added the source for all sandbox security exceptions

src/Extension/CoreExtension.php

@@ -1601,7 +1601,7 @@ function twig_get_attribute(Environment $env, Source $source, $object, $item, ar
             }
 
             if ($sandboxed) {
-                $env->getExtension(SandboxExtension::class)->checkPropertyAllowed($object, $item);
+                $env->getExtension(SandboxExtension::class)->checkPropertyAllowed($object, $item, $source);
             }
 
             return $object->$item;
@@ -1678,7 +1678,7 @@ function twig_get_attribute(Environment $env, Source $source, $object, $item, ar
     }
 
     if ($sandboxed) {
-        $env->getExtension(SandboxExtension::class)->checkMethodAllowed($object, $method);
+        $env->getExtension(SandboxExtension::class)->checkMethodAllowed($object, $method, $source);
     }
 
     // Some objects throw exceptions when they have __call, and the method we try

src/Extension/SandboxExtension.php

@@ -12,7 +12,10 @@
 namespace Twig\Extension;
 
 use Twig\NodeVisitor\SandboxNodeVisitor;
+use Twig\Sandbox\SecurityNotAllowedMethodError;
+use Twig\Sandbox\SecurityNotAllowedPropertyError;
 use Twig\Sandbox\SecurityPolicyInterface;
+use Twig\Source;
 use Twig\TokenParser\SandboxTokenParser;
 
 final class SandboxExtension extends AbstractExtension
@@ -74,24 +77,42 @@ final class SandboxExtension extends AbstractExtension
         }
     }
 
-    public function checkMethodAllowed($obj, $method)
+    public function checkMethodAllowed($obj, $method, Source $source = null)
     {
         if ($this->isSandboxed()) {
-            $this->policy->checkMethodAllowed($obj, $method);
+            try {
+                $this->policy->checkMethodAllowed($obj, $method);
+            } catch (SecurityNotAllowedMethodError $e) {
+                $e->setSourceContext($source);
+
+                throw $e;
+            }
         }
     }
 
-    public function checkPropertyAllowed($obj, $method)
+    public function checkPropertyAllowed($obj, $method, Source $source = null)
     {
         if ($this->isSandboxed()) {
-            $this->policy->checkPropertyAllowed($obj, $method);
+            try {
+                $this->policy->checkPropertyAllowed($obj, $method);
+            } catch (SecurityNotAllowedPropertyError $e) {
+                $e->setSourceContext($source);
+
+                throw $e;
+            }
         }
     }
 
-    public function ensureToStringAllowed($obj)
+    public function ensureToStringAllowed($obj, Source $source = null)
     {
         if ($this->isSandboxed() && \is_object($obj) && method_exists($obj, '__toString')) {
-            $this->policy->checkMethodAllowed($obj, '__toString');
+            try {
+                $this->policy->checkMethodAllowed($obj, '__toString');
+            } catch (SecurityNotAllowedMethodError $e) {
+                $e->setSourceContext($source);
+
+                throw $e;
+            }
         }
 
         return $obj;

src/Node/CheckToStringNode.php

@@ -36,7 +36,7 @@ class CheckToStringNode extends AbstractExpression
         $compiler
             ->raw('$this->sandbox->ensureToStringAllowed(')
             ->subcompile($this->getNode('expr'))
-            ->raw(')')
+            ->raw(', $this->source)')
         ;
     }
 }

src/Node/SandboxedPrintNode.php

@@ -43,7 +43,7 @@ class SandboxedPrintNode extends PrintNode
             $compiler
                 ->write('$this->extensions[SandboxExtension::class]->ensureToStringAllowed(')
                 ->subcompile($expr)
-                ->raw(");\n")
+                ->raw(", \$this->source);\n")
             ;
         }
     }

src/Sandbox/SecurityPolicyInterface.php

@@ -18,10 +18,19 @@ namespace Twig\Sandbox;
  */
 interface SecurityPolicyInterface
 {
+    /**
+     * @throws SecurityError
+     */
     public function checkSecurity($tags, $filters, $functions);
 
+    /**
+     * @throws SecurityNotAllowedMethodError
+     */
     public function checkMethodAllowed($obj, $method);
 
+    /**
+     * @throws SecurityNotAllowedPropertyError
+     */
     public function checkPropertyAllowed($obj, $method);
 }