3 Commits

Author	SHA1	Message	Date
Fabien Potencier	87093aab9e	Allow calling a macro with a dynamic name via the dot operator	2026-06-06 17:10:52 +02:00
Fabien Potencier	8a4b77920a	Add PHPUnit attributes alongside annotations to silence doc-comment metadata deprecations on PHPUnit 11	2026-06-03 18:26:39 +02:00
Fabien Potencier	ea3f7a2844	Validate macro name in MacroReferenceExpression constructor ... The name passed to MacroReferenceExpression is emitted as raw PHP in compile() via "->{$name}(...)". Callers were expected to validate the name, but a missing check led to CVE-2026-XXXXX (PHP code injection via _self / import macro reference): defense-in-depth, validate the name in the constructor so the class is safe by construction.	2026-05-19 23:42:31 +02:00