* 3.x:
Set LANG=en_US.UTF-8 for the extra packages tests
Use per-extension PHPUnit bridge and force PHPUnit 11 on PHP 8.2+
Install a custom exception handler before bootstrapping KernelTestCase
Simplify code
# Conflicts:
# .github/workflows/ci.yml
# extra/twig-extra-bundle/phpunit.xml.dist
This PR was merged into the 3.x branch.
Discussion
----------
Set LANG=en_US.UTF-8 for the extra packages tests
Commits
-------
d016d2439f Set LANG=en_US.UTF-8 for the extra packages tests
This PR was squashed before being merged into the 3.x branch.
Discussion
----------
Use modern PHPUnit for extra packages
Commits
-------
25d7eb60d7 Use per-extension PHPUnit bridge and force PHPUnit 11 on PHP 8.2+
54420847f0 Install a custom exception handler before bootstrapping KernelTestCase
This PR was merged into the 3.x branch.
Discussion
----------
Escape root profile name in HtmlDumper
Commits
-------
f6aca309d8 Escape root profile name in HtmlDumper
This PR was merged into the 3.x branch.
Discussion
----------
Restrict allowed classes in Profile::unserialize()
Commits
-------
4c1dae5e71 Restrict allowed classes in Profile::unserialize()
This PR was merged into the 3.x branch.
Discussion
----------
Deprecate the "Twig\Sandbox\SourcePolicyInterface" interface
I'm deprecating this feature for the following main reasons:
* AFAICS, no open-source projects is using this feature and the only repository using it has 0 stars and 0 downloads on Packagist - if nobody find value in this feature, it's better to remove it
* As much as possible, a better strategy is to render templates written by untrusted users via a specific loader that restrict what the sandbox environment can "see".
Commits
-------
bd924d5d33 Deprecate the "Twig\Sandbox\SourcePolicyInterface" interface
* 3.x:
Remove Drupal integration tests
Do not add : void for test methods
Fix deprecated PHP CS Fixer rules
Replace FQCN with use statements in SandboxTest
Fix CS
# Conflicts:
# .github/workflows/ci.yml
# tests/Extension/SandboxTest.php
This PR was squashed before being merged into the 3.x branch.
Discussion
----------
Replace FQCN with use statements in SandboxTest
Commits
-------
d8781e473c Do not add : void for test methods
ed6df6b4b4 Fix deprecated PHP CS Fixer rules
This PR was merged into the 3.x branch.
Discussion
----------
Replace FQCN with use statements in SandboxTest
Commits
-------
a0a1f1d17d Replace FQCN with use statements in SandboxTest
* 3.x: (23 commits)
Bump version
Prepare the 3.26.0 release
Update CHANGELOG
Document that the sandbox doesn't protect against resource exhaustion
Document template_from_string caveats when used in a sandboxed env
Pre-escape HTML input on the `spaceless` filter
Add docs on Markup about the goal of this class in the context of a sandbox
Fix sandbox bypass in the "column" filter
Fix sandbox `__toString` bypasses
Validate macro name in MacroReferenceExpression constructor
Fix sandbox bypass: PHP code injection via _self / import macro reference
Fix deprecations in tests
Fix sandbox bypass in the `{% sandbox %}` tag when including a preloaded template
Encode single quotes as \x27 in Compiler::string()
Fix sandbox bypass: PHP code injection via {% use %} template name
Fix unbounded memoisation of `IntlDateFormatter` / `NumberFormatter`
Fix deprecation
[Profiler] Escape template and profile names in HtmlDumper
Bump version
Fix sandbox bypass: propagate sandbox state to checkArrow for source-policy sandboxing
...
# Conflicts:
# CHANGELOG
# doc/filters/spaceless.rst
# extra/cssinliner-extra/CssInlinerExtension.php
# extra/inky-extra/InkyExtension.php
# extra/markdown-extra/MarkdownExtension.php
# src/Environment.php
# src/ExpressionParser/Infix/DotExpressionParser.php
# src/Extension/CoreExtension.php
# src/Node/Expression/FilterExpression.php
# src/Node/Expression/FunctionExpression.php
# src/Node/Expression/TestExpression.php
# src/Node/ModuleNode.php
# src/NodeVisitor/SandboxNodeVisitor.php
# src/Resources/core.php
# src/TokenParser/SandboxTokenParser.php
# tests/Extension/SandboxTest.php
Fabien Potencier
Alexandre Daubois