Commit Graph

124 Commits

Author SHA1 Message Date
Fabien Potencier afbaa2a9da Mark new SourcePolicyInterface column filter tests as @group legacy
These tests pass a SourcePolicyInterface instance to SandboxExtension, which
triggers the 3.27 deprecation. Mark them legacy and assert the deprecation
to silence the PHPUnit "unhandled deprecation" report.
2026-05-27 14:49:53 +02:00
Fabien Potencier 09c6706407 Fix sandbox bypass in the "column" filter under SourcePolicyInterface 2026-05-27 14:49:52 +02:00
Fabien Potencier af7bf5e181 Add a strict mode to SecurityPolicy to opt-in to the 4.0 sandbox behavior for the extends/use tags and the parent/block/attribute functions 2026-05-25 13:40:27 +02:00
Fabien Potencier cfaa2fd030 Deprecate the fact that the parent, block, and attribute functions are always allowed in a sandboxed template 2026-05-24 21:19:56 +02:00
Fabien Potencier 33690a4a28 Fix PHP 8.1+ implicit float-to-int deprecation in sandboxed array access 2026-05-24 17:39:37 +02:00
Fabien Potencier 4fc0210084 Bump version 2026-05-23 08:32:22 +02:00
Fabien Potencier bd924d5d33 Deprecate the "Twig\Sandbox\SourcePolicyInterface" interface 2026-05-23 08:30:05 +02:00
Fabien Potencier a0a1f1d17d Replace FQCN with use statements in SandboxTest 2026-05-22 12:08:11 +02:00
Fabien Potencier 4a64b5b486 Fix CS 2026-05-21 16:34:23 +02:00
Alexandre Daubois f05c5011c2 Fix sandbox bypass in the "column" filter 2026-05-20 07:33:52 +02:00
Fabien Potencier 447d0b2331 Fix sandbox __toString bypasses 2026-05-20 00:18:59 +02:00
Alexandre Daubois 324fa60545 Fix sandbox bypass: PHP code injection via _self / import macro reference 2026-05-19 23:41:59 +02:00
Fabien Potencier aeb37f4801 Fix deprecations in tests 2026-05-19 23:05:30 +02:00
Alexandre Daubois 819c6a89fe Fix sandbox bypass in the {% sandbox %} tag when including a preloaded template 2026-05-19 23:00:58 +02:00
Fabien Potencier e494400ce4 Fix deprecation 2026-05-19 22:05:26 +02:00
Fabien Potencier a8eb5a8a74 security #cve-2026-46639 Fix sandbox bypass in object destructuring assignment (alexandre-daubois)
This PR was merged into the twig-3.x branch.
2026-05-19 21:37:04 +02:00
Fabien Potencier c8dfd62064 security #cve-2026-24425 Fix sandbox bypass: propagate Source to checkArrow for source-policy sandboxing (fabpot)
This PR was merged into the twig-3.x branch.
2026-05-19 21:30:51 +02:00
Fabien Potencier fd0760d972 feature #4795 Lazy load EscaperRuntime in EscaperExtension (GromNaN)
This PR was merged into the 3.x branch.

Discussion
----------

Lazy load `EscaperRuntime` in `EscaperExtension`

This allows overriding `EscaperRuntime` via a custom runtime loader.

Previously, `EscaperExtension::setEnvironment()` was calling `$environment->getRuntime(EscaperRuntime::class)` eagerly. Since this method is called from `Environment::__construct()`, the runtime was resolved before any custom runtime loader could be injected, making it impossible to override `EscaperRuntime`.

- Required by https://github.com/symfony/symfony/pull/63929

Commits
-------

b73ab8cfd9 Lazy load EscaperRuntime in EscaperExtension
2026-05-17 07:52:38 +01:00
Fabien Potencier d0579ededc Fix sandbox bypass: propagate sandbox state to checkArrow for source-policy sandboxing 2026-05-16 18:56:08 +01:00
Fabien Potencier 5462817da0 Add a needs_is_sandboxed option for filters, functions, and tests 2026-05-16 18:52:17 +01:00
Jérôme Tamarelle b73ab8cfd9 Lazy load EscaperRuntime in EscaperExtension
Previously, setEnvironment() called getRuntime(EscaperRuntime::class) eagerly,
which prevented overriding EscaperRuntime via a custom runtime loader since
Environment::__construct() calls setEnvironment() before any loader can be injected.
2026-04-30 13:43:11 +02:00
Alexandre Daubois 3fe13f98f8 Fix sandbox bypass in object destructuring assignment 2026-04-28 12:59:06 +02:00
Younes ENNAJI 473653d19b [Core] Fix cycle() with non-countable ArrayAccess+Traversable objects 2025-11-23 13:20:23 +01:00
Nicolas Grekas 85a4817128 CS fixes 2025-07-29 10:07:07 +02:00
Jérôme Tamarelle 5886907b28 Create attributes AsTwigFilter, AsTwigFunction and AsTwigTest to ease extension development 2025-03-24 22:34:21 +01:00
Fabien Potencier 76062c8d51 Fix CS 2025-01-19 16:54:05 +01:00
Jérôme Tamarelle d8fe3bd1ec Add LastModifiedExtensionInterface and implementation in AbstractExtension to track modification of runtime classes 2025-01-02 14:50:18 +01:00
Nicolas Grekas d72ae2447e Merge branch '3.14.x' into 3.x
* 3.14.x:
  Improve detection of recursion
  Fix recursion when arrays contain self-references in sandboxed mode
  Fix code
  Prepare the 3.11.2 release
  Update CHANGELOG
  Sandbox ArrayAccess and do sandbox checks before isset() checks
  Fix sandbox handling for __toString()
  Prepare the 3.14.1 release
  Update CHANGELOG
  Sandbox ArrayAccess and do sandbox checks before isset() checks
  Fix sandbox handling for __toString()
  Prepare the 3.11.1 release
  Fix a security issue when an included sandboxed template has been loaded before without the sandbox context
2024-11-07 11:17:57 +01:00
Nicolas Grekas 83a21d31e5 Merge branch '3.11.x' into 3.14.x
* 3.11.x:
  Improve detection of recursion
  Fix recursion when arrays contain self-references in sandboxed mode
  Fix code
  Prepare the 3.11.2 release
  Update CHANGELOG
  Sandbox ArrayAccess and do sandbox checks before isset() checks
  Fix sandbox handling for __toString()
  Prepare the 3.11.1 release
  Fix a security issue when an included sandboxed template has been loaded before without the sandbox context
2024-11-07 11:11:36 +01:00
Lee Rowlands a0f775683d Fix recursion when arrays contain self-references in sandboxed mode 2024-11-07 09:42:22 +01:00
Nicolas Grekas b957e5a44c Sandbox ArrayAccess and do sandbox checks before isset() checks 2024-11-06 21:41:25 +01:00
Fabien Potencier d4a302681b Fix sandbox handling for __toString() 2024-11-06 21:35:53 +01:00
Fabien Potencier 5b580ec188 Fix code 2024-11-06 19:50:16 +01:00
Nicolas Grekas ec39a9dccc Sandbox ArrayAccess and do sandbox checks before isset() checks 2024-11-06 19:48:59 +01:00
Fabien Potencier cafc608ece Fix sandbox handling for __toString() 2024-11-06 19:27:48 +01:00
Nicolas Grekas 831c148e78 Sandbox ArrayAccess and do sandbox checks before isset() checks 2024-11-06 19:16:07 +01:00
Fabien Potencier 2bb8c2460a Fix sandbox handling for __toString() 2024-11-05 17:54:37 +01:00
Fabien Potencier 9369a48c53 Deprecate the sandbox tag 2024-09-10 22:41:00 +02:00
Fabien Potencier 41103dcdc2 Fix a security issue when an included sandboxed template has been loaded before without the sandbox context 2024-09-10 12:40:14 +02:00
Fabien Potencier 11f68e2aeb Fix a security issue when an included sandboxed template has been loaded before without the sandbox context 2024-09-09 19:04:10 +02:00
Fabien Potencier 2ae0c0d38c Fix CS 2024-09-06 12:33:38 +02:00
Alexandre Daubois 797e490356 Improve exception expectations reliability 2024-09-04 15:22:48 +02:00
Alexander M. Turek 6ddb76bb76 Make data providers static 2024-09-03 16:32:00 +02:00
Fabien Potencier a39b6e164c minor #4241 Adjust cycle implementation (smnandre)
This PR was squashed before being merged into the 3.x branch.

Discussion
----------

Adjust `cycle` implementation

Update code following [#4158](https://github.com/twigphp/Twig/issues/4158)
* return mixed
* trigger when non countable
* type the position argument

Add doc precisions

Commits
-------

7c3c1615 Adjust `cycle` implementation
2024-08-30 20:43:09 +02:00
Simon André 7c3c16154e Adjust cycle implementation 2024-08-30 20:43:06 +02:00
Christian Flothmann 8663ec242b fix typo 2024-08-28 14:18:47 +02:00
Fabien Potencier 5fca700cbd Deprecate the fact that the extends and use tags are always allowed in a sandboxed template 2024-08-28 13:40:53 +02:00
Fabien Potencier e4e95f5b86 Replace template loader mocks by ArrayLoader 2024-07-24 08:27:23 +02:00
Fabien Potencier b63bde3063 Optimize sprintf() calls for PHP 8.4 2024-06-21 08:16:55 +02:00
Fabien Potencier 04b1ad3ced Fix old escaper signature + add docs 2024-05-13 18:21:17 +02:00