This PR was merged into the 3.x branch.
Discussion
----------
Fix inconsistent array access with a Stringable key
Closes#4804
Commits
-------
8ec9530732 Fix inconsistent array access with a Stringable key
This PR was merged into the 3.x branch.
Discussion
----------
Preserve IteratorAggregate identity in sandbox __toString walker
Fixes#4820
It's not a full fix, but a quick one just that for the specific use case described in the issue. This is the simple case as IteratorAggregate instances can be iterated more than once (I suppose most such iterators don't have side effects).
Commits
-------
d25f98f45b Preserve IteratorAggregate identity in sandbox __toString walker
This PR was merged into the twig-3.x branch.
Discussion
----------
Fix sandbox filter/tag/function allow-list bypass when sandbox state changes between renders
Fixes#555
Commits
-------
23eb6eb126 Fix sandbox filter/tag/function allow-list bypass when sandbox state changes between renders
This PR was squashed before being merged into the twig-3.x branch.
Discussion
----------
Fix sandbox __toString policy bypass via dynamic mapping keys
Fixes#548
Fixing this one introduces a new feature that I've decided to "keep" and document :)
Commits
-------
635cea4789 Document new support for any expression as a dynamic mapping key
9ff4101463 Fix sandbox __toString policy bypass via dynamic mapping keys
This PR was squashed before being merged into the twig-3.x branch.
Discussion
----------
Fix sandbox `__toString` bypasses via `Traversable` in `join`/`replace` filters and the `in`/`not in` operators
Fixes#512
Commits
-------
e3f66654b8 Fix deprecation notices in tests
475fb690ac Guard sandbox `__toString` walker against self-referencing iterables
e9e818cbfc Fix sandbox `__toString` bypass via `Stringable` + `Traversable` containers
8d6af0707b Fix sandbox `__toString` bypass via the `in` and `not in` operators
cc1e21a2a2 Fix sandbox __toString bypass via Traversable in join/replace filters
This PR was squashed before being merged into the twig-3.x branch.
Discussion
----------
Fix sandbox bypass in the "column" filter under SourcePolicyInterface
Fixes#514
Commits
-------
afbaa2a9da Mark new SourcePolicyInterface column filter tests as `@group` legacy
09c6706407 Fix sandbox bypass in the "column" filter under SourcePolicyInterface
These tests pass a SourcePolicyInterface instance to SandboxExtension, which
triggers the 3.27 deprecation. Mark them legacy and assert the deprecation
to silence the PHPUnit "unhandled deprecation" report.
This PR was merged into the 3.x branch.
Discussion
----------
Add a strict mode to SecurityPolicy to opt-in to the 4.0 sandbox behavior for the extends/use tags and the parent/block/attribute functions
#4813 follow-up
As `@stof` mentioned on Slack, there is currently no way to avoid the deprecation if you want to forbid those tags.
Commits
-------
af7bf5e181 Add a strict mode to SecurityPolicy to opt-in to the 4.0 sandbox behavior for the extends/use tags and the parent/block/attribute functions
This PR was merged into the 3.x branch.
Discussion
----------
Document transitive behavior of allowed sandbox operations
Commits
-------
461143d700 Document transitive behavior of allowed sandbox operations
This PR was merged into the 3.x branch.
Discussion
----------
Remove obsolete PHP 8.0 workaround for Closure::__invoke attribute access
The removed code was needed for `isset($closure->__invoke)` to work with PHP pre-8.0 (to avoid a fatal error):
* 7.4: Fatal error: Uncaught Error: Closure object cannot have properties
* 8.0: Fatal error: Uncaught Error: Closure object cannot have properties
* 8.1+: bool(false) clean, no error
Commits
-------
42ccc472a2 Remove obsolete PHP 8.0 workaround for Closure::__invoke attribute access
This PR was merged into the 3.x branch.
Discussion
----------
Deprecate the fact that the `parent`, `block`, and `attribute` functions are always allowed in a sandboxed template
Commits
-------
cfaa2fd030 Deprecate the fact that the `parent`, `block`, and `attribute` functions are always allowed in a sandboxed template
This PR was merged into the 3.x branch.
Discussion
----------
Set LANG=en_US.UTF-8 for the extra packages tests
Commits
-------
d016d2439f Set LANG=en_US.UTF-8 for the extra packages tests
This PR was squashed before being merged into the 3.x branch.
Discussion
----------
Use modern PHPUnit for extra packages
Commits
-------
25d7eb60d7 Use per-extension PHPUnit bridge and force PHPUnit 11 on PHP 8.2+
54420847f0 Install a custom exception handler before bootstrapping KernelTestCase
This PR was merged into the 3.x branch.
Discussion
----------
Escape root profile name in HtmlDumper
Commits
-------
f6aca309d8 Escape root profile name in HtmlDumper
This PR was merged into the 3.x branch.
Discussion
----------
Restrict allowed classes in Profile::unserialize()
Commits
-------
4c1dae5e71 Restrict allowed classes in Profile::unserialize()
This PR was merged into the 3.x branch.
Discussion
----------
Deprecate the "Twig\Sandbox\SourcePolicyInterface" interface
I'm deprecating this feature for the following main reasons:
* AFAICS, no open-source projects is using this feature and the only repository using it has 0 stars and 0 downloads on Packagist - if nobody find value in this feature, it's better to remove it
* As much as possible, a better strategy is to render templates written by untrusted users via a specific loader that restrict what the sandbox environment can "see".
Commits
-------
bd924d5d33 Deprecate the "Twig\Sandbox\SourcePolicyInterface" interface
Fabien Potencier