6 Commits

Author	SHA1	Message	Date
Fabien Potencier	d7f8b4eb1c	Redesign macro calls and argument handling	2026-07-30 13:53:24 +02:00
Fabien Potencier	be36fee09e	Rename macro variable AST nodes	2026-07-28 11:53:50 +02:00
Fabien Potencier	9c6d76b61c	Add void return type hint even in tests	2026-07-12 13:43:08 +02:00
Fabien Potencier	87093aab9e	Allow calling a macro with a dynamic name via the dot operator	2026-06-06 17:10:52 +02:00
Fabien Potencier	8a4b77920a	Add PHPUnit attributes alongside annotations to silence doc-comment metadata deprecations on PHPUnit 11	2026-06-03 18:26:39 +02:00
Fabien Potencier	ea3f7a2844	Validate macro name in MacroReferenceExpression constructor ... The name passed to MacroReferenceExpression is emitted as raw PHP in compile() via "->{$name}(...)". Callers were expected to validate the name, but a missing check led to CVE-2026-XXXXX (PHP code injection via _self / import macro reference): defense-in-depth, validate the name in the constructor so the class is safe by construction.	2026-05-19 23:42:31 +02:00