f05c5011c2
Fix sandbox bypass in the "column" filter
2026-05-20 07:33:52 +02:00
447d0b2331
Fix sandbox __toString bypasses
2026-05-20 00:18:59 +02:00
324fa60545
Fix sandbox bypass: PHP code injection via _self / import macro reference
2026-05-19 23:41:59 +02:00
aeb37f4801
Fix deprecations in tests
2026-05-19 23:05:30 +02:00
819c6a89fe
Fix sandbox bypass in the {% sandbox %} tag when including a preloaded template
2026-05-19 23:00:58 +02:00
e494400ce4
Fix deprecation
2026-05-19 22:05:26 +02:00
a8eb5a8a74
security #cve-2026-46639 Fix sandbox bypass in object destructuring assignment (alexandre-daubois)
...
This PR was merged into the twig-3.x branch.
2026-05-19 21:37:04 +02:00
d0579ededc
Fix sandbox bypass: propagate sandbox state to checkArrow for source-policy sandboxing
2026-05-16 18:56:08 +01:00
5462817da0
Add a needs_is_sandboxed option for filters, functions, and tests
2026-05-16 18:52:17 +01:00
3fe13f98f8
Fix sandbox bypass in object destructuring assignment
2026-04-28 12:59:06 +02:00
85a4817128
CS fixes
2025-07-29 10:07:07 +02:00
76062c8d51
Fix CS
2025-01-19 16:54:05 +01:00
d72ae2447e
Merge branch '3.14.x' into 3.x
...
* 3.14.x:
Improve detection of recursion
Fix recursion when arrays contain self-references in sandboxed mode
Fix code
Prepare the 3.11.2 release
Update CHANGELOG
Sandbox ArrayAccess and do sandbox checks before isset() checks
Fix sandbox handling for __toString()
Prepare the 3.14.1 release
Update CHANGELOG
Sandbox ArrayAccess and do sandbox checks before isset() checks
Fix sandbox handling for __toString()
Prepare the 3.11.1 release
Fix a security issue when an included sandboxed template has been loaded before without the sandbox context
2024-11-07 11:17:57 +01:00
83a21d31e5
Merge branch '3.11.x' into 3.14.x
...
* 3.11.x:
Improve detection of recursion
Fix recursion when arrays contain self-references in sandboxed mode
Fix code
Prepare the 3.11.2 release
Update CHANGELOG
Sandbox ArrayAccess and do sandbox checks before isset() checks
Fix sandbox handling for __toString()
Prepare the 3.11.1 release
Fix a security issue when an included sandboxed template has been loaded before without the sandbox context
2024-11-07 11:11:36 +01:00
a0f775683d
Fix recursion when arrays contain self-references in sandboxed mode
2024-11-07 09:42:22 +01:00
b957e5a44c
Sandbox ArrayAccess and do sandbox checks before isset() checks
2024-11-06 21:41:25 +01:00
d4a302681b
Fix sandbox handling for __toString()
2024-11-06 21:35:53 +01:00
ec39a9dccc
Sandbox ArrayAccess and do sandbox checks before isset() checks
2024-11-06 19:48:59 +01:00
cafc608ece
Fix sandbox handling for __toString()
2024-11-06 19:27:48 +01:00
831c148e78
Sandbox ArrayAccess and do sandbox checks before isset() checks
2024-11-06 19:16:07 +01:00
2bb8c2460a
Fix sandbox handling for __toString()
2024-11-05 17:54:37 +01:00
9369a48c53
Deprecate the sandbox tag
2024-09-10 22:41:00 +02:00
2ae0c0d38c
Fix CS
2024-09-06 12:33:38 +02:00
797e490356
Improve exception expectations reliability
2024-09-04 15:22:48 +02:00
6ddb76bb76
Make data providers static
2024-09-03 16:32:00 +02:00
8663ec242b
fix typo
2024-08-28 14:18:47 +02:00
5fca700cbd
Deprecate the fact that the extends and use tags are always allowed in a sandboxed template
2024-08-28 13:40:53 +02:00
e6a98a000f
Fix test without any assertions
2023-12-20 20:34:04 +01:00
fca89954f1
Simplify tests
2023-12-20 20:34:04 +01:00
204cd6f412
Merge branch '2.x' into 3.x
...
* 2.x:
Add SourcePolicyInterface to selectively enable the Sandbox based on a template's Source
2023-12-19 08:19:15 +01:00
a18da1614a
Add SourcePolicyInterface to selectively enable the Sandbox based on a template's Source
2023-12-19 08:18:35 +01:00
62732646c8
Minor rename of SandboxTest functions->methods
2023-10-27 12:15:56 -04:00
5e1838dbca
Fix premature loop exit in Security Policy lookup of allowed methods/properties
2023-10-26 17:37:13 -07:00
2eb3308055
Disallow non closures in sort filter when the sanbox mode is enabled
2022-02-04 07:52:21 +01:00
497f027cd4
Merge branch '1.x' into 2.x
...
* 1.x:
Fix "include(template_from_string())"
Fix PHPUnit config
2020-10-27 15:14:55 +01:00
df9c9f2165
Fix "include(template_from_string())"
2020-10-27 13:39:31 +01:00
ab6695b580
Merge branch '1.x' into 2.x
...
* 1.x:
Fix sandbox support when using include(template_from_string())
Add test to verify that filter is not working when template_from_string is used.
In |filter(), |map(), and |reduce(), throw a RuntimeError instead of a TypeError
2020-08-23 17:55:14 +02:00
c7be1bb3c4
Fix sandbox support when using include(template_from_string())
2020-08-23 17:48:34 +02:00
04431228af
Add test to verify that filter is not working when template_from_string is used.
2020-08-23 17:46:12 +02:00
9bf49d5ccf
Merge branch '1.x' into 2.x
...
* 1.x:
Update CHANGELOG
Fix previous merge
Make round brackets optional for one argument tests like sameas
2020-08-23 14:22:09 +02:00
1ee72d9e15
Make round brackets optional for one argument tests like sameas
2020-08-23 14:16:31 +02:00
81612a5c7d
Merge branch '1.x' into 2.x
...
* 1.x:
Fix CS
2020-08-23 13:49:18 +02:00
bde54e11b8
Fix CS
2020-08-23 13:48:32 +02:00
38bd74d03a
Merge branch '1.x' into 2.x
...
* 1.x:
Add a test
fix typo in ApplyTokenParser PHP doc
Fixes #3351
2020-08-05 16:53:59 +02:00
04658c9f59
Fixes #3351
2020-07-09 14:43:36 +02:00
d190c2e7f7
Merge branch '1.x' into 2.x
...
* 1.x:
Restrict callables to closures in filters
2020-07-05 15:32:43 +02:00
d8259519c0
Restrict callables to closures in filters
2020-07-05 15:30:15 +02:00
791f001ae6
Merge branch '1.x' into 2.x
...
* 1.x:
Minor fixes
2020-05-21 11:15:20 +02:00
5dc364469b
Minor fixes
2020-05-21 11:01:36 +02:00
b845ed969e
Twig 2 is compatible with PHP 7.0
2019-09-20 15:13:40 +02:00
Alexandre Daubois
Fabien Potencier
Nicolas Grekas
Lee Rowlands
Alexander M. Turek
Christian Flothmann
Yaakov Saxon
Bozhidar Hristov
Andreas
Jérémy Derussé