* 3.x:
Resolve block chains against the render context instead of freezing lineages
Resolve constant parent templates once instead of on every lookup
Template runtime and block composition
Fix wrapping the Twig cache pool in a second tag aware adapter
Check that the use tag is allowed before resolving trait templates
# Conflicts:
# CHANGELOG
# extra/twig-extra-bundle/TwigExtraBundle.php
# src/Template.php
* 3.x:
Make the sandbox a first-class citizen with a dedicated Sandbox class
# Conflicts:
# CHANGELOG
# doc/deprecated.rst
# doc/tags/sandbox.rst
# phpstan-baseline.neon
# src/Extension/CoreExtension.php
# src/Extension/SandboxExtension.php
# src/Sandbox/SecurityPolicy.php
* 3.x:
Handle single-node child template bodies in cleanup
Keep captured block definitions supported
Clarify captured block deprecation wording
Simplify correctness visitor checks
Move extends validation into correctness visitor
Fix correctness visitor regressions
Fix test assertions that did not verify the intended behavior
Address review: fix block-nesting checks in CorrectnessNodeVisitor
Move the extends-in-block and extends-in-macro errors into the CorrectnessNodeVisitor
Introduce a CorrectnessNodeVisitor to validate that templates are semantically correct
Mark Markup as final
Allow calling a macro with a dynamic name via the dot operator
Add an allow-list for tests to the sandbox security policy
Fix markdown_to_html mangling content that starts with a blank line
# Conflicts:
# CHANGELOG
# doc/deprecated.rst
# doc/sandbox.rst
# src/ExpressionParser/Infix/DotExpressionParser.php
# src/Extension/CoreExtension.php
# src/Markup.php
# src/Node/CheckSecurityNode.php
# src/Node/Expression/Filter/DefaultFilter.php
# src/Node/Expression/NullCoalesceExpression.php
# src/Node/IfNode.php
# src/NodeVisitor/SandboxNodeVisitor.php
# src/Parser.php
# src/Sandbox/SecurityPolicy.php
# tests/Extension/SandboxTest.php
# tests/ParserTest.php
* 3.x:
Skip the sandbox `__toString` check on arguments whose PHP parameter type cannot implicitly coerce to string
Fix CS
Bump version
Prepare the 3.27.1 release
Fix inconsistent array access with a Stringable key
Preserve IteratorAggregate identity in sandbox __toString walker
Fix tests
Bump version
Prepare the 3.27.0 release
Fix sandbox filter/tag/function allow-list bypass when sandbox state changes between renders
Document new support for any expression as a dynamic mapping key
Fix sandbox __toString policy bypass via dynamic mapping keys
Fix deprecation notices in tests
Guard sandbox `__toString` walker against self-referencing iterables
Fix sandbox `__toString` bypass via `Stringable` + `Traversable` containers
Fix sandbox `__toString` bypass via the `in` and `not in` operators
Fix sandbox __toString bypass via Traversable in join/replace filters
Mark new SourcePolicyInterface column filter tests as @group legacy
Fix sandbox bypass in the "column" filter under SourcePolicyInterface
Fix sandbox bypass in deprecated internal wrappers
# Conflicts:
# CHANGELOG
# src/Environment.php
# src/Node/Expression/ArrayExpression.php
# src/Node/Expression/CallExpression.php
# src/Resources/core.php
# src/Template.php
# src/Util/CallableArgumentsExtractor.php
# src/Util/ReflectionCallable.php
# tests/Extension/SandboxTest.php
# tests/Resources/LegacyCoreTest.php
# tests/TemplateTest.php
* 3.x:
Set LANG=en_US.UTF-8 for the extra packages tests
Use per-extension PHPUnit bridge and force PHPUnit 11 on PHP 8.2+
Install a custom exception handler before bootstrapping KernelTestCase
Simplify code
# Conflicts:
# .github/workflows/ci.yml
# extra/twig-extra-bundle/phpunit.xml.dist
* 3.x:
Fix a @return type hint
Fix CS
Fix a test
Fix type
Simplify sandbox code
Get rid of weird code
[html-extra] filter classes
Fix some inconsistencies
* 2.x:
Fix sandbox support when using include(template_from_string())
Add test to verify that filter is not working when template_from_string is used.
In |filter(), |map(), and |reduce(), throw a RuntimeError instead of a TypeError
* 1.x:
Fix sandbox support when using include(template_from_string())
Add test to verify that filter is not working when template_from_string is used.
In |filter(), |map(), and |reduce(), throw a RuntimeError instead of a TypeError
* 1.x:
do not check sandbox for __toString if method does not exist on object
tweaked sandbox generated code
fixed indentation of the compiled template
Fabien Potencier
Nicolas Grekas
Yaakov Saxon
Maxime Steinhausser