These tests pass a SourcePolicyInterface instance to SandboxExtension, which
triggers the 3.27 deprecation. Mark them legacy and assert the deprecation
to silence the PHPUnit "unhandled deprecation" report.
This PR was merged into the 3.x branch.
Discussion
----------
Add a strict mode to SecurityPolicy to opt-in to the 4.0 sandbox behavior for the extends/use tags and the parent/block/attribute functions
#4813 follow-up
As `@stof` mentioned on Slack, there is currently no way to avoid the deprecation if you want to forbid those tags.
Commits
-------
af7bf5e181 Add a strict mode to SecurityPolicy to opt-in to the 4.0 sandbox behavior for the extends/use tags and the parent/block/attribute functions
This PR was merged into the 3.x branch.
Discussion
----------
Document transitive behavior of allowed sandbox operations
Commits
-------
461143d700 Document transitive behavior of allowed sandbox operations
This PR was merged into the 3.x branch.
Discussion
----------
Remove obsolete PHP 8.0 workaround for Closure::__invoke attribute access
The removed code was needed for `isset($closure->__invoke)` to work with PHP pre-8.0 (to avoid a fatal error):
* 7.4: Fatal error: Uncaught Error: Closure object cannot have properties
* 8.0: Fatal error: Uncaught Error: Closure object cannot have properties
* 8.1+: bool(false) clean, no error
Commits
-------
42ccc472a2 Remove obsolete PHP 8.0 workaround for Closure::__invoke attribute access
This PR was merged into the 3.x branch.
Discussion
----------
Deprecate the fact that the `parent`, `block`, and `attribute` functions are always allowed in a sandboxed template
Commits
-------
cfaa2fd030 Deprecate the fact that the `parent`, `block`, and `attribute` functions are always allowed in a sandboxed template
This PR was merged into the 3.x branch.
Discussion
----------
Set LANG=en_US.UTF-8 for the extra packages tests
Commits
-------
d016d2439f Set LANG=en_US.UTF-8 for the extra packages tests
This PR was squashed before being merged into the 3.x branch.
Discussion
----------
Use modern PHPUnit for extra packages
Commits
-------
25d7eb60d7 Use per-extension PHPUnit bridge and force PHPUnit 11 on PHP 8.2+
54420847f0 Install a custom exception handler before bootstrapping KernelTestCase
This PR was merged into the 3.x branch.
Discussion
----------
Escape root profile name in HtmlDumper
Commits
-------
f6aca309d8 Escape root profile name in HtmlDumper
This PR was merged into the 3.x branch.
Discussion
----------
Restrict allowed classes in Profile::unserialize()
Commits
-------
4c1dae5e71 Restrict allowed classes in Profile::unserialize()
This PR was merged into the 3.x branch.
Discussion
----------
Deprecate the "Twig\Sandbox\SourcePolicyInterface" interface
I'm deprecating this feature for the following main reasons:
* AFAICS, no open-source projects is using this feature and the only repository using it has 0 stars and 0 downloads on Packagist - if nobody find value in this feature, it's better to remove it
* As much as possible, a better strategy is to render templates written by untrusted users via a specific loader that restrict what the sandbox environment can "see".
Commits
-------
bd924d5d33 Deprecate the "Twig\Sandbox\SourcePolicyInterface" interface
This PR was squashed before being merged into the 3.x branch.
Discussion
----------
Replace FQCN with use statements in SandboxTest
Commits
-------
d8781e473c Do not add : void for test methods
ed6df6b4b4 Fix deprecated PHP CS Fixer rules
This PR was merged into the 3.x branch.
Discussion
----------
Replace FQCN with use statements in SandboxTest
Commits
-------
a0a1f1d17d Replace FQCN with use statements in SandboxTest
Fabien Potencier
Alexandre Daubois