Validate macro name in MacroReferenceExpression constructor

The name passed to MacroReferenceExpression is emitted as raw PHP in
compile() via "->{$name}(...)". Callers were expected to validate
the name, but a missing check led to CVE-2026-XXXXX (PHP code injection
via _self / import macro reference): defense-in-depth, validate the
name in the constructor so the class is safe by construction.

src/Node/Expression/MacroReferenceExpression.php

@@ -26,6 +26,14 @@ class MacroReferenceExpression extends AbstractExpression implements SupportDefi
 
     public function __construct(TemplateVariable $template, string $name, AbstractExpression $arguments, int $lineno)
     {
+        // The name is emitted as raw PHP in compile() via "->{$name}(...)",
+        // so it must be a valid PHP method identifier. Reject anything else
+        // as a defense-in-depth against accidental PHP code injection from
+        // a caller that forgot to validate user-controlled input.
+        if (!preg_match('#^[a-zA-Z_\x7f-\xff][a-zA-Z0-9_\x7f-\xff]*$#D', $name)) {
+            throw new \LogicException(\sprintf('Macro name "%s" is not a valid PHP identifier.', $name));
+        }
+
         parent::__construct(['template' => $template, 'arguments' => $arguments], ['name' => $name], $lineno);
     }
 

tests/Node/Expression/MacroReferenceTest.php

@@ -0,0 +1,41 @@
+<?php
+
+/*
+ * This file is part of Twig.
+ *
+ * (c) Fabien Potencier
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Twig\Tests\Node\Expression;
+
+use PHPUnit\Framework\TestCase;
+use Twig\Node\Expression\ArrayExpression;
+use Twig\Node\Expression\MacroReferenceExpression;
+use Twig\Node\Expression\Variable\TemplateVariable;
+
+class MacroReferenceTest extends TestCase
+{
+    /**
+     * @dataProvider provideInvalidMacroNames
+     */
+    public function testConstructorRejectsNonIdentifierName(string $name)
+    {
+        $this->expectException(\LogicException::class);
+        $this->expectExceptionMessage(\sprintf('Macro name "%s" is not a valid PHP identifier.', $name));
+
+        new MacroReferenceExpression(new TemplateVariable('foo', 1), $name, new ArrayExpression([], 1), 1);
+    }
+
+    public static function provideInvalidMacroNames(): iterable
+    {
+        yield 'empty' => [''];
+        yield 'starts with digit' => ['1foo'];
+        yield 'contains space' => ['foo bar'];
+        yield 'contains semicolon' => ['foo;bar'];
+        yield 'PHP injection payload' => ['macro_foo + 1; trigger_error("BAD") //'];
+        yield 'contains NUL byte' => ["foo\x00bar"];
+    }
+}