* 3.x: (26 commits)
Remove the documentation comments compilation overhead
Clarify source function trust requirements
Throw on PCRE errors in the matches operator
Document that reusing a non-rewindable iterator after destructuring is unsupported
Release destructuring temporaries after assignment
Deprecate prefixed macro definedness checks
Fix duplicate macro deprecation wording
Throw when list formatting fails
Document that sequence destructuring consumes one value per pattern slot
Fix the html_attr documentation about iterables in data attributes
Warn about untrusted input with the default Tempest markdown converter
Document that overriding MacroNode::compile() is not supported anymore
Merge overlapping CHANGELOG entries for the destructuring fatal error fix
Document that include_only keeps global variables available
Remove lazy macro import resolution
Honor date formatter prototype calendars
Fix Stringable keys for ArrayAccess implementations
Fix repeated object destructuring evaluation
Restore void return type compatibility for extension points
Reject destructuring patterns containing no variables
...
# Conflicts:
# CHANGELOG
# doc/deprecated.rst
# doc/filters/format_datetime.rst
# extra/twig-extra-bundle/DependencyInjection/Compiler/MissingExtensionSuggestorPass.php
# extra/twig-extra-bundle/DependencyInjection/TwigExtraExtension.php
# extra/twig-extra-bundle/TwigExtraBundle.php
# src/MacroNamespace.php
# src/Node/MacrosNode.php
# src/Parser.php
# src/Test/IntegrationTestCase.php
# src/Test/NodeTestCase.php
# tests/CallMacroTest.php
# tests/ExpressionParserTest.php
# tests/Fixtures/macros/duplicate_definition.legacy.test
# tests/Node/MacrosTest.php
# tests/ParserTest.php
* 3.x:
Make the sandbox a first-class citizen with a dedicated Sandbox class
# Conflicts:
# CHANGELOG
# doc/deprecated.rst
# doc/tags/sandbox.rst
# phpstan-baseline.neon
# src/Extension/CoreExtension.php
# src/Extension/SandboxExtension.php
# src/Sandbox/SecurityPolicy.php
* 3.x:
Handle single-node child template bodies in cleanup
Keep captured block definitions supported
Clarify captured block deprecation wording
Simplify correctness visitor checks
Move extends validation into correctness visitor
Fix correctness visitor regressions
Fix test assertions that did not verify the intended behavior
Address review: fix block-nesting checks in CorrectnessNodeVisitor
Move the extends-in-block and extends-in-macro errors into the CorrectnessNodeVisitor
Introduce a CorrectnessNodeVisitor to validate that templates are semantically correct
Mark Markup as final
Allow calling a macro with a dynamic name via the dot operator
Add an allow-list for tests to the sandbox security policy
Fix markdown_to_html mangling content that starts with a blank line
# Conflicts:
# CHANGELOG
# doc/deprecated.rst
# doc/sandbox.rst
# src/ExpressionParser/Infix/DotExpressionParser.php
# src/Extension/CoreExtension.php
# src/Markup.php
# src/Node/CheckSecurityNode.php
# src/Node/Expression/Filter/DefaultFilter.php
# src/Node/Expression/NullCoalesceExpression.php
# src/Node/IfNode.php
# src/NodeVisitor/SandboxNodeVisitor.php
# src/Parser.php
# src/Sandbox/SecurityPolicy.php
# tests/Extension/SandboxTest.php
# tests/ParserTest.php
This PR was merged into the 3.x branch.
Discussion
----------
Allow calling a macro with a dynamic name via the dot operator
Closes#4715
Commits
-------
87093aab9e Allow calling a macro with a dynamic name via the dot operator
* 3.x:
Reduce memory usage of the context restoration compiled at the end of for loops
Clarify sandbox always-allowed trust boundary
Bump version to 3.28.0 for the always_allowed_in_sandbox feature
Add regression tests that always-allowed callables still enforce the sandbox __toString policy on arguments
Document the criteria for always-allowed sandbox items and list 4.0 built-ins
Add an always_allowed_in_sandbox flag for filters, functions, and tags
Remove issue references in tests
Avoid allocating a normalized copy when counting newlines without carriage returns
Report columns in syntax errors
Track the source offset of each token
# Conflicts:
# CHANGELOG
# doc/deprecated.rst
# doc/sandbox.rst
# src/Environment.php
# src/Error/Error.php
# src/Lexer.php
# src/Node/ForNode.php
# src/Token.php
# src/TwigCallableInterface.php
# tests/Extension/SandboxTest.php
# tests/Node/ForTest.php
* 3.x:
Document how to customize the markdown_to_html converter
Make the include() function return a Markup object
Fix nested block() resolution when a directly rendered block calls parent()
Fix nested block() resolution when a directly rendered block calls parent()
Document storing an enum in a variable to avoid repeating its FQCN
Stop reporting a skipped test in IntegrationTestCase when there is no legacy test to run
Document {#--#} as the replacement for the deprecated spaceless filter
Skip the string cast in PrintNode when the expression is already a string and add tests
Ensure PrintNode is yielding string content
CoreExtension::getAttribute: small improvement regarding getter/isser/hasser
# Conflicts:
# CHANGELOG
# tests/Node/ForTest.php
* 3.x:
Skip the sandbox `__toString` check on arguments whose PHP parameter type cannot implicitly coerce to string
Fix CS
Bump version
Prepare the 3.27.1 release
Fix inconsistent array access with a Stringable key
Preserve IteratorAggregate identity in sandbox __toString walker
Fix tests
Bump version
Prepare the 3.27.0 release
Fix sandbox filter/tag/function allow-list bypass when sandbox state changes between renders
Document new support for any expression as a dynamic mapping key
Fix sandbox __toString policy bypass via dynamic mapping keys
Fix deprecation notices in tests
Guard sandbox `__toString` walker against self-referencing iterables
Fix sandbox `__toString` bypass via `Stringable` + `Traversable` containers
Fix sandbox `__toString` bypass via the `in` and `not in` operators
Fix sandbox __toString bypass via Traversable in join/replace filters
Mark new SourcePolicyInterface column filter tests as @group legacy
Fix sandbox bypass in the "column" filter under SourcePolicyInterface
Fix sandbox bypass in deprecated internal wrappers
# Conflicts:
# CHANGELOG
# src/Environment.php
# src/Node/Expression/ArrayExpression.php
# src/Node/Expression/CallExpression.php
# src/Resources/core.php
# src/Template.php
# src/Util/CallableArgumentsExtractor.php
# src/Util/ReflectionCallable.php
# tests/Extension/SandboxTest.php
# tests/Resources/LegacyCoreTest.php
# tests/TemplateTest.php
These tests pass a SourcePolicyInterface instance to SandboxExtension, which
triggers the 3.27 deprecation. Mark them legacy and assert the deprecation
to silence the PHPUnit "unhandled deprecation" report.
* 3.x:
Add a strict mode to SecurityPolicy to opt-in to the 4.0 sandbox behavior for the extends/use tags and the parent/block/attribute functions
# Conflicts:
# CHANGELOG
# doc/deprecated.rst
# doc/sandbox.rst
# src/Sandbox/SecurityPolicy.php
# tests/Extension/SandboxTest.php
Fabien Potencier