This PR was merged into the 3.x branch.
Discussion
----------
Deprecate the "Twig\Sandbox\SourcePolicyInterface" interface
I'm deprecating this feature for the following main reasons:
* AFAICS, no open-source projects is using this feature and the only repository using it has 0 stars and 0 downloads on Packagist - if nobody find value in this feature, it's better to remove it
* As much as possible, a better strategy is to render templates written by untrusted users via a specific loader that restrict what the sandbox environment can "see".
Commits
-------
bd924d5d33 Deprecate the "Twig\Sandbox\SourcePolicyInterface" interface
This PR was squashed before being merged into the 3.x branch.
Discussion
----------
Replace FQCN with use statements in SandboxTest
Commits
-------
d8781e473c Do not add : void for test methods
ed6df6b4b4 Fix deprecated PHP CS Fixer rules
This PR was merged into the 3.x branch.
Discussion
----------
Replace FQCN with use statements in SandboxTest
Commits
-------
a0a1f1d17d Replace FQCN with use statements in SandboxTest
The name passed to MacroReferenceExpression is emitted as raw PHP in
compile() via "->{$name}(...)". Callers were expected to validate
the name, but a missing check led to CVE-2026-XXXXX (PHP code injection
via _self / import macro reference): defense-in-depth, validate the
name in the constructor so the class is safe by construction.
This is a defense-in-depth measure: callers must always concatenate the
result into a double-quoted PHP context, but if one ever (mistakenly)
embeds it inside a single-quoted PHP literal, an attacker-controlled
single quote in the source value could break out of that context. The
previous commit fixed exactly such a bug in ModuleNode for the {% use %}
template name.
Encoding ' as the hex escape \x27 guarantees that the emitted PHP source
never contains a literal single quote derived from user input, while the
decoded runtime value is unchanged. \' is not used because it is not a
recognized escape sequence in PHP double-quoted strings (the backslash
would be kept literally).
The HtmlDumper output is intended to be rendered in a browser, and the
template and macro/block names it interpolates are loader-controlled
(e.g. the key for ArrayLoader or a database row id), so they can carry
arbitrary HTML when an application stores templates under user-supplied
identifiers.
This PR was merged into the 3.x branch.
Discussion
----------
Lazy load `EscaperRuntime` in `EscaperExtension`
This allows overriding `EscaperRuntime` via a custom runtime loader.
Previously, `EscaperExtension::setEnvironment()` was calling `$environment->getRuntime(EscaperRuntime::class)` eagerly. Since this method is called from `Environment::__construct()`, the runtime was resolved before any custom runtime loader could be injected, making it impossible to override `EscaperRuntime`.
- Required by https://github.com/symfony/symfony/pull/63929
Commits
-------
b73ab8cfd9 Lazy load EscaperRuntime in EscaperExtension
This PR was merged into the 3.x branch.
Discussion
----------
Add a `needs_is_sandboxed` option for filters, functions, and tests
This PR introduces a new `needs_is_sandboxed` option for Twig callables.
When set to `true`, Twig passes the current sandbox state (enabled/disabled) as a boolean to the callable. This lets filters, functions, and tests adapt their behavior depending on whether the sandbox is enabled or not.
Commits
-------
5462817da0 Add a `needs_is_sandboxed` option for filters, functions, and tests
Fabien Potencier
Alexandre Daubois
Nicolas Grekas