* 3.x: (23 commits)
Bump version
Prepare the 3.26.0 release
Update CHANGELOG
Document that the sandbox doesn't protect against resource exhaustion
Document template_from_string caveats when used in a sandboxed env
Pre-escape HTML input on the `spaceless` filter
Add docs on Markup about the goal of this class in the context of a sandbox
Fix sandbox bypass in the "column" filter
Fix sandbox `__toString` bypasses
Validate macro name in MacroReferenceExpression constructor
Fix sandbox bypass: PHP code injection via _self / import macro reference
Fix deprecations in tests
Fix sandbox bypass in the `{% sandbox %}` tag when including a preloaded template
Encode single quotes as \x27 in Compiler::string()
Fix sandbox bypass: PHP code injection via {% use %} template name
Fix unbounded memoisation of `IntlDateFormatter` / `NumberFormatter`
Fix deprecation
[Profiler] Escape template and profile names in HtmlDumper
Bump version
Fix sandbox bypass: propagate sandbox state to checkArrow for source-policy sandboxing
...
# Conflicts:
# CHANGELOG
# doc/filters/spaceless.rst
# extra/cssinliner-extra/CssInlinerExtension.php
# extra/inky-extra/InkyExtension.php
# extra/markdown-extra/MarkdownExtension.php
# src/Environment.php
# src/ExpressionParser/Infix/DotExpressionParser.php
# src/Extension/CoreExtension.php
# src/Node/Expression/FilterExpression.php
# src/Node/Expression/FunctionExpression.php
# src/Node/Expression/TestExpression.php
# src/Node/ModuleNode.php
# src/NodeVisitor/SandboxNodeVisitor.php
# src/Resources/core.php
# src/TokenParser/SandboxTokenParser.php
# tests/Extension/SandboxTest.php
Both filters consume HTML on the input side. Adding `pre_escape => 'html'`
makes the autoescaper escape attacker-controlled inputs before the filters
process them, so they are no longer reachable via `{{ user_input|inline_css }}`
or `{{ user_input|inky_to_html }}` without an explicit `|raw`.
The `html_to_markdown` filter emits plain Markdown text, so the
`is_safe` annotation is dropped entirely and autoescape now handles
its output according to the surrounding context.
The `markdown_to_html` and `inline_css` filters emit HTML, not text
safe in every escaping context, so `is_safe => ['all']` produced
unescaped HTML when their output was interpolated into a JS, CSS or
URL context. The annotation is now `is_safe => ['html']`.
* 3.x:
Fix tiny typo in CI workflow label
Fix typo
Fix opcache preload warning for unlinked anonymous class
Bump version
Prepare the 3.22.2 release
Add .gitignore & .gitattributes to all .gitattributes
* 3.x:
Validate the input of CoreExtension::map()
Rename AbstractTest to ProfilerTestCase
Make data providers static
Prepare IntegrationTestCase for static data providers
* 3.x:
Bump version to 3.9.4-DEV
Fix a warning
Use ::class everywhere
Auto-close PRs on subtree-splits
Bump version
Prepare the 3.9.3 release
Update CHANGELOG
Ensure Lexer:: is always initialized
fix: #4033 add missing unwrap call when a TemplateWrapper instance can be present
change extended DI extension class
fix: #4029 when use_yield is true CaptureNode use iterator_to_array preserveKeys argument to false
* 3.x:
Fix CS
Move functions for CoreExtension
Move functions for EscaperExtension
Move functions for StringLoaderExtension
Move functions for DebugExtension
Move functions for MarkdownExtension
Move functions for InkyExtension
Move functions for CssInlinerExtension
Move functions for HtmlExtension
Deprecate internal extension functions in favor of methods on the extension classes
Tweak deprecated docs
Fabien Potencier
Nicolas Grekas
jmsche
Alexander M. Turek
Simon André
Kevin Bond
Christian Flothmann
noniagriconomie