This PR was merged into the 3.x branch.
Discussion
----------
Reduce memory usage of the context restoration compiled at the end of for loops
Refs #4021
I benchmarked the new version and it's 10–15% faster CPU and half the allocations.
Commits
-------
0197736dfc Reduce memory usage of the context restoration compiled at the end of for loops
This PR was squashed before being merged into the 3.x branch.
Discussion
----------
Add an always_allowed_in_sandbox flag for filters, functions, and tags
Some filters, functions, and tags are pure and inherently safe to use in sandboxed templates. Forcing every sandbox policy to explicitly allow-list them is noisy.
Introduce an opt-in flag that lets callable and token-parser authors mark their item as always allowed in the sandbox. When set, the sandbox node visitor skips recording the name, so it never reaches the policy's `checkSecurity()` call: zero runtime cost, no allow-list entry required.
Commits
-------
cf4b50d181 Clarify sandbox always-allowed trust boundary
29c4325afd Bump version to 3.28.0 for the always_allowed_in_sandbox feature
1c53b790fb Add regression tests that always-allowed callables still enforce the sandbox __toString policy on arguments
7fd87a381f Document the criteria for always-allowed sandbox items and list 4.0 built-ins
2d75c87d05 Add an always_allowed_in_sandbox flag for filters, functions, and tags
This PR was squashed before being merged into the 3.x branch.
Discussion
----------
Track the source offset of each token and expose it in syntax errors
Commits
-------
3868bac531 Avoid allocating a normalized copy when counting newlines without carriage returns
a82782ac30 Report columns in syntax errors
4943bb405c Track the source offset of each token
This PR was merged into the 3.x branch.
Discussion
----------
Document how to customize the markdown_to_html converter
Closes#3842Closes#3211
Commits
-------
36cd35dff4 Document how to customize the markdown_to_html converter
This PR was merged into the 3.x branch.
Discussion
----------
CoreExtension::getAttribute: small improvement regarding getter/isser/hasser
For a getter method like `getFirstName` it is common to call it in twig via `person.firstName`.
But at the moment twig is adding these variants to the class method cache: `getFirstName`, `getfirstname`, `FirstName` and `firstname`.
So when resolving the name, it uses the first `elseif` here with additional `strtolower` call, because `firstName` is missing:
https://github.com/twigphp/Twig/blob/403bd9d73c2a010e5b26689f2f2eb9d7ddf391af/src/Extension/CoreExtension.php#L1863-L1867
This PR replaces `FirstName` with `firstName` in the method cache.
So `person.firstName` is resolved via first `if` branch (but `person.FirstName` would use the `elseif` with `strtolower` now).
Commits
-------
45cd6ffe80 CoreExtension::getAttribute: small improvement regarding getter/isser/hasser
This PR was merged into the 3.x branch.
Discussion
----------
Make the include() function return a Markup object
Closes#4754
Commits
-------
a3eda4b1fd Make the include() function return a Markup object
This PR was merged into the 3.x branch.
Discussion
----------
Fix nested block() resolution when a directly rendered block calls parent()
Closes#3321
Commits
-------
279fe13b22 Fix nested block() resolution when a directly rendered block calls parent()
This PR was merged into the 3.x branch.
Discussion
----------
Document {#--#} as the replacement for the deprecated spaceless filter
Closes#4442
Commits
-------
c29877f54a Document {#--#} as the replacement for the deprecated spaceless filter
This PR was merged into the 3.x branch.
Discussion
----------
Stop reporting a skipped test in IntegrationTestCase when there is no legacy test to run
Closes#4635
Commits
-------
86076c87a6 Stop reporting a skipped test in IntegrationTestCase when there is no legacy test to run
This PR was merged into the 3.x branch.
Discussion
----------
Document storing an enum in a variable to avoid repeating its FQCN
Closes#4646
Commits
-------
e1178abfa1 Document storing an enum in a variable to avoid repeating its FQCN
This PR was merged into the 3.x branch.
Discussion
----------
Cast printed expressions to string so values that cannot be converted to a string (arrays, non-`Stringable` objects, ...) report a usable stack trace at the print location
Closes#4765Closes#4780Closes#4644
Is it what you had in mind `@stof`?
Commits
-------
89f886e324 Skip the string cast in PrintNode when the expression is already a string and add tests
86840f9351 Ensure PrintNode is yielding string content
This PR was squashed before being merged into the 3.x branch.
Discussion
----------
Make IntegrationTestCase and NodeTestCase compatible with PHPUnit 11
Closes#4782
Commits
-------
8a4b77920a Add PHPUnit attributes alongside annotations to silence doc-comment metadata deprecations on PHPUnit 11
8b35934e68 Run the test suite against PHPUnit 11.3 in CI
ee8ab447d7 Make IntegrationTestCase and NodeTestCase compatible with PHPUnit 11
This PR was squashed before being merged into the 3.x branch.
Discussion
----------
Skip the sandbox `__toString` check on arguments whose PHP parameter type cannot implicitly coerce to string
The sandbox visitor currently wraps every argument of every Twig callable with `CheckToStringNode.
As an optimization, we are now only wrapping when needed (based on the callable type hints). This is a conservative approach (untyped, mixed, string, array, iterable, object, Stringable, Traversable, self/static/parent and unknown class names all keep wrapping).
Here is a concrete before/after for template `{{ demo(a, b) }}` under the sandbox, with the following signature on the PHP side `demo(int $a, string $b)`:
**Before**:
```php
yield $this->sandbox->ensureToStringAllowed(
$this->env->getFunction('demo')->getCallable()(
$this->sandbox->ensureToStringAllowed(($context["a"] ?? null), 1, $this->source),
$this->sandbox->ensureToStringAllowed(($context["b"] ?? null), 1, $this->source),
),
1, $this->source,
);
```
**After**
```php
yield $this->sandbox->ensureToStringAllowed(
$this->env->getFunction('demo')->getCallable()(
($context["a"] ?? null), // int: bare, skipped
$this->sandbox->ensureToStringAllowed(($context["b"] ?? null), 1, $this->source), // string: still wrapped
),
1, $this->source,
);
```
Commits
-------
6d5ef30436 Skip the sandbox `__toString` check on arguments whose PHP parameter type cannot implicitly coerce to string
This PR was merged into the 3.x branch.
Discussion
----------
Fix inconsistent array access with a Stringable key
Closes#4804
Commits
-------
8ec9530732 Fix inconsistent array access with a Stringable key
This PR was merged into the 3.x branch.
Discussion
----------
Preserve IteratorAggregate identity in sandbox __toString walker
Fixes#4820
It's not a full fix, but a quick one just that for the specific use case described in the issue. This is the simple case as IteratorAggregate instances can be iterated more than once (I suppose most such iterators don't have side effects).
Commits
-------
d25f98f45b Preserve IteratorAggregate identity in sandbox __toString walker
This PR was merged into the twig-3.x branch.
Discussion
----------
Fix sandbox filter/tag/function allow-list bypass when sandbox state changes between renders
Fixes#555
Commits
-------
23eb6eb126 Fix sandbox filter/tag/function allow-list bypass when sandbox state changes between renders
This PR was squashed before being merged into the twig-3.x branch.
Discussion
----------
Fix sandbox __toString policy bypass via dynamic mapping keys
Fixes#548
Fixing this one introduces a new feature that I've decided to "keep" and document :)
Commits
-------
635cea4789 Document new support for any expression as a dynamic mapping key
9ff4101463 Fix sandbox __toString policy bypass via dynamic mapping keys
Fabien Potencier
Christophe Coevoet