geckon01/Twig
1
0
Fork 0
mirror of https://github.com/twigphp/Twig.git synced 2026-10-20 10:45:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Deprecate the fact that the parent, block, and attribute functions are always allowed in a sandboxed template

Browse Source
This commit is contained in:
Fabien Potencier
2026-05-24 21:19:08 +02:00
parent d0a5017fd5
commit cfaa2fd030
6 changed files with 132 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/ExpressionParser/Infix/FunctionExpressionParser.php
+7 -1
View File
@@ -54,7 +54,13 @@ final class FunctionExpressionParser extends AbstractExpressionParser implements
$fakeNode = new EmptyNode($line);
$fakeNode->setSourceContext($parser->getStream()->getSourceContext());
return ($function->getParserCallable())($parser, $fakeNode, $args, $line);
$node = ($function->getParserCallable())($parser, $fakeNode, $args, $line);
// remember the original function name so the sandbox can enforce
// the `allowedFunctions` allow-list even though the parser callable
// returned a specialized node (e.g. `parent`, `block`, `attribute`).
$node->setAttribute('sandboxed_function_name', $name);
return $node;
}
if (!isset($this->readyNodes[$class = $function->getNodeClass()])) {