The name passed to MacroReferenceExpression is emitted as raw PHP in
compile() via "->{$name}(...)". Callers were expected to validate
the name, but a missing check led to CVE-2026-XXXXX (PHP code injection
via _self / import macro reference): defense-in-depth, validate the
name in the constructor so the class is safe by construction.
This PR was merged into the 3.x branch.
Discussion
----------
Support short-circuiting in null-safe operator chains
This PR adds short-circuiting for null-safe operator chains, using the same rules as PHP, `PropertyAccess`, and the `ExpressionLanguage`.
Previously, only the immediate null-safe access was guarded. With this change, as soon as a `null` is encountered at a null-safe access, the rest of the chain is skipped.
My approach was to move the null check outside of the `getAttribute()` calls so the expression can immediately return `null`, eg:
```twig
foo?.bar.baz
```
Before:
```php
yield $this->env
->getRuntime('Twig\Runtime\EscaperRuntime')
->escape(
CoreExtension::getAttribute(
$this->env,
$this->source,
(
null === (
$_v0 = (
isset($context['foo']) || array_key_exists('foo', $context)
? $context['foo']
: throw new RuntimeError('Variable "foo" does not exist.', 3, $this->source)
)
)
? null
: CoreExtension::getAttribute(
$this->env,
$this->source,
$_v0,
'bar',
[],
'any',
false,
false,
false,
3
)
),
'baz',
[],
'any',
false,
false,
false,
3
),
'html',
null,
true
);
```
Now:
```php
yield $this->env
->getRuntime('Twig\Runtime\EscaperRuntime')
->escape(
(
null === (
$_v0 = (
isset($context['foo']) || array_key_exists('foo', $context)
? $context['foo']
: throw new RuntimeError('Variable "foo" does not exist.', 3, $this->source)
)
)
? null
: CoreExtension::getAttribute(
$this->env,
$this->source,
CoreExtension::getAttribute(
$this->env,
$this->source,
$_v0,
'bar',
[],
'any',
false,
false,
false,
3
),
'baz',
[],
'any',
false,
false,
false,
3
)
),
'html',
null,
true
);
```
Commits
-------
d56e8e2dba Support short-circuiting in null-safe operator chains
This PR was merged into the 3.x branch.
Discussion
----------
Add return type to compiled macro
This makes it easier for TwigStan to analyze the return type.
Commits
-------
1e7c719e24 Add return type to compiled macro
This PR was merged into the 3.x branch.
Discussion
----------
Rename Node classes related to variables
Whenever I work on Twig internals, it's always complicated to reason about variable names, probably because the class names are confusing. This PR is an attempt to find "better" and more explicit names.
This PR does the following renaming:
* `NameExpression` to `Variable\ContextVariable`
Represents the value of a context variable like `$context[VAR] ?? null`
* `AssignNameExpression` to `Variable\AssignContextVariable`
Represents a context variable assignment like in `$context[VAR] = `
* `TempNameExpression` to `Variable\LocalVariable`
Represents a "private" local variable like `$_l111`
Commits
-------
fc15e7ccbc Rename Node classes related to variables
This PR was squashed before being merged into the 3.x branch.
Discussion
----------
Documentation for types tag uses Twig types in examples instead of PHP
Specifically, "bool" => "boolean" and "int" => "number".
This aligns the `types` documentation with templates.rst. See #4362
Thanks, `@alexander`-schranz!
Commits
-------
f3e0a00cf0 Documentation for types tag uses Twig types in examples instead of PHP
This PR was merged into the 3.x branch.
Discussion
----------
Fix isset in ForLoopNode
Even though the code works perfectly fine, PHPStan doesn't understand it.
> Offset 'revindex0' does not exist on array{parent: array{index0: int<1, max>, index: int<2, max>, first: false, revindex0?: int, revindex?: int, length: int<0, max>, last?: bool}.
> Offset 'revindex' does not exist on array{parent: array{index0: int<1, max>, index: int<2, max>, first: false, revindex0: int, revindex?: int, length: int<0, max>, last?: bool}.
Since we want to work with `revindex` and `revindex0`, we can better check for their existence, instead of `length`.
/cc `@stof` `@fabpot`
Commits
-------
2b887e64 Fix isset in ForLoopNode
Even though the code works perfectly fine, PHPStan doesn't understand it.
Since we want to work with `revindex` and `revindex0`, we can better check for their
existence, instead of `length`.
Currently, the PHPDoc states that a string should be returned, but that's not correct.
It can be anything that is echo-able.
That means any scalar, Stringable and even null.
This PR was merged into the 3.x branch.
Discussion
----------
Migrate NodeTestCase to static data providers
PHPUnit 11 requires data providers to be static. This PR prepares our abstract `NodeTestCase` by deprecating the non-static `getTests()` and adding a static `provideTests()` as a replacement. I've also added PHPUnit attributes which newer PHPUnit releases prefer over PHPDoc annotations.
Commits
-------
f555a33c Migrate NodeTestCase to static data providers
Fabien Potencier
Alexandre Daubois
HypeMC
Felds Liscia
Simon André
Nicolas Grekas
Ruud Kamphuis
Jeroen Versteeg
Alexander M. Turek