* 3.x: (23 commits)
Bump version
Prepare the 3.26.0 release
Update CHANGELOG
Document that the sandbox doesn't protect against resource exhaustion
Document template_from_string caveats when used in a sandboxed env
Pre-escape HTML input on the `spaceless` filter
Add docs on Markup about the goal of this class in the context of a sandbox
Fix sandbox bypass in the "column" filter
Fix sandbox `__toString` bypasses
Validate macro name in MacroReferenceExpression constructor
Fix sandbox bypass: PHP code injection via _self / import macro reference
Fix deprecations in tests
Fix sandbox bypass in the `{% sandbox %}` tag when including a preloaded template
Encode single quotes as \x27 in Compiler::string()
Fix sandbox bypass: PHP code injection via {% use %} template name
Fix unbounded memoisation of `IntlDateFormatter` / `NumberFormatter`
Fix deprecation
[Profiler] Escape template and profile names in HtmlDumper
Bump version
Fix sandbox bypass: propagate sandbox state to checkArrow for source-policy sandboxing
...
# Conflicts:
# CHANGELOG
# doc/filters/spaceless.rst
# extra/cssinliner-extra/CssInlinerExtension.php
# extra/inky-extra/InkyExtension.php
# extra/markdown-extra/MarkdownExtension.php
# src/Environment.php
# src/ExpressionParser/Infix/DotExpressionParser.php
# src/Extension/CoreExtension.php
# src/Node/Expression/FilterExpression.php
# src/Node/Expression/FunctionExpression.php
# src/Node/Expression/TestExpression.php
# src/Node/ModuleNode.php
# src/NodeVisitor/SandboxNodeVisitor.php
# src/Resources/core.php
# src/TokenParser/SandboxTokenParser.php
# tests/Extension/SandboxTest.php
The name passed to MacroReferenceExpression is emitted as raw PHP in
compile() via "->{$name}(...)". Callers were expected to validate
the name, but a missing check led to CVE-2026-XXXXX (PHP code injection
via _self / import macro reference): defense-in-depth, validate the
name in the constructor so the class is safe by construction.
* origin/3.x:
Add a `needs_is_sandboxed` option for filters, functions, and tests
Bump version
Make embeds deterministic
[Doc] Document loose comparison in the `in` operator
[Doc] Reword whitespace control note about first-newline removal
Stop publishing extra package minor versions with no changes
Lazy load EscaperRuntime in EscaperExtension
Fix typo
Replace parent-child analogy in `doc/tags/extends.rst`
doc: Add missing toctree entries and fix ordering
Fix CHANGELOG
Bump version
Prepare the 3.24.0 release
* 3.x:
Update CHANGELOG
Add `html_attr_relaxed` escaping strategy
re-add mixed return type
Support short-circuiting in null-safe operator chains
Add support for renaming variables in object destructuring
Update .gitattributes to remove splitsh.json
Fix intro for operator precedence table ?
This PR was merged into the 3.x branch.
Discussion
----------
Support short-circuiting in null-safe operator chains
This PR adds short-circuiting for null-safe operator chains, using the same rules as PHP, `PropertyAccess`, and the `ExpressionLanguage`.
Previously, only the immediate null-safe access was guarded. With this change, as soon as a `null` is encountered at a null-safe access, the rest of the chain is skipped.
My approach was to move the null check outside of the `getAttribute()` calls so the expression can immediately return `null`, eg:
```twig
foo?.bar.baz
```
Before:
```php
yield $this->env
->getRuntime('Twig\Runtime\EscaperRuntime')
->escape(
CoreExtension::getAttribute(
$this->env,
$this->source,
(
null === (
$_v0 = (
isset($context['foo']) || array_key_exists('foo', $context)
? $context['foo']
: throw new RuntimeError('Variable "foo" does not exist.', 3, $this->source)
)
)
? null
: CoreExtension::getAttribute(
$this->env,
$this->source,
$_v0,
'bar',
[],
'any',
false,
false,
false,
3
)
),
'baz',
[],
'any',
false,
false,
false,
3
),
'html',
null,
true
);
```
Now:
```php
yield $this->env
->getRuntime('Twig\Runtime\EscaperRuntime')
->escape(
(
null === (
$_v0 = (
isset($context['foo']) || array_key_exists('foo', $context)
? $context['foo']
: throw new RuntimeError('Variable "foo" does not exist.', 3, $this->source)
)
)
? null
: CoreExtension::getAttribute(
$this->env,
$this->source,
CoreExtension::getAttribute(
$this->env,
$this->source,
$_v0,
'bar',
[],
'any',
false,
false,
false,
3
),
'baz',
[],
'any',
false,
false,
false,
3
)
),
'html',
null,
true
);
```
Commits
-------
d56e8e2dba Support short-circuiting in null-safe operator chains
* 3.x:
Update CHANGELOG
Fix accessing arrays with stringable objects as key
Update inky_to_html.rst: Updating link
Update replace.rst
[Doc] Tweaks in the escaping article
Compile 'index' with repr (not string) in EmbedNode
Introduce registerUndefinedTestCallback
Fix intl test
Bump minimum Commonmark requirement
Support two words test guard
Bump version
Improve documentation examples for `enum` and `enum_cases`
Avoid errors when failing to guess the template info for an error
Add note to format_datetime explaining how to install required extensions
Fix compatibility layer
* 3.x:
Fix testing and expression when it evaluates to an instance of Markup
Simplify Error implementation
Make the defined test implementation more generic
fix typo
fix the rst syntax of the operator precedence table
* 3.x:
Fixing minor typo in Update inline_css.rst
Ignore static properties when using the dot operator
Fix CS
Fix constant() behavior when used with ??
Finish the work
fix indentation
Apply suggestions from code review
typo
fix merge
docs and changelog
typehint instead of checkArrow
checkArrow, typehints
invoke filter
* 3.x: (30 commits)
Make {} optional for the types tag
Remove the note about types mapping argument
Add a note on the types locality
Fix CS
Fix typos in the docs
Use spl_object_id() instead of spl_object_hash()
Add `LastModifiedExtensionInterface` and implementation in `AbstractExtension` to track modification of runtime classes
Bump version
Optimize NameExpression compilation
Fix typo in enum twig doc functions
Remove dead method in ModuleNode
Bump version
Prepare the 3.18.0 release
Add support for `Twig\Markup`
Fix unary operator precedence change
Replace Twigfiddle by the new Twig playground
Fix MacroNode $name argument can be overridden
Ignore exceptions from undefined handlers when using the guard tag
[Doc] Update the docs about attribute() function
Fix doc
...
* 3.x:
Remove obsolete code
Update CHANGELOG
Sandbox ArrayAccess and do sandbox checks before isset() checks
Fix sandbox handling for __toString()
Fix mistake in docs for `keys` filter
Update CHANGELOG
[String] Add SpanishInflector support for singular and plural
Add `find` to `Filters` docs
Remove duplicate test case
Revert "minor #4411 Add return type to getDebugInfo (ruudk)"
Add `$this` return type to Template::unwrap
Add link to TwigQI in docs "You might also be interested in" section
Add return type to compiled macro
This PR was merged into the 3.x branch.
Discussion
----------
Add return type to compiled macro
This makes it easier for TwigStan to analyze the return type.
Commits
-------
1e7c719e24 Add return type to compiled macro
Fabien Potencier
Alexandre Daubois
HypeMC
Felds Liscia
Simon André
Nicolas Grekas