This PR was merged into the 3.x branch.
Discussion
----------
CoreExtension::getAttribute: small improvement regarding getter/isser/hasser
For a getter method like `getFirstName` it is common to call it in twig via `person.firstName`.
But at the moment twig is adding these variants to the class method cache: `getFirstName`, `getfirstname`, `FirstName` and `firstname`.
So when resolving the name, it uses the first `elseif` here with additional `strtolower` call, because `firstName` is missing:
https://github.com/twigphp/Twig/blob/403bd9d73c2a010e5b26689f2f2eb9d7ddf391af/src/Extension/CoreExtension.php#L1863-L1867
This PR replaces `FirstName` with `firstName` in the method cache.
So `person.firstName` is resolved via first `if` branch (but `person.FirstName` would use the `elseif` with `strtolower` now).
Commits
-------
45cd6ffe80 CoreExtension::getAttribute: small improvement regarding getter/isser/hasser
This PR was merged into the 3.x branch.
Discussion
----------
Make the include() function return a Markup object
Closes#4754
Commits
-------
a3eda4b1fd Make the include() function return a Markup object
This PR was merged into the 3.x branch.
Discussion
----------
Fix nested block() resolution when a directly rendered block calls parent()
Closes#3321
Commits
-------
279fe13b22 Fix nested block() resolution when a directly rendered block calls parent()
This PR was merged into the 3.x branch.
Discussion
----------
Document {#--#} as the replacement for the deprecated spaceless filter
Closes#4442
Commits
-------
c29877f54a Document {#--#} as the replacement for the deprecated spaceless filter
This PR was merged into the 3.x branch.
Discussion
----------
Stop reporting a skipped test in IntegrationTestCase when there is no legacy test to run
Closes#4635
Commits
-------
86076c87a6 Stop reporting a skipped test in IntegrationTestCase when there is no legacy test to run
This PR was merged into the 3.x branch.
Discussion
----------
Document storing an enum in a variable to avoid repeating its FQCN
Closes#4646
Commits
-------
e1178abfa1 Document storing an enum in a variable to avoid repeating its FQCN
This PR was merged into the 3.x branch.
Discussion
----------
Cast printed expressions to string so values that cannot be converted to a string (arrays, non-`Stringable` objects, ...) report a usable stack trace at the print location
Closes#4765Closes#4780Closes#4644
Is it what you had in mind `@stof`?
Commits
-------
89f886e324 Skip the string cast in PrintNode when the expression is already a string and add tests
86840f9351 Ensure PrintNode is yielding string content
This PR was squashed before being merged into the 3.x branch.
Discussion
----------
Make IntegrationTestCase and NodeTestCase compatible with PHPUnit 11
Closes#4782
Commits
-------
8a4b77920a Add PHPUnit attributes alongside annotations to silence doc-comment metadata deprecations on PHPUnit 11
8b35934e68 Run the test suite against PHPUnit 11.3 in CI
ee8ab447d7 Make IntegrationTestCase and NodeTestCase compatible with PHPUnit 11
This PR was squashed before being merged into the 3.x branch.
Discussion
----------
Skip the sandbox `__toString` check on arguments whose PHP parameter type cannot implicitly coerce to string
The sandbox visitor currently wraps every argument of every Twig callable with `CheckToStringNode.
As an optimization, we are now only wrapping when needed (based on the callable type hints). This is a conservative approach (untyped, mixed, string, array, iterable, object, Stringable, Traversable, self/static/parent and unknown class names all keep wrapping).
Here is a concrete before/after for template `{{ demo(a, b) }}` under the sandbox, with the following signature on the PHP side `demo(int $a, string $b)`:
**Before**:
```php
yield $this->sandbox->ensureToStringAllowed(
$this->env->getFunction('demo')->getCallable()(
$this->sandbox->ensureToStringAllowed(($context["a"] ?? null), 1, $this->source),
$this->sandbox->ensureToStringAllowed(($context["b"] ?? null), 1, $this->source),
),
1, $this->source,
);
```
**After**
```php
yield $this->sandbox->ensureToStringAllowed(
$this->env->getFunction('demo')->getCallable()(
($context["a"] ?? null), // int: bare, skipped
$this->sandbox->ensureToStringAllowed(($context["b"] ?? null), 1, $this->source), // string: still wrapped
),
1, $this->source,
);
```
Commits
-------
6d5ef30436 Skip the sandbox `__toString` check on arguments whose PHP parameter type cannot implicitly coerce to string
This PR was merged into the 3.x branch.
Discussion
----------
Fix inconsistent array access with a Stringable key
Closes#4804
Commits
-------
8ec9530732 Fix inconsistent array access with a Stringable key
This PR was merged into the 3.x branch.
Discussion
----------
Preserve IteratorAggregate identity in sandbox __toString walker
Fixes#4820
It's not a full fix, but a quick one just that for the specific use case described in the issue. This is the simple case as IteratorAggregate instances can be iterated more than once (I suppose most such iterators don't have side effects).
Commits
-------
d25f98f45b Preserve IteratorAggregate identity in sandbox __toString walker
This PR was merged into the twig-3.x branch.
Discussion
----------
Fix sandbox filter/tag/function allow-list bypass when sandbox state changes between renders
Fixes#555
Commits
-------
23eb6eb126 Fix sandbox filter/tag/function allow-list bypass when sandbox state changes between renders
This PR was squashed before being merged into the twig-3.x branch.
Discussion
----------
Fix sandbox __toString policy bypass via dynamic mapping keys
Fixes#548
Fixing this one introduces a new feature that I've decided to "keep" and document :)
Commits
-------
635cea4789 Document new support for any expression as a dynamic mapping key
9ff4101463 Fix sandbox __toString policy bypass via dynamic mapping keys
This PR was squashed before being merged into the twig-3.x branch.
Discussion
----------
Fix sandbox `__toString` bypasses via `Traversable` in `join`/`replace` filters and the `in`/`not in` operators
Fixes#512
Commits
-------
e3f66654b8 Fix deprecation notices in tests
475fb690ac Guard sandbox `__toString` walker against self-referencing iterables
e9e818cbfc Fix sandbox `__toString` bypass via `Stringable` + `Traversable` containers
8d6af0707b Fix sandbox `__toString` bypass via the `in` and `not in` operators
cc1e21a2a2 Fix sandbox __toString bypass via Traversable in join/replace filters
This PR was squashed before being merged into the twig-3.x branch.
Discussion
----------
Fix sandbox bypass in the "column" filter under SourcePolicyInterface
Fixes#514
Commits
-------
afbaa2a9da Mark new SourcePolicyInterface column filter tests as `@group` legacy
09c6706407 Fix sandbox bypass in the "column" filter under SourcePolicyInterface
These tests pass a SourcePolicyInterface instance to SandboxExtension, which
triggers the 3.27 deprecation. Mark them legacy and assert the deprecation
to silence the PHPUnit "unhandled deprecation" report.
This PR was merged into the 3.x branch.
Discussion
----------
Add a strict mode to SecurityPolicy to opt-in to the 4.0 sandbox behavior for the extends/use tags and the parent/block/attribute functions
#4813 follow-up
As `@stof` mentioned on Slack, there is currently no way to avoid the deprecation if you want to forbid those tags.
Commits
-------
af7bf5e181 Add a strict mode to SecurityPolicy to opt-in to the 4.0 sandbox behavior for the extends/use tags and the parent/block/attribute functions
Fabien Potencier
Christophe Coevoet