ffcae61b15
Move extends validation into correctness visitor
2026-06-11 07:43:47 +02:00
d96eac3895
Fix correctness visitor regressions
2026-06-11 07:43:46 +02:00
89e8699a73
Fix test assertions that did not verify the intended behavior
2026-06-11 07:43:36 +02:00
4b2e651dd5
Address review: fix block-nesting checks in CorrectnessNodeVisitor
2026-06-11 07:43:36 +02:00
de7bbc7be9
Move the extends-in-block and extends-in-macro errors into the CorrectnessNodeVisitor
2026-06-11 07:43:36 +02:00
c12100525e
Introduce a CorrectnessNodeVisitor to validate that templates are semantically correct
2026-06-11 07:43:33 +02:00
f938f6d153
Mark Markup as final
2026-06-07 10:29:17 +02:00
612dc96c18
feature #4838 Allow calling a macro with a dynamic name via the dot operator (fabpot)
...
This PR was merged into the 3.x branch.
Discussion
----------
Allow calling a macro with a dynamic name via the dot operator
Closes #4715
Commits
-------
87093aab9e
2026-06-07 09:36:06 +02:00
87093aab9e
Allow calling a macro with a dynamic name via the dot operator
2026-06-06 17:10:52 +02:00
aef7587fc8
feature #4819 Add an allow-list for tests to the sandbox security policy (fabpot)
...
This PR was merged into the 3.x branch.
Discussion
----------
Add an allow-list for tests to the sandbox security policy
Commits
-------
416d07da1d
2026-06-06 17:04:39 +02:00
416d07da1d
Add an allow-list for tests to the sandbox security policy
2026-06-06 11:08:56 +02:00
0197736dfc
Reduce memory usage of the context restoration compiled at the end of for loops
2026-06-06 09:31:56 +02:00
29c4325afd
Bump version to 3.28.0 for the always_allowed_in_sandbox feature
2026-06-06 08:56:59 +02:00
2d75c87d05
Add an always_allowed_in_sandbox flag for filters, functions, and tags
2026-06-06 08:56:58 +02:00
3868bac531
Avoid allocating a normalized copy when counting newlines without carriage returns
2026-06-05 20:33:28 +02:00
a82782ac30
Report columns in syntax errors
2026-06-05 20:28:45 +02:00
4943bb405c
Track the source offset of each token
2026-06-05 20:28:45 +02:00
afad02326d
minor #4662 CoreExtension::getAttribute: small improvement regarding getter/isser/hasser (gharlan)
...
This PR was merged into the 3.x branch.
Discussion
----------
CoreExtension::getAttribute: small improvement regarding getter/isser/hasser
For a getter method like `getFirstName` it is common to call it in twig via `person.firstName`.
But at the moment twig is adding these variants to the class method cache: `getFirstName`, `getfirstname`, `FirstName` and `firstname`.
So when resolving the name, it uses the first `elseif` here with additional `strtolower` call, because `firstName` is missing:
https://github.com/twigphp/Twig/blob/403bd9d73c2a010e5b26689f2f2eb9d7ddf391af/src/Extension/CoreExtension.php#L1863-L1867
This PR replaces `FirstName` with `firstName` in the method cache.
So `person.firstName` is resolved via first `if` branch (but `person.FirstName` would use the `elseif` with `strtolower` now).
Commits
-------
45cd6ffe80
2026-06-04 22:28:58 +02:00
a3eda4b1fd
Make the include() function return a Markup object
2026-06-04 21:32:12 +02:00
2171127676
Fix nested block() resolution when a directly rendered block calls parent()
2026-06-03 22:09:09 +02:00
86076c87a6
Stop reporting a skipped test in IntegrationTestCase when there is no legacy test to run
2026-06-03 20:07:23 +02:00
89f886e324
Skip the string cast in PrintNode when the expression is already a string and add tests
2026-06-03 19:56:27 +02:00
86840f9351
Ensure PrintNode is yielding string content
2026-06-03 19:56:11 +02:00
ee8ab447d7
Make IntegrationTestCase and NodeTestCase compatible with PHPUnit 11
2026-06-03 18:17:03 +02:00
6d5ef30436
Skip the sandbox __toString check on arguments whose PHP parameter type cannot implicitly coerce to string
2026-06-02 13:58:24 +02:00
dc1db9ef63
Bump version
2026-05-30 19:09:51 +02:00
ae2071bffb
Prepare the 3.27.1 release
2026-05-30 19:09:26 +02:00
8ec9530732
Fix inconsistent array access with a Stringable key
2026-05-29 10:06:57 +02:00
d25f98f45b
Preserve IteratorAggregate identity in sandbox __toString walker
2026-05-29 09:31:03 +02:00
86f3b3a1f2
Bump version
2026-05-27 15:06:12 +02:00
04ae1bfe94
Prepare the 3.27.0 release
2026-05-27 15:05:51 +02:00
23eb6eb126
Fix sandbox filter/tag/function allow-list bypass when sandbox state changes between renders
2026-05-27 14:59:42 +02:00
7d55aa838c
security #cve-2026-48805 Fix sandbox bypass in deprecated internal wrappers (fabpot)
...
This PR was merged into the twig-3.x branch.
2026-05-27 14:55:54 +02:00
9ff4101463
Fix sandbox __toString policy bypass via dynamic mapping keys
2026-05-27 14:54:34 +02:00
475fb690ac
Guard sandbox __toString walker against self-referencing iterables
2026-05-27 14:53:02 +02:00
e9e818cbfc
Fix sandbox __toString bypass via Stringable + Traversable containers
2026-05-27 14:53:01 +02:00
8d6af0707b
Fix sandbox __toString bypass via the in and not in operators
2026-05-27 14:52:32 +02:00
cc1e21a2a2
Fix sandbox __toString bypass via Traversable in join/replace filters
2026-05-27 14:52:30 +02:00
09c6706407
Fix sandbox bypass in the "column" filter under SourcePolicyInterface
2026-05-27 14:49:52 +02:00
af7bf5e181
Add a strict mode to SecurityPolicy to opt-in to the 4.0 sandbox behavior for the extends/use tags and the parent/block/attribute functions
2026-05-25 13:40:27 +02:00
42ccc472a2
Remove obsolete PHP 8.0 workaround for Closure::__invoke attribute access
2026-05-25 08:28:10 +02:00
cfaa2fd030
Deprecate the fact that the parent, block, and attribute functions are always allowed in a sandboxed template
2026-05-24 21:19:56 +02:00
33690a4a28
Fix PHP 8.1+ implicit float-to-int deprecation in sandboxed array access
2026-05-24 17:39:37 +02:00
e235cae3a1
Fix sandbox bypass in deprecated internal wrappers
2026-05-24 11:10:36 +02:00
49e59e4612
Simplify code
2026-05-24 09:57:49 +02:00
f6aca309d8
Escape root profile name in HtmlDumper
2026-05-23 09:39:26 +02:00
4c1dae5e71
Restrict allowed classes in Profile::unserialize()
2026-05-23 09:09:19 +02:00
4fc0210084
Bump version
2026-05-23 08:32:22 +02:00
bd924d5d33
Deprecate the "Twig\Sandbox\SourcePolicyInterface" interface
2026-05-23 08:30:05 +02:00
91b3d5182d
Bump version
2026-05-20 09:32:26 +02:00
Fabien Potencier
Christophe Coevoet