Commit Graph

318 Commits

Author SHA1 Message Date
Fabien Potencier b762bc94b9 Make the sandbox a first-class citizen with a dedicated Sandbox class 2026-07-30 12:05:47 +02:00
Fabien Potencier 9c6d76b61c Add void return type hint even in tests 2026-07-12 13:43:08 +02:00
Fabien Potencier c12100525e Introduce a CorrectnessNodeVisitor to validate that templates are semantically correct 2026-06-11 07:43:33 +02:00
Fabien Potencier 416d07da1d Add an allow-list for tests to the sandbox security policy 2026-06-06 11:08:56 +02:00
Fabien Potencier afad02326d minor #4662 CoreExtension::getAttribute: small improvement regarding getter/isser/hasser (gharlan)
This PR was merged into the 3.x branch.

Discussion
----------

CoreExtension::getAttribute: small improvement regarding getter/isser/hasser

For a getter method like `getFirstName` it is common to call it in twig via `person.firstName`.
But at the moment twig is adding these variants to the class method cache: `getFirstName`, `getfirstname`, `FirstName` and `firstname`.
So when resolving the name, it uses the first `elseif` here with additional `strtolower` call, because `firstName` is missing:

https://github.com/twigphp/Twig/blob/403bd9d73c2a010e5b26689f2f2eb9d7ddf391af/src/Extension/CoreExtension.php#L1863-L1867

This PR replaces `FirstName` with `firstName` in the method cache.
So `person.firstName` is resolved via first `if` branch (but `person.FirstName` would use the `elseif` with `strtolower` now).

Commits
-------

45cd6ffe80 CoreExtension::getAttribute: small improvement regarding getter/isser/hasser
2026-06-04 22:28:58 +02:00
Fabien Potencier a3eda4b1fd Make the include() function return a Markup object 2026-06-04 21:32:12 +02:00
Fabien Potencier 23eb6eb126 Fix sandbox filter/tag/function allow-list bypass when sandbox state changes between renders 2026-05-27 14:59:42 +02:00
Fabien Potencier 09c6706407 Fix sandbox bypass in the "column" filter under SourcePolicyInterface 2026-05-27 14:49:52 +02:00
Fabien Potencier 42ccc472a2 Remove obsolete PHP 8.0 workaround for Closure::__invoke attribute access 2026-05-25 08:28:10 +02:00
Fabien Potencier 33690a4a28 Fix PHP 8.1+ implicit float-to-int deprecation in sandboxed array access 2026-05-24 17:39:37 +02:00
Fabien Potencier 3190b9ae12 Pre-escape HTML input on the spaceless filter 2026-05-20 08:29:48 +02:00
Alexandre Daubois f05c5011c2 Fix sandbox bypass in the "column" filter 2026-05-20 07:33:52 +02:00
Fabien Potencier 447d0b2331 Fix sandbox __toString bypasses 2026-05-20 00:18:59 +02:00
Fabien Potencier d0579ededc Fix sandbox bypass: propagate sandbox state to checkArrow for source-policy sandboxing 2026-05-16 18:56:08 +01:00
Fabien Potencier 861215c507 Fix CS 2026-02-07 09:07:38 +01:00
Fabien Potencier bfbbef05f2 Add the = assignment operator 2026-01-19 16:39:57 +01:00
Fabien Potencier 94c8bdd6a6 Add === and !== operators 2026-01-14 09:58:48 +01:00
Fabien Potencier 2376bbaf3e Fix spread operator behavior 2026-01-12 08:54:38 +01:00
Younes ENNAJI 473653d19b [Core] Fix cycle() with non-countable ArrayAccess+Traversable objects 2025-11-23 13:20:23 +01:00
Thomas Cochard 40248e4ca9 CoreExtension : Make error message more readable 2025-11-15 08:57:35 +01:00
Nicolas Grekas 9ae75d315c Fix accessing arrays with stringable objects as key 2025-10-24 14:19:16 +02:00
Gregor Harlan 45cd6ffe80 CoreExtension::getAttribute: small improvement regarding getter/isser/hasser 2025-07-29 10:12:10 +02:00
Fabien Potencier 1c6ac163c9 minor #4589 Make in_array() calls strict (alexandre-daubois)
This PR was merged into the 3.x branch.

Discussion
----------

Make `in_array()` calls strict

I propose to add `strict: true` to all calls to `in_array()`, making the calls faster.

Commits
-------

9c6b95f2a6 Make `in_array()` calls strict
2025-02-21 19:06:58 +01:00
Fabien Potencier d72c1c6b1e Fix testing and expression when it evaluates to an instance of Markup 2025-02-21 18:29:32 +01:00
Alexandre Daubois 9c6b95f2a6 Make in_array() calls strict 2025-02-19 15:29:33 +01:00
Fabien Potencier 151aa4ecda Fix CS 2025-02-14 12:57:03 +01:00
Fabien Potencier 3964aeba78 Add a proper prefix spread operator 2025-02-14 11:45:39 +01:00
Fabien Potencier 8ff19090f3 Fix precedence rules 2025-02-14 08:38:53 +01:00
Fabien Potencier f67078b5c4 Move Operators to ExpressionParsers, deprecate ExpressionParser 2025-02-14 08:38:53 +01:00
Fabien Potencier 42c82e1e9b Extract operators logic from ExpressionParser to their own classes 2025-02-14 08:38:53 +01:00
Fabien Potencier df877a1d53 Introduce operator classes to describe operators provided by extensions instead of arrays 2025-02-14 08:38:53 +01:00
Fabien Potencier fab1a37d8e bug #4546 Fix timezone conversion on strings (PrinsFrank)
This PR was squashed before being merged into the 3.x branch.

Discussion
----------

Fix timezone conversion on strings

When setting a default application timezone, and a display timezone:
```php
date_default_timezone_set('UTC');
$twig->getExtension(\Twig\Extension\CoreExtension::class)->setTimezone('Europe/Paris');
```

Date objects get converted, but strings don't. See #4545.

For most other paths in `convertDate`, the dateTime object is initialized, and afterwards the timezone gets set. For strings, the timezone is passed as a constructor argument before having the timezone set again, losing its converting behaviour. This makes the convertDate method work identical for DateTime objects as strings. This different behaviour was already spotted in #3568.

Fixes #4545 #3568 #2819

Commits
-------

f69531fa00 Fix timezone conversion on strings
2025-02-07 22:52:13 +01:00
PrinsFrank f69531fa00 Fix timezone conversion on strings 2025-02-07 22:52:10 +01:00
Nicolas Grekas 1d5180549f Ignore static properties when using the dot operator 2025-01-22 09:18:31 +01:00
Fabien Potencier 76062c8d51 Fix CS 2025-01-19 16:54:05 +01:00
Lorenz edecc13f08 typehint instead of checkArrow 2025-01-12 18:44:45 +01:00
Lorenz f27115857d checkArrow, typehints 2025-01-12 18:44:45 +01:00
Lorenz 8b432758f6 invoke filter 2025-01-12 18:44:45 +01:00
Faizan Akram 0a61801d9a adds support for invoking closures 2024-12-14 20:06:34 +01:00
Fabien Potencier 1af334be89 Fix the Elvis operator when there is some space between ? and : 2024-12-11 10:38:21 +01:00
Gregor Harlan 32a75b7869 Fix ArrayAccess with objects as keys 2024-12-05 12:31:45 +01:00
Fabien Potencier 14fc89ebea Fix CS 2024-11-30 09:42:13 +01:00
Fabien Potencier 44516133e2 Fix CS 2024-11-30 09:33:57 +01:00
Fabien Potencier 4f8ba93600 Enforce AbstractBinary for all binary operators 2024-11-29 16:51:09 +01:00
Ruud Kamphuis fb43e7a854 Specify allow round methods
This way, PHPStan can validate invalid input.
2024-11-21 09:11:20 +01:00
Fabien Potencier 5b380e5b3b minor #4435 Fix wrong type for cycle position (ruudk)
This PR was merged into the 3.x branch.

Discussion
----------

Fix wrong type for cycle position

It also accepts 0, which is not a positive int.

Commits
-------

c78499bda9 Fix wrong type for cycle position
2024-11-07 18:02:41 +01:00
Fabien Potencier 8f1ae67b73 minor #4421 Add type for join method (ruudk)
This PR was merged into the 3.x branch.

Discussion
----------

Add type for join method

Looking at the code, this method is very forgiving in what it accepts.

This helps PHPStan to not complain when something other than an array is passed.

Did I miss other types?

/cc `@stof`

Commits
-------

226f0ff0dd Add type for join method
2024-11-07 18:02:05 +01:00
Nicolas Grekas 5cd1ff1977 Rely on reflection to access null properties 2024-11-07 11:23:04 +01:00
Nicolas Grekas d72ae2447e Merge branch '3.14.x' into 3.x
* 3.14.x:
  Improve detection of recursion
  Fix recursion when arrays contain self-references in sandboxed mode
  Fix code
  Prepare the 3.11.2 release
  Update CHANGELOG
  Sandbox ArrayAccess and do sandbox checks before isset() checks
  Fix sandbox handling for __toString()
  Prepare the 3.14.1 release
  Update CHANGELOG
  Sandbox ArrayAccess and do sandbox checks before isset() checks
  Fix sandbox handling for __toString()
  Prepare the 3.11.1 release
  Fix a security issue when an included sandboxed template has been loaded before without the sandbox context
2024-11-07 11:17:57 +01:00
Fabien Potencier 32e99c263d Remove obsolete code 2024-11-06 21:45:08 +01:00