Commit Graph

56 Commits

Author SHA1 Message Date
Fabien Potencier f640320202 Merge branch '3.x' into 4.x
* 3.x: (26 commits)
  Remove the documentation comments compilation overhead
  Clarify source function trust requirements
  Throw on PCRE errors in the matches operator
  Document that reusing a non-rewindable iterator after destructuring is unsupported
  Release destructuring temporaries after assignment
  Deprecate prefixed macro definedness checks
  Fix duplicate macro deprecation wording
  Throw when list formatting fails
  Document that sequence destructuring consumes one value per pattern slot
  Fix the html_attr documentation about iterables in data attributes
  Warn about untrusted input with the default Tempest markdown converter
  Document that overriding MacroNode::compile() is not supported anymore
  Merge overlapping CHANGELOG entries for the destructuring fatal error fix
  Document that include_only keeps global variables available
  Remove lazy macro import resolution
  Honor date formatter prototype calendars
  Fix Stringable keys for ArrayAccess implementations
  Fix repeated object destructuring evaluation
  Restore void return type compatibility for extension points
  Reject destructuring patterns containing no variables
  ...

# Conflicts:
#	CHANGELOG
#	doc/deprecated.rst
#	doc/filters/format_datetime.rst
#	extra/twig-extra-bundle/DependencyInjection/Compiler/MissingExtensionSuggestorPass.php
#	extra/twig-extra-bundle/DependencyInjection/TwigExtraExtension.php
#	extra/twig-extra-bundle/TwigExtraBundle.php
#	src/MacroNamespace.php
#	src/Node/MacrosNode.php
#	src/Parser.php
#	src/Test/IntegrationTestCase.php
#	src/Test/NodeTestCase.php
#	tests/CallMacroTest.php
#	tests/ExpressionParserTest.php
#	tests/Fixtures/macros/duplicate_definition.legacy.test
#	tests/Node/MacrosTest.php
#	tests/ParserTest.php
2026-08-29 00:25:20 +02:00
Fabien Potencier a3a318face Reject destructuring patterns containing no variables 2026-08-27 07:18:49 +02:00
Fabien Potencier a2b023397e Fix an empty destructuring pattern triggering a PHP fatal error instead of a SyntaxError 2026-08-23 09:50:46 +02:00
Fabien Potencier d5e2f249d2 Remove deprecated macro defined test syntax 2026-07-31 12:18:02 +02:00
Fabien Potencier ab8e41b49b Merge branch '3.x' into 4.x
* 3.x:
  Deprecate using parentheses when testing a macro with the defined test

# Conflicts:
#	CHANGELOG
#	doc/deprecated.rst
#	src/ExpressionParser/Infix/DotExpressionParser.php
#	src/ExpressionParser/Infix/FunctionExpressionParser.php
#	src/ExpressionParser/Infix/IsExpressionParser.php
#	tests/Fixtures/macros/call_without_parentheses.legacy.test
#	tests/ParserTest.php
2026-07-31 12:15:12 +02:00
Fabien Potencier 34d9c67d38 Deprecate using parentheses when testing a macro with the defined test 2026-07-31 12:09:23 +02:00
Fabien Potencier 986a765019 Merge branch '3.x' into 4.x
* 3.x:
  Redesign macro calls and argument handling

# Conflicts:
#	CHANGELOG
#	doc/deprecated.rst
#	src/ExpressionParser/Infix/ArgumentsTrait.php
#	src/ExpressionParser/Infix/DotExpressionParser.php
#	src/ExpressionParser/Infix/FunctionExpressionParser.php
#	src/Extension/CoreExtension.php
#	src/Node/Expression/MacroReferenceExpression.php
#	src/Node/Expression/MethodCallExpression.php
#	src/Node/Expression/TempNameExpression.php
#	src/Node/MacroNode.php
#	src/Node/ModuleNode.php
#	src/Template.php
#	tests/Fixtures/macros/call_without_parentheses.legacy.test
#	tests/Node/Expression/MacroReferenceTest.php
#	tests/Node/MacroTest.php
2026-07-30 14:02:30 +02:00
Fabien Potencier d7f8b4eb1c Redesign macro calls and argument handling 2026-07-30 13:53:24 +02:00
Fabien Potencier 9b42c9bd3d Merge branch '3.x' into 4.x
* 3.x:
  Deprecate macro calls without parentheses

# Conflicts:
#	CHANGELOG
#	doc/deprecated.rst
2026-07-28 16:26:41 +02:00
Fabien Potencier ad305b414e Deprecate macro calls without parentheses 2026-07-28 16:13:23 +02:00
Fabien Potencier 8bfb29b953 Remove deprecated code 2026-07-28 14:52:35 +02:00
Fabien Potencier 80df3b5f63 Merge branch '3.x' into 4.x
* 3.x:
  Rename macro variable AST nodes

# Conflicts:
#	CHANGELOG
#	doc/deprecated.rst
#	src/ExpressionParser/Infix/DotExpressionParser.php
#	src/Node/Expression/Variable/TemplateVariable.php
#	src/Node/ImportNode.php
#	src/Parser.php
2026-07-28 14:47:56 +02:00
Fabien Potencier be36fee09e Rename macro variable AST nodes 2026-07-28 11:53:50 +02:00
Fabien Potencier d266b2df7f Merge branch '3.x' into 4.x
* 3.x:
  Clarify the security scope for untrusted templates
  Normalize destructuring assignment targets
  Deprecate duplicate macro definitions

# Conflicts:
#	CHANGELOG
#	doc/deprecated.rst
#	tests/ExpressionParserTest.php
2026-07-28 09:58:56 +02:00
Fabien Potencier 6ce5beb7c2 Normalize destructuring assignment targets 2026-07-27 18:51:15 +02:00
Fabien Potencier 04ace9dba0 Merge branch '3.x' into 4.x
* 3.x:
  Handle single-node child template bodies in cleanup
  Keep captured block definitions supported
  Clarify captured block deprecation wording
  Simplify correctness visitor checks
  Move extends validation into correctness visitor
  Fix correctness visitor regressions
  Fix test assertions that did not verify the intended behavior
  Address review: fix block-nesting checks in CorrectnessNodeVisitor
  Move the extends-in-block and extends-in-macro errors into the CorrectnessNodeVisitor
  Introduce a CorrectnessNodeVisitor to validate that templates are semantically correct
  Mark Markup as final
  Allow calling a macro with a dynamic name via the dot operator
  Add an allow-list for tests to the sandbox security policy
  Fix markdown_to_html mangling content that starts with a blank line

# Conflicts:
#	CHANGELOG
#	doc/deprecated.rst
#	doc/sandbox.rst
#	src/ExpressionParser/Infix/DotExpressionParser.php
#	src/Extension/CoreExtension.php
#	src/Markup.php
#	src/Node/CheckSecurityNode.php
#	src/Node/Expression/Filter/DefaultFilter.php
#	src/Node/Expression/NullCoalesceExpression.php
#	src/Node/IfNode.php
#	src/NodeVisitor/SandboxNodeVisitor.php
#	src/Parser.php
#	src/Sandbox/SecurityPolicy.php
#	tests/Extension/SandboxTest.php
#	tests/ParserTest.php
2026-06-11 07:57:54 +02:00
Fabien Potencier 87093aab9e Allow calling a macro with a dynamic name via the dot operator 2026-06-06 17:10:52 +02:00
Fabien Potencier 82bc07bc64 Merge branch '3.x' into 4.x
* 3.x:
  Reduce memory usage of the context restoration compiled at the end of for loops
  Clarify sandbox always-allowed trust boundary
  Bump version to 3.28.0 for the always_allowed_in_sandbox feature
  Add regression tests that always-allowed callables still enforce the sandbox __toString policy on arguments
  Document the criteria for always-allowed sandbox items and list 4.0 built-ins
  Add an always_allowed_in_sandbox flag for filters, functions, and tags
  Remove issue references in tests
  Avoid allocating a normalized copy when counting newlines without carriage returns
  Report columns in syntax errors
  Track the source offset of each token

# Conflicts:
#	CHANGELOG
#	doc/deprecated.rst
#	doc/sandbox.rst
#	src/Environment.php
#	src/Error/Error.php
#	src/Lexer.php
#	src/Node/ForNode.php
#	src/Token.php
#	src/TwigCallableInterface.php
#	tests/Extension/SandboxTest.php
#	tests/Node/ForTest.php
2026-06-06 11:03:40 +02:00
Fabien Potencier 2d75c87d05 Add an always_allowed_in_sandbox flag for filters, functions, and tags 2026-06-06 08:56:58 +02:00
Fabien Potencier c1f02e6d4a Merge branch '3.x' into 4.x
* 3.x:
  Deprecate the fact that the `parent`, `block`, and `attribute` functions are always allowed in a sandboxed template
  Fix PHP 8.1+ implicit float-to-int deprecation in sandboxed array access

# Conflicts:
#	CHANGELOG
#	doc/deprecated.rst
#	tests/Extension/SandboxTest.php
2026-05-24 21:23:36 +02:00
Fabien Potencier cfaa2fd030 Deprecate the fact that the parent, block, and attribute functions are always allowed in a sandboxed template 2026-05-24 21:19:56 +02:00
Fabien Potencier b91dbaa1ba Fix merge conflict resolution 2026-05-21 14:11:53 +02:00
Alexandre Daubois 324fa60545 Fix sandbox bypass: PHP code injection via _self / import macro reference 2026-05-19 23:41:59 +02:00
Fabien Potencier 2fcc93954d Fix CS 2026-03-17 08:26:25 +01:00
Fabien Potencier 83c686818e minor #4773 Move to PHPStan level 5 (fabpot)
This PR was merged into the 4.x branch.

Discussion
----------

Move to PHPStan level 5

Not a big fan adding more phpdocs, but I don't have a better idea for now (except stop use `getNode()` and add proper getters).

Commits
-------

b3cbcedced Move to PHPStan level 5
2026-02-25 13:44:15 +01:00
Fabien Potencier 85295f3d4c Remove compat code 2026-02-25 09:42:46 +01:00
Fabien Potencier b8e6b314b3 Merge branch '3.x' into 4.x
* 3.x:
  fix documentation typos for singular filter arguments
  Add getOperatorTokens() to ExpressionParserInterface to separate operator token registration from parser identity
  Ensure filters/attributes aren't mistaken for operators
2026-02-25 09:40:35 +01:00
Fabien Potencier e5eb95d0d7 Add getOperatorTokens() to ExpressionParserInterface to separate operator token registration from parser identity 2026-02-24 21:13:06 +01:00
Fabien Potencier b3cbcedced Move to PHPStan level 5 2026-02-23 15:07:49 +01:00
Fabien Potencier 825af0e7f1 Merge branch '3.x' into 4.x
* 3.x:
  Enforce more precise type on ListExpression
2026-02-23 15:07:05 +01:00
Fabien Potencier dcfc419a25 Enforce more precise type on ListExpression 2026-02-23 13:36:14 +01:00
Fabien Potencier 0facb551b0 Merge branch '3.x' into 4.x
* 3.x:
  Fix CS
2026-02-07 09:12:05 +01:00
Fabien Potencier 861215c507 Fix CS 2026-02-07 09:07:38 +01:00
Fabien Potencier 0222460a72 Merge branch '3.x' into 4.x
* 3.x:
  Bump version
  Add a not about the return value of destructuring
  Fix null-safe operator test
  Bump version
  Prepare the  release
  Update CHANGELOG
  Add support for object and mapping destructuring
  Rename classes
  Assignment operator array destructuring
  Fix doc notes
  Fix doc notes
  Add the = assignment operator
  Fix grammar and spelling mistakes in documentation
2026-02-06 22:45:48 +01:00
Fabien Potencier 8a0f8acbdf Add support for object and mapping destructuring 2026-01-21 13:21:14 +01:00
Fabien Potencier 76c404ec67 Rename classes 2026-01-21 13:14:16 +01:00
Fabien Potencier bb99af3b39 Assignment operator array destructuring 2026-01-21 08:46:28 +01:00
Fabien Potencier bfbbef05f2 Add the = assignment operator 2026-01-19 16:39:57 +01:00
Fabien Potencier e968cf6591 Merge branch '3.x' into 4.x
* 3.x:
  Tweak null-safe operator implementation
  Add null-safe operator
  Update u.rst to clarify truncate method's third argument behavior
2026-01-17 15:17:13 +01:00
Felds Liscia 263c04fd1f Add null-safe operator 2026-01-17 14:57:47 +01:00
Fabien Potencier 280960d9e1 Merge branch '3.x' into 4.x
* 3.x:
  Fix documentation for getOperators()
  bump version
  Enhance enum.rst with dynamic case example
  Add === and !== operators
  Update extends.rst
  Fix spread operator behavior
2026-01-17 10:24:43 +01:00
Fabien Potencier 94c8bdd6a6 Add === and !== operators 2026-01-14 09:58:48 +01:00
Fabien Potencier 2376bbaf3e Fix spread operator behavior 2026-01-12 08:54:38 +01:00
Fabien Potencier 56a7aa4e4f Merge branch '3.x' into 4.x
* 3.x:
  use getShareDir as an indicator of Symfony version
  Add 'invoke' to filters index
  [Core] Fix cycle() with non-countable ArrayAccess+Traversable objects
  Update .gitattributes to exclude phpstan configs
  Bump version
  Prepare the 3.22.1 release
  Update CHANGELOG
  `CoreExtension` : Make error message more readable
  Add caution note for random function usage
  Add throw tag to parse methods
2025-12-05 09:58:08 +01:00
Vincent Langlet 790eee7ae0 Add throw tag to parse methods 2025-10-18 12:28:49 +02:00
Fabien Potencier 9a0f896cd0 Fix CS 2025-02-14 13:03:18 +01:00
Fabien Potencier 38c52534cc Merge branch '3.x' into 4.x
* 3.x:
  Fix CS
2025-02-14 13:02:29 +01:00
Fabien Potencier 151aa4ecda Fix CS 2025-02-14 12:57:03 +01:00
Fabien Potencier 9bccdf438d Merge branch '3.x' into 4.x
* 3.x:
  Add a proper prefix spread operator
  Avoid storing expression parser instances in Node attributes
2025-02-14 12:51:14 +01:00
Fabien Potencier 3964aeba78 Add a proper prefix spread operator 2025-02-14 11:45:39 +01:00