From a165ce67d435880f3d66077a3b069d7994e46b95 Mon Sep 17 00:00:00 2001
From: Fabien Potencier <fabien@potencier.org>
Date: Tue, 16 Apr 2019 18:31:51 +0200
Subject: [PATCH] added the source for all sandbox security exceptions

---
 src/Extension/CoreExtension.php         |  4 +--
 src/Extension/SandboxExtension.php      | 33 ++++++++++++++++++++-----
 src/Node/CheckToStringNode.php          |  2 +-
 src/Node/SandboxedPrintNode.php         |  2 +-
 src/Sandbox/SecurityPolicyInterface.php |  9 +++++++
 5 files changed, 40 insertions(+), 10 deletions(-)

diff --git a/src/Extension/CoreExtension.php b/src/Extension/CoreExtension.php
index 2860a5676..227c576e2 100644
--- a/src/Extension/CoreExtension.php
+++ b/src/Extension/CoreExtension.php
@@ -1601,7 +1601,7 @@ function twig_get_attribute(Environment $env, Source $source, $object, $item, ar
             }
 
             if ($sandboxed) {
-                $env->getExtension(SandboxExtension::class)->checkPropertyAllowed($object, $item);
+                $env->getExtension(SandboxExtension::class)->checkPropertyAllowed($object, $item, $source);
             }
 
             return $object->$item;
@@ -1678,7 +1678,7 @@ function twig_get_attribute(Environment $env, Source $source, $object, $item, ar
     }
 
     if ($sandboxed) {
-        $env->getExtension(SandboxExtension::class)->checkMethodAllowed($object, $method);
+        $env->getExtension(SandboxExtension::class)->checkMethodAllowed($object, $method, $source);
     }
 
     // Some objects throw exceptions when they have __call, and the method we try
diff --git a/src/Extension/SandboxExtension.php b/src/Extension/SandboxExtension.php
index 09ea286e7..f6267b64d 100644
--- a/src/Extension/SandboxExtension.php
+++ b/src/Extension/SandboxExtension.php
@@ -12,7 +12,10 @@
 namespace Twig\Extension;
 
 use Twig\NodeVisitor\SandboxNodeVisitor;
+use Twig\Sandbox\SecurityNotAllowedMethodError;
+use Twig\Sandbox\SecurityNotAllowedPropertyError;
 use Twig\Sandbox\SecurityPolicyInterface;
+use Twig\Source;
 use Twig\TokenParser\SandboxTokenParser;
 
 final class SandboxExtension extends AbstractExtension
@@ -74,24 +77,42 @@ final class SandboxExtension extends AbstractExtension
         }
     }
 
-    public function checkMethodAllowed($obj, $method)
+    public function checkMethodAllowed($obj, $method, Source $source = null)
     {
         if ($this->isSandboxed()) {
-            $this->policy->checkMethodAllowed($obj, $method);
+            try {
+                $this->policy->checkMethodAllowed($obj, $method);
+            } catch (SecurityNotAllowedMethodError $e) {
+                $e->setSourceContext($source);
+
+                throw $e;
+            }
         }
     }
 
-    public function checkPropertyAllowed($obj, $method)
+    public function checkPropertyAllowed($obj, $method, Source $source = null)
     {
         if ($this->isSandboxed()) {
-            $this->policy->checkPropertyAllowed($obj, $method);
+            try {
+                $this->policy->checkPropertyAllowed($obj, $method);
+            } catch (SecurityNotAllowedPropertyError $e) {
+                $e->setSourceContext($source);
+
+                throw $e;
+            }
         }
     }
 
-    public function ensureToStringAllowed($obj)
+    public function ensureToStringAllowed($obj, Source $source = null)
     {
         if ($this->isSandboxed() && \is_object($obj) && method_exists($obj, '__toString')) {
-            $this->policy->checkMethodAllowed($obj, '__toString');
+            try {
+                $this->policy->checkMethodAllowed($obj, '__toString');
+            } catch (SecurityNotAllowedMethodError $e) {
+                $e->setSourceContext($source);
+
+                throw $e;
+            }
         }
 
         return $obj;
diff --git a/src/Node/CheckToStringNode.php b/src/Node/CheckToStringNode.php
index 5d6746791..b20fb3d4c 100644
--- a/src/Node/CheckToStringNode.php
+++ b/src/Node/CheckToStringNode.php
@@ -36,7 +36,7 @@ class CheckToStringNode extends AbstractExpression
         $compiler
             ->raw('$this->sandbox->ensureToStringAllowed(')
             ->subcompile($this->getNode('expr'))
-            ->raw(')')
+            ->raw(', $this->source)')
         ;
     }
 }
diff --git a/src/Node/SandboxedPrintNode.php b/src/Node/SandboxedPrintNode.php
index 8c4d213cb..97df3438a 100644
--- a/src/Node/SandboxedPrintNode.php
+++ b/src/Node/SandboxedPrintNode.php
@@ -43,7 +43,7 @@ class SandboxedPrintNode extends PrintNode
             $compiler
                 ->write('$this->extensions[SandboxExtension::class]->ensureToStringAllowed(')
                 ->subcompile($expr)
-                ->raw(");\n")
+                ->raw(", \$this->source);\n")
             ;
         }
     }
diff --git a/src/Sandbox/SecurityPolicyInterface.php b/src/Sandbox/SecurityPolicyInterface.php
index d2d783d48..e7fddeef0 100644
--- a/src/Sandbox/SecurityPolicyInterface.php
+++ b/src/Sandbox/SecurityPolicyInterface.php
@@ -18,10 +18,19 @@ namespace Twig\Sandbox;
  */
 interface SecurityPolicyInterface
 {
+    /**
+     * @throws SecurityError
+     */
     public function checkSecurity($tags, $filters, $functions);
 
+    /**
+     * @throws SecurityNotAllowedMethodError
+     */
     public function checkMethodAllowed($obj, $method);
 
+    /**
+     * @throws SecurityNotAllowedPropertyError
+     */
     public function checkPropertyAllowed($obj, $method);
 }