Commit Graph

63 Commits

Author SHA1 Message Date
Fabien Potencier 0c515667d2 Merge remote-tracking branch 'origin/3.x' into 4.x
* origin/3.x:
  Add a `needs_is_sandboxed` option for filters, functions, and tests
  Bump version
  Make embeds deterministic
  [Doc] Document loose comparison in the `in` operator
  [Doc] Reword whitespace control note about first-newline removal
  Stop publishing extra package minor versions with no changes
  Lazy load EscaperRuntime in EscaperExtension
  Fix typo
  Replace parent-child analogy in `doc/tags/extends.rst`
  doc: Add missing toctree entries and fix ordering
  Fix CHANGELOG
  Bump version
  Prepare the 3.24.0 release
2026-05-17 08:18:04 +01:00
Fabien Potencier 5462817da0 Add a needs_is_sandboxed option for filters, functions, and tests 2026-05-16 18:52:17 +01:00
Nicolas Grekas c649c1658b Merge branch '3.x' into 4.x
* 3.x:
  CS fixes
  Enable Fabbot as a GHA
2025-07-29 10:27:55 +02:00
Nicolas Grekas 85a4817128 CS fixes 2025-07-29 10:07:07 +02:00
Fabien Potencier 28246c5d4e Merge branch '3.x' into 4.x
* 3.x:
  Fixing minor typo in Update inline_css.rst
  Ignore static properties when using the dot operator
  Fix CS
  Fix constant() behavior when used with ??
  Finish the work
  fix indentation
  Apply suggestions from code review
  typo
  fix merge
  docs and changelog
  typehint instead of checkArrow
  checkArrow, typehints
  invoke filter
2025-01-24 11:32:17 +01:00
Fabien Potencier 76062c8d51 Fix CS 2025-01-19 16:54:05 +01:00
Fabien Potencier 82cde4edcb Fix CS 2024-11-30 09:45:07 +01:00
Nicolas Grekas 3f7c47fc01 Merge branch '3.x' into 4.x
* 3.x:
  Improve detection of recursion
  Fix recursion when arrays contain self-references in sandboxed mode
  Fix code
  Prepare the 3.11.2 release
  Update CHANGELOG
  Sandbox ArrayAccess and do sandbox checks before isset() checks
  Fix sandbox handling for __toString()
  Prepare the 3.14.1 release
  Update CHANGELOG
  Sandbox ArrayAccess and do sandbox checks before isset() checks
  Fix sandbox handling for __toString()
  Prepare the 3.11.1 release
  Fix a security issue when an included sandboxed template has been loaded before without the sandbox context
2024-11-07 11:43:01 +01:00
Nicolas Grekas d72ae2447e Merge branch '3.14.x' into 3.x
* 3.14.x:
  Improve detection of recursion
  Fix recursion when arrays contain self-references in sandboxed mode
  Fix code
  Prepare the 3.11.2 release
  Update CHANGELOG
  Sandbox ArrayAccess and do sandbox checks before isset() checks
  Fix sandbox handling for __toString()
  Prepare the 3.14.1 release
  Update CHANGELOG
  Sandbox ArrayAccess and do sandbox checks before isset() checks
  Fix sandbox handling for __toString()
  Prepare the 3.11.1 release
  Fix a security issue when an included sandboxed template has been loaded before without the sandbox context
2024-11-07 11:17:57 +01:00
Nicolas Grekas 83a21d31e5 Merge branch '3.11.x' into 3.14.x
* 3.11.x:
  Improve detection of recursion
  Fix recursion when arrays contain self-references in sandboxed mode
  Fix code
  Prepare the 3.11.2 release
  Update CHANGELOG
  Sandbox ArrayAccess and do sandbox checks before isset() checks
  Fix sandbox handling for __toString()
  Prepare the 3.11.1 release
  Fix a security issue when an included sandboxed template has been loaded before without the sandbox context
2024-11-07 11:11:36 +01:00
Lee Rowlands a0f775683d Fix recursion when arrays contain self-references in sandboxed mode 2024-11-07 09:42:22 +01:00
Fabien Potencier 429b13c9b0 Merge branch '3.x' into 4.x
* 3.x:
  Remove obsolete code
  Update CHANGELOG
  Sandbox ArrayAccess and do sandbox checks before isset() checks
  Fix sandbox handling for __toString()
  Fix mistake in docs for `keys` filter
  Update CHANGELOG
  [String] Add SpanishInflector support for singular and plural
  Add `find` to `Filters` docs
  Remove duplicate test case
  Revert "minor #4411 Add return type to getDebugInfo (ruudk)"
  Add `$this` return type to Template::unwrap
  Add link to TwigQI in docs "You might also be interested in" section
  Add return type to compiled macro
2024-11-06 21:52:30 +01:00
Nicolas Grekas b957e5a44c Sandbox ArrayAccess and do sandbox checks before isset() checks 2024-11-06 21:41:25 +01:00
Fabien Potencier d4a302681b Fix sandbox handling for __toString() 2024-11-06 21:35:53 +01:00
Nicolas Grekas ec39a9dccc Sandbox ArrayAccess and do sandbox checks before isset() checks 2024-11-06 19:48:59 +01:00
Fabien Potencier cafc608ece Fix sandbox handling for __toString() 2024-11-06 19:27:48 +01:00
Nicolas Grekas 831c148e78 Sandbox ArrayAccess and do sandbox checks before isset() checks 2024-11-06 19:16:07 +01:00
Fabien Potencier 2bb8c2460a Fix sandbox handling for __toString() 2024-11-05 17:54:37 +01:00
Fabien Potencier e98b10a802 Remove obsolete code 2024-10-04 21:08:34 +02:00
Fabien Potencier eb2a77d7d2 Remove deprecated code 2024-09-10 22:45:56 +02:00
Fabien Potencier 9b9196c9d6 Merge branch '3.x' into 4.x
* 3.x:
  Deprecate the sandbox tag
  Removed @internal on Environment::getGlobals()
  Clarify docs on registerUndefinedTokenParserCallback()
  Simplify code
2024-09-10 22:43:00 +02:00
Fabien Potencier 9369a48c53 Deprecate the sandbox tag 2024-09-10 22:41:00 +02:00
Fabien Potencier fa1c9f0bf9 Merge branch '3.x' into 4.x
* 3.x:
  Remove obsolete code
  Deprecate Environment::mergeGlobals()
  Bump version
  Prepare the 3.13.0 release
  Fix wrong format of `Environment::VERSION_ID` constant
  Fix minor things
  Fix CS
  Fix isset in ForLoopNode
  Fix iterable return type
  Improve exception expectations reliability
2024-09-07 17:03:10 +02:00
Fabien Potencier 2ae0c0d38c Fix CS 2024-09-06 12:33:38 +02:00
Alexandre Daubois 797e490356 Improve exception expectations reliability 2024-09-04 15:22:48 +02:00
Alexander M. Turek f2053bbea0 PHPUnit 11 2024-09-04 12:11:51 +02:00
Fabien Potencier a789eca738 Merge branch '3.x' into 4.x
* 3.x:
  Validate the input of CoreExtension::map()
  Rename AbstractTest to ProfilerTestCase
  Make data providers static
  Prepare IntegrationTestCase for static data providers
2024-09-03 22:20:28 +02:00
Alexander M. Turek 6ddb76bb76 Make data providers static 2024-09-03 16:32:00 +02:00
Alexander M. Turek 0ab26b08b9 Switch to expectUserDeprecationMessage() 2024-09-02 15:38:53 +02:00
Christian Flothmann 8663ec242b fix typo 2024-08-28 14:18:47 +02:00
Fabien Potencier 7cfcefcaef Remove deprecated code 2024-08-28 14:01:55 +02:00
Fabien Potencier e2f0128774 Merge branch '3.x' into 4.x
* 3.x:
  Deprecate the fact that the `extends` and `use` tags are always allowed in a sandboxed template
  Clarify block function
2024-08-28 13:56:42 +02:00
Fabien Potencier 5fca700cbd Deprecate the fact that the extends and use tags are always allowed in a sandboxed template 2024-08-28 13:40:53 +02:00
Fabien Potencier e5431b1361 Modernize code 2024-05-04 18:35:53 +02:00
Fabien Potencier e6a98a000f Fix test without any assertions 2023-12-20 20:34:04 +01:00
Fabien Potencier fca89954f1 Simplify tests 2023-12-20 20:34:04 +01:00
Fabien Potencier 204cd6f412 Merge branch '2.x' into 3.x
* 2.x:
  Add SourcePolicyInterface to selectively enable the Sandbox based on a template's Source
2023-12-19 08:19:15 +01:00
Yaakov Saxon a18da1614a Add SourcePolicyInterface to selectively enable the Sandbox based on a template's Source 2023-12-19 08:18:35 +01:00
Yaakov Saxon 62732646c8 Minor rename of SandboxTest functions->methods 2023-10-27 12:15:56 -04:00
Yaakov Saxon 5e1838dbca Fix premature loop exit in Security Policy lookup of allowed methods/properties 2023-10-26 17:37:13 -07:00
Fabien Potencier 2eb3308055 Disallow non closures in sort filter when the sanbox mode is enabled 2022-02-04 07:52:21 +01:00
Fabien Potencier 497f027cd4 Merge branch '1.x' into 2.x
* 1.x:
  Fix "include(template_from_string())"
  Fix PHPUnit config
2020-10-27 15:14:55 +01:00
Fabien Potencier df9c9f2165 Fix "include(template_from_string())" 2020-10-27 13:39:31 +01:00
Fabien Potencier ab6695b580 Merge branch '1.x' into 2.x
* 1.x:
  Fix sandbox support when using include(template_from_string())
  Add test to verify that filter is not working when template_from_string is used.
  In |filter(), |map(), and |reduce(), throw a RuntimeError instead of a TypeError
2020-08-23 17:55:14 +02:00
Fabien Potencier c7be1bb3c4 Fix sandbox support when using include(template_from_string()) 2020-08-23 17:48:34 +02:00
Bozhidar Hristov 04431228af Add test to verify that filter is not working when template_from_string is used. 2020-08-23 17:46:12 +02:00
Fabien Potencier 9bf49d5ccf Merge branch '1.x' into 2.x
* 1.x:
  Update CHANGELOG
  Fix previous merge
  Make round brackets optional for one argument tests like sameas
2020-08-23 14:22:09 +02:00
Andreas 1ee72d9e15 Make round brackets optional for one argument tests like sameas 2020-08-23 14:16:31 +02:00
Fabien Potencier 81612a5c7d Merge branch '1.x' into 2.x
* 1.x:
  Fix CS
2020-08-23 13:49:18 +02:00
Fabien Potencier bde54e11b8 Fix CS 2020-08-23 13:48:32 +02:00