8a4b77920a
Add PHPUnit attributes alongside annotations to silence doc-comment metadata deprecations on PHPUnit 11
2026-06-03 18:26:39 +02:00
6d5ef30436
Skip the sandbox __toString check on arguments whose PHP parameter type cannot implicitly coerce to string
2026-06-02 13:58:24 +02:00
d25f98f45b
Preserve IteratorAggregate identity in sandbox __toString walker
2026-05-29 09:31:03 +02:00
635cea4789
Document new support for any expression as a dynamic mapping key
2026-05-27 14:54:58 +02:00
9ff4101463
Fix sandbox __toString policy bypass via dynamic mapping keys
2026-05-27 14:54:34 +02:00
e3f66654b8
Fix deprecation notices in tests
2026-05-27 14:53:02 +02:00
475fb690ac
Guard sandbox __toString walker against self-referencing iterables
2026-05-27 14:53:02 +02:00
e9e818cbfc
Fix sandbox __toString bypass via Stringable + Traversable containers
2026-05-27 14:53:01 +02:00
8d6af0707b
Fix sandbox __toString bypass via the in and not in operators
2026-05-27 14:52:32 +02:00
cc1e21a2a2
Fix sandbox __toString bypass via Traversable in join/replace filters
2026-05-27 14:52:30 +02:00
afbaa2a9da
Mark new SourcePolicyInterface column filter tests as @group legacy
...
These tests pass a SourcePolicyInterface instance to SandboxExtension, which
triggers the 3.27 deprecation. Mark them legacy and assert the deprecation
to silence the PHPUnit "unhandled deprecation" report.
2026-05-27 14:49:53 +02:00
09c6706407
Fix sandbox bypass in the "column" filter under SourcePolicyInterface
2026-05-27 14:49:52 +02:00
af7bf5e181
Add a strict mode to SecurityPolicy to opt-in to the 4.0 sandbox behavior for the extends/use tags and the parent/block/attribute functions
2026-05-25 13:40:27 +02:00
cfaa2fd030
Deprecate the fact that the parent, block, and attribute functions are always allowed in a sandboxed template
2026-05-24 21:19:56 +02:00
33690a4a28
Fix PHP 8.1+ implicit float-to-int deprecation in sandboxed array access
2026-05-24 17:39:37 +02:00
4fc0210084
Bump version
2026-05-23 08:32:22 +02:00
bd924d5d33
Deprecate the "Twig\Sandbox\SourcePolicyInterface" interface
2026-05-23 08:30:05 +02:00
a0a1f1d17d
Replace FQCN with use statements in SandboxTest
2026-05-22 12:08:11 +02:00
4a64b5b486
Fix CS
2026-05-21 16:34:23 +02:00
f05c5011c2
Fix sandbox bypass in the "column" filter
2026-05-20 07:33:52 +02:00
447d0b2331
Fix sandbox __toString bypasses
2026-05-20 00:18:59 +02:00
324fa60545
Fix sandbox bypass: PHP code injection via _self / import macro reference
2026-05-19 23:41:59 +02:00
aeb37f4801
Fix deprecations in tests
2026-05-19 23:05:30 +02:00
819c6a89fe
Fix sandbox bypass in the {% sandbox %} tag when including a preloaded template
2026-05-19 23:00:58 +02:00
e494400ce4
Fix deprecation
2026-05-19 22:05:26 +02:00
a8eb5a8a74
security #cve-2026-46639 Fix sandbox bypass in object destructuring assignment (alexandre-daubois)
...
This PR was merged into the twig-3.x branch.
2026-05-19 21:37:04 +02:00
d0579ededc
Fix sandbox bypass: propagate sandbox state to checkArrow for source-policy sandboxing
2026-05-16 18:56:08 +01:00
5462817da0
Add a needs_is_sandboxed option for filters, functions, and tests
2026-05-16 18:52:17 +01:00
3fe13f98f8
Fix sandbox bypass in object destructuring assignment
2026-04-28 12:59:06 +02:00
85a4817128
CS fixes
2025-07-29 10:07:07 +02:00
76062c8d51
Fix CS
2025-01-19 16:54:05 +01:00
d72ae2447e
Merge branch '3.14.x' into 3.x
...
* 3.14.x:
Improve detection of recursion
Fix recursion when arrays contain self-references in sandboxed mode
Fix code
Prepare the 3.11.2 release
Update CHANGELOG
Sandbox ArrayAccess and do sandbox checks before isset() checks
Fix sandbox handling for __toString()
Prepare the 3.14.1 release
Update CHANGELOG
Sandbox ArrayAccess and do sandbox checks before isset() checks
Fix sandbox handling for __toString()
Prepare the 3.11.1 release
Fix a security issue when an included sandboxed template has been loaded before without the sandbox context
2024-11-07 11:17:57 +01:00
83a21d31e5
Merge branch '3.11.x' into 3.14.x
...
* 3.11.x:
Improve detection of recursion
Fix recursion when arrays contain self-references in sandboxed mode
Fix code
Prepare the 3.11.2 release
Update CHANGELOG
Sandbox ArrayAccess and do sandbox checks before isset() checks
Fix sandbox handling for __toString()
Prepare the 3.11.1 release
Fix a security issue when an included sandboxed template has been loaded before without the sandbox context
2024-11-07 11:11:36 +01:00
a0f775683d
Fix recursion when arrays contain self-references in sandboxed mode
2024-11-07 09:42:22 +01:00
b957e5a44c
Sandbox ArrayAccess and do sandbox checks before isset() checks
2024-11-06 21:41:25 +01:00
d4a302681b
Fix sandbox handling for __toString()
2024-11-06 21:35:53 +01:00
ec39a9dccc
Sandbox ArrayAccess and do sandbox checks before isset() checks
2024-11-06 19:48:59 +01:00
cafc608ece
Fix sandbox handling for __toString()
2024-11-06 19:27:48 +01:00
831c148e78
Sandbox ArrayAccess and do sandbox checks before isset() checks
2024-11-06 19:16:07 +01:00
2bb8c2460a
Fix sandbox handling for __toString()
2024-11-05 17:54:37 +01:00
9369a48c53
Deprecate the sandbox tag
2024-09-10 22:41:00 +02:00
2ae0c0d38c
Fix CS
2024-09-06 12:33:38 +02:00
797e490356
Improve exception expectations reliability
2024-09-04 15:22:48 +02:00
6ddb76bb76
Make data providers static
2024-09-03 16:32:00 +02:00
8663ec242b
fix typo
2024-08-28 14:18:47 +02:00
5fca700cbd
Deprecate the fact that the extends and use tags are always allowed in a sandboxed template
2024-08-28 13:40:53 +02:00
e6a98a000f
Fix test without any assertions
2023-12-20 20:34:04 +01:00
fca89954f1
Simplify tests
2023-12-20 20:34:04 +01:00
204cd6f412
Merge branch '2.x' into 3.x
...
* 2.x:
Add SourcePolicyInterface to selectively enable the Sandbox based on a template's Source
2023-12-19 08:19:15 +01:00
a18da1614a
Add SourcePolicyInterface to selectively enable the Sandbox based on a template's Source
2023-12-19 08:18:35 +01:00
Fabien Potencier
Alexandre Daubois
Nicolas Grekas
Lee Rowlands
Alexander M. Turek
Christian Flothmann
Yaakov Saxon