This PR was merged into the 3.x branch.
Discussion
----------
Set LANG=en_US.UTF-8 for the extra packages tests
Commits
-------
d016d2439f Set LANG=en_US.UTF-8 for the extra packages tests
This PR was squashed before being merged into the 3.x branch.
Discussion
----------
Use modern PHPUnit for extra packages
Commits
-------
25d7eb60d7 Use per-extension PHPUnit bridge and force PHPUnit 11 on PHP 8.2+
54420847f0 Install a custom exception handler before bootstrapping KernelTestCase
This PR was merged into the 3.x branch.
Discussion
----------
Escape root profile name in HtmlDumper
Commits
-------
f6aca309d8 Escape root profile name in HtmlDumper
This PR was merged into the 3.x branch.
Discussion
----------
Restrict allowed classes in Profile::unserialize()
Commits
-------
4c1dae5e71 Restrict allowed classes in Profile::unserialize()
This PR was merged into the 3.x branch.
Discussion
----------
Deprecate the "Twig\Sandbox\SourcePolicyInterface" interface
I'm deprecating this feature for the following main reasons:
* AFAICS, no open-source projects is using this feature and the only repository using it has 0 stars and 0 downloads on Packagist - if nobody find value in this feature, it's better to remove it
* As much as possible, a better strategy is to render templates written by untrusted users via a specific loader that restrict what the sandbox environment can "see".
Commits
-------
bd924d5d33 Deprecate the "Twig\Sandbox\SourcePolicyInterface" interface
This PR was squashed before being merged into the 3.x branch.
Discussion
----------
Replace FQCN with use statements in SandboxTest
Commits
-------
d8781e473c Do not add : void for test methods
ed6df6b4b4 Fix deprecated PHP CS Fixer rules
This PR was merged into the 3.x branch.
Discussion
----------
Replace FQCN with use statements in SandboxTest
Commits
-------
a0a1f1d17d Replace FQCN with use statements in SandboxTest
The name passed to MacroReferenceExpression is emitted as raw PHP in
compile() via "->{$name}(...)". Callers were expected to validate
the name, but a missing check led to CVE-2026-XXXXX (PHP code injection
via _self / import macro reference): defense-in-depth, validate the
name in the constructor so the class is safe by construction.
This is a defense-in-depth measure: callers must always concatenate the
result into a double-quoted PHP context, but if one ever (mistakenly)
embeds it inside a single-quoted PHP literal, an attacker-controlled
single quote in the source value could break out of that context. The
previous commit fixed exactly such a bug in ModuleNode for the {% use %}
template name.
Encoding ' as the hex escape \x27 guarantees that the emitted PHP source
never contains a literal single quote derived from user input, while the
decoded runtime value is unchanged. \' is not used because it is not a
recognized escape sequence in PHP double-quoted strings (the backslash
would be kept literally).
Fabien Potencier
Alexandre Daubois