'Fabien', 'obj' => new FooObject(), 'arr' => ['obj' => new FooObject()], 'child_obj' => new ChildClass(), ]; self::$templates = [ '1_basic1' => '{{ obj.foo }}', '1_basic2' => '{{ name|upper }}', '1_basic3' => '{% if name %}foo{% endif %}', '1_basic4' => '{{ obj.bar }}', '1_basic5' => '{{ obj }}', '1_basic7' => '{{ cycle(["foo","bar"], 1) }}', '1_basic8' => '{{ obj.getfoobar }}{{ obj.getFooBar }}', '1_basic9' => '{{ obj.foobar }}{{ obj.fooBar }}', '1_basic' => '{% if obj.foo %}{{ obj.foo|upper }}{% endif %}', '1_layout' => '{% block content %}{% endblock %}', '1_child' => "{% extends \"1_layout\" %}\n{% block content %}\n{{ \"a\"|json_encode }}\n{% endblock %}", '1_include' => '{{ include("1_basic1", sandboxed=true) }}', '1_basic2_include_template_from_string_sandboxed' => '{{ include(template_from_string("{{ name|upper }}"), sandboxed=true) }}', '1_basic2_include_template_from_string' => '{{ include(template_from_string("{{ name|upper }}")) }}', '1_range_operator' => '{{ (1..2)[0] }}', '1_syntax_error_wrapper_legacy' => '{% sandbox %}{% include "1_syntax_error" %}{% endsandbox %}', '1_syntax_error_wrapper' => '{{ include("1_syntax_error", sandboxed: true) }}', '1_syntax_error' => '{% syntax error }}', '1_childobj_parentmethod' => '{{ child_obj.ParentMethod() }}', '1_childobj_childmethod' => '{{ child_obj.ChildMethod() }}', '1_empty' => '', ]; } /** * @dataProvider getSandboxedForCoreTagsTests */ public function testSandboxForCoreTags(string $tag, string $template) { $twig = $this->getEnvironment(true, [], self::$templates, []); $this->expectException(SecurityError::class); $this->expectExceptionMessageMatches(\sprintf('/Tag "%s" is not allowed in "index \(string template .+?\)" at line 1/', $tag)); $twig->createTemplate($template, 'index')->render([]); } public static function getSandboxedForCoreTagsTests() { yield ['apply', '{% apply upper %}foo{% endapply %}']; yield ['autoescape', '{% autoescape %}foo{% endautoescape %}']; yield ['block', '{% block foo %}foo{% endblock %}']; yield ['deprecated', '{% deprecated "message" %}']; yield ['do', '{% do 1 + 2 %}']; yield ['embed', '{% embed "base.twig" %}{% endembed %}']; // To be uncommented in 4.0 // yield ['extends', '{% extends "base.twig" %}']; yield ['flush', '{% flush %}']; yield ['for', '{% for i in 1..2 %}{% endfor %}']; yield ['from', '{% from "macros" import foo %}']; yield ['if', '{% if false %}{% endif %}']; yield ['import', '{% import "macros" as macros %}']; yield ['include', '{% include "macros" %}']; yield ['macro', '{% macro foo() %}{% endmacro %}']; yield ['set', '{% set foo = 1 %}']; // To be uncommented in 4.0 // yield ['use', '{% use "1_empty" %}']; yield ['with', '{% with foo %}{% endwith %}']; } /** * @dataProvider getSandboxedForExtendsAndUseTagsTests * * @group legacy */ public function testSandboxForExtendsAndUseTags(string $tag, string $template) { $this->expectDeprecation(\sprintf('Since twig/twig 3.12: The "%s" tag is always allowed in sandboxes, but won\'t be in 4.0, please enable it explicitly in your sandbox policy if needed.', $tag)); $twig = $this->getEnvironment(true, [], self::$templates, []); $twig->createTemplate($template, 'index')->render([]); } public static function getSandboxedForExtendsAndUseTagsTests() { yield ['extends', '{% extends "1_empty" %}']; yield ['use', '{% use "1_empty" %}']; } public function testSandboxWithInheritance() { $twig = $this->getEnvironment(true, [], self::$templates, ['extends', 'block']); $this->expectException(SecurityError::class); $this->expectExceptionMessage('Filter "json_encode" is not allowed in "1_child" at line 3.'); $twig->load('1_child')->render([]); } public function testSandboxGloballySet() { $twig = $this->getEnvironment(false, [], self::$templates); $this->assertEquals('FOO', $twig->load('1_basic')->render(self::$params), 'Sandbox does nothing if it is disabled globally'); } public function testSandboxUnallowedMethodAccessor() { $twig = $this->getEnvironment(true, [], self::$templates); try { $twig->load('1_basic1')->render(self::$params); $this->fail('Sandbox throws a SecurityError exception if an unallowed method is called'); } catch (SecurityNotAllowedMethodError $e) { $this->assertEquals('Twig\Tests\Extension\FooObject', $e->getClassName(), 'Exception should be raised on the "Twig\Tests\Extension\FooObject" class'); $this->assertEquals('foo', $e->getMethodName(), 'Exception should be raised on the "foo" method'); } } /** * @group legacy */ public function testIfSandBoxIsDisabledAfterSyntaxErrorLegacy() { $twig = $this->getEnvironment(false, [], self::$templates); try { $twig->load('1_syntax_error_wrapper_legacy')->render(self::$params); } catch (SyntaxError $e) { /** @var SandboxExtension $sandbox */ $sandbox = $twig->getExtension(SandboxExtension::class); $this->assertFalse($sandbox->isSandboxed()); } } public function testIfSandBoxIsDisabledAfterSyntaxError() { $twig = $this->getEnvironment(false, [], self::$templates); try { $twig->load('1_syntax_error_wrapper')->render(self::$params); } catch (SyntaxError $e) { /** @var SandboxExtension $sandbox */ $sandbox = $twig->getExtension(SandboxExtension::class); $this->assertFalse($sandbox->isSandboxed()); } } public function testSandboxGloballyFalseUnallowedFilterWithIncludeTemplateFromStringSandboxed() { $twig = $this->getEnvironment(false, [], self::$templates); $twig->addExtension(new StringLoaderExtension()); try { $twig->load('1_basic2_include_template_from_string_sandboxed')->render(self::$params); $this->fail('Sandbox throws a SecurityError exception if an unallowed filter is called'); } catch (SecurityNotAllowedFilterError $e) { $this->assertEquals('upper', $e->getFilterName(), 'Exception should be raised on the "upper" filter'); } } public function testSandboxGloballyTrueUnallowedFilterWithIncludeTemplateFromStringSandboxed() { $twig = $this->getEnvironment(true, [], self::$templates, [], [], [], [], ['include', 'template_from_string']); $twig->addExtension(new StringLoaderExtension()); try { $twig->load('1_basic2_include_template_from_string_sandboxed')->render(self::$params); $this->fail('Sandbox throws a SecurityError exception if an unallowed filter is called'); } catch (SecurityNotAllowedFilterError $e) { $this->assertEquals('upper', $e->getFilterName(), 'Exception should be raised on the "upper" filter'); } } public function testSandboxGloballyFalseUnallowedFilterWithIncludeTemplateFromStringNotSandboxed() { $twig = $this->getEnvironment(false, [], self::$templates); $twig->addExtension(new StringLoaderExtension()); $this->assertSame('FABIEN', $twig->load('1_basic2_include_template_from_string')->render(self::$params)); } public function testSandboxGloballyTrueUnallowedFilterWithIncludeTemplateFromStringNotSandboxed() { $twig = $this->getEnvironment(true, [], self::$templates, [], [], [], [], ['include', 'template_from_string']); $twig->addExtension(new StringLoaderExtension()); try { $twig->load('1_basic2_include_template_from_string')->render(self::$params); $this->fail('Sandbox throws a SecurityError exception if an unallowed filter is called'); } catch (SecurityNotAllowedFilterError $e) { $this->assertEquals('upper', $e->getFilterName(), 'Exception should be raised on the "upper" filter'); } } public function testSandboxUnallowedFilter() { $twig = $this->getEnvironment(true, [], self::$templates); try { $twig->load('1_basic2')->render(self::$params); $this->fail('Sandbox throws a SecurityError exception if an unallowed filter is called'); } catch (SecurityNotAllowedFilterError $e) { $this->assertEquals('upper', $e->getFilterName(), 'Exception should be raised on the "upper" filter'); } } public function testSandboxUnallowedTag() { $twig = $this->getEnvironment(true, [], self::$templates); try { $twig->load('1_basic3')->render(self::$params); $this->fail('Sandbox throws a SecurityError exception if an unallowed tag is used in the template'); } catch (SecurityNotAllowedTagError $e) { $this->assertEquals('if', $e->getTagName(), 'Exception should be raised on the "if" tag'); } } public function testSandboxUnallowedProperty() { $twig = $this->getEnvironment(true, [], self::$templates); try { $twig->load('1_basic4')->render(self::$params); $this->fail('Sandbox throws a SecurityError exception if an unallowed property is called in the template'); } catch (SecurityNotAllowedPropertyError $e) { $this->assertEquals('Twig\Tests\Extension\FooObject', $e->getClassName(), 'Exception should be raised on the "Twig\Tests\Extension\FooObject" class'); $this->assertEquals('bar', $e->getPropertyName(), 'Exception should be raised on the "bar" property'); } } /** * @dataProvider getSandboxUnallowedToStringTests */ public function testSandboxUnallowedToString($template) { $twig = $this->getEnvironment(true, [], ['index' => $template], [], ['upper'], ['Twig\Tests\Extension\FooObject' => 'getAnotherFooObject'], [], ['random']); try { $twig->load('index')->render(self::$params); $this->fail('Sandbox throws a SecurityError exception if an unallowed method (__toString()) is called in the template'); } catch (SecurityNotAllowedMethodError $e) { $this->assertEquals('Twig\Tests\Extension\FooObject', $e->getClassName(), 'Exception should be raised on the "Twig\Tests\Extension\FooObject" class'); $this->assertEquals('__tostring', $e->getMethodName(), 'Exception should be raised on the "__toString" method'); } } public static function getSandboxUnallowedToStringTests() { return [ 'simple' => ['{{ obj }}'], 'object_from_array' => ['{{ arr.obj }}'], 'object_chain' => ['{{ obj.anotherFooObject }}'], 'filter' => ['{{ obj|upper }}'], 'filter_from_array' => ['{{ arr.obj|upper }}'], 'function' => ['{{ random(obj) }}'], 'function_from_array' => ['{{ random(arr.obj) }}'], 'function_and_filter' => ['{{ random(obj|upper) }}'], 'function_and_filter_from_array' => ['{{ random(arr.obj|upper) }}'], 'object_chain_and_filter' => ['{{ obj.anotherFooObject|upper }}'], 'object_chain_and_function' => ['{{ random(obj.anotherFooObject) }}'], 'concat' => ['{{ obj ~ "" }}'], 'concat_again' => ['{{ "" ~ obj }}'], ]; } /** * @dataProvider getSandboxAllowedToStringTests */ public function testSandboxAllowedToString($template, $output) { $twig = $this->getEnvironment(true, [], ['index' => $template], ['set'], [], ['Twig\Tests\Extension\FooObject' => ['foo', 'getAnotherFooObject']]); $this->assertEquals($output, $twig->load('index')->render(self::$params)); } public static function getSandboxAllowedToStringTests() { return [ 'constant_test' => ['{{ obj is constant("PHP_INT_MAX") }}', ''], 'set_object' => ['{% set a = obj.anotherFooObject %}{{ a.foo }}', 'foo'], 'is_defined' => ['{{ obj.anotherFooObject is defined }}', '1'], 'is_null' => ['{{ obj is null }}', ''], 'is_sameas' => ['{{ obj is same as(obj) }}', '1'], 'is_sameas_no_brackets' => ['{{ obj is same as obj }}', '1'], 'is_sameas_from_array' => ['{{ arr.obj is same as(arr.obj) }}', '1'], 'is_sameas_from_array_no_brackets' => ['{{ arr.obj is same as arr.obj }}', '1'], 'is_sameas_from_another_method' => ['{{ obj.anotherFooObject is same as(obj.anotherFooObject) }}', ''], 'is_sameas_from_another_method_no_brackets' => ['{{ obj.anotherFooObject is same as obj.anotherFooObject }}', ''], ]; } public function testSandboxAllowMethodToString() { $twig = $this->getEnvironment(true, [], self::$templates, [], [], ['Twig\Tests\Extension\FooObject' => '__toString']); FooObject::reset(); $this->assertEquals('foo', $twig->load('1_basic5')->render(self::$params), 'Sandbox allow some methods'); $this->assertEquals(1, FooObject::$called['__toString'], 'Sandbox only calls method once'); } public function testSandboxAllowMethodToStringDisabled() { $twig = $this->getEnvironment(false, [], self::$templates); FooObject::reset(); $this->assertEquals('foo', $twig->load('1_basic5')->render(self::$params), 'Sandbox allows __toString when sandbox disabled'); $this->assertEquals(1, FooObject::$called['__toString'], 'Sandbox only calls method once'); } public function testSandboxUnallowedFunction() { $twig = $this->getEnvironment(true, [], self::$templates); try { $twig->load('1_basic7')->render(self::$params); $this->fail('Sandbox throws a SecurityError exception if an unallowed function is called in the template'); } catch (SecurityNotAllowedFunctionError $e) { $this->assertEquals('cycle', $e->getFunctionName(), 'Exception should be raised on the "cycle" function'); } } public function testSandboxUnallowedRangeOperator() { $twig = $this->getEnvironment(true, [], self::$templates); try { $twig->load('1_range_operator')->render(self::$params); $this->fail('Sandbox throws a SecurityError exception if the unallowed range operator is called'); } catch (SecurityNotAllowedFunctionError $e) { $this->assertEquals('range', $e->getFunctionName(), 'Exception should be raised on the "range" function'); } } public function testSandboxAllowMethodFoo() { $twig = $this->getEnvironment(true, [], self::$templates, [], [], ['Twig\Tests\Extension\FooObject' => 'foo']); FooObject::reset(); $this->assertEquals('foo', $twig->load('1_basic1')->render(self::$params), 'Sandbox allow some methods'); $this->assertEquals(1, FooObject::$called['foo'], 'Sandbox only calls method once'); } public function testSandboxAllowFilter() { $twig = $this->getEnvironment(true, [], self::$templates, [], ['upper']); $this->assertEquals('FABIEN', $twig->load('1_basic2')->render(self::$params), 'Sandbox allow some filters'); } public function testSandboxAllowTag() { $twig = $this->getEnvironment(true, [], self::$templates, ['if']); $this->assertEquals('foo', $twig->load('1_basic3')->render(self::$params), 'Sandbox allow some tags'); } public function testSandboxAllowProperty() { $twig = $this->getEnvironment(true, [], self::$templates, [], [], [], ['Twig\Tests\Extension\FooObject' => 'bar']); $this->assertEquals('bar', $twig->load('1_basic4')->render(self::$params), 'Sandbox allow some properties'); } public function testSandboxAllowFunction() { $twig = $this->getEnvironment(true, [], self::$templates, [], [], [], [], ['cycle']); $this->assertEquals('bar', $twig->load('1_basic7')->render(self::$params), 'Sandbox allow some functions'); } public function testSandboxAllowRangeOperator() { $twig = $this->getEnvironment(true, [], self::$templates, [], [], [], [], ['range']); $this->assertEquals('1', $twig->load('1_range_operator')->render(self::$params), 'Sandbox allow the range operator'); } public function testSandboxAllowMethodsCaseInsensitive() { foreach (['getfoobar', 'getFoobar', 'getFooBar'] as $name) { $twig = $this->getEnvironment(true, [], self::$templates, [], [], ['Twig\Tests\Extension\FooObject' => $name]); FooObject::reset(); $this->assertEquals('foobarfoobar', $twig->load('1_basic8')->render(self::$params), 'Sandbox allow methods in a case-insensitive way'); $this->assertEquals(2, FooObject::$called['getFooBar'], 'Sandbox only calls method once'); $this->assertEquals('foobarfoobar', $twig->load('1_basic9')->render(self::$params), 'Sandbox allow methods via shortcut names (ie. without get/set)'); } } public function testSandboxLocallySetForAnInclude() { self::$templates = [ '2_basic' => '{{ obj.foo }}{% include "2_included" %}{{ obj.foo }}', '2_included' => '{% if obj.foo %}{{ obj.foo|upper }}{% endif %}', ]; $twig = $this->getEnvironment(false, [], self::$templates); $this->assertEquals('fooFOOfoo', $twig->load('2_basic')->render(self::$params), 'Sandbox does nothing if disabled globally and sandboxed not used for the include'); self::$templates = [ '3_basic' => '{{ include("3_included", sandboxed: true) }}', '3_included' => '{% if true %}{{ "foo"|upper }}{% endif %}', ]; $twig = $this->getEnvironment(true, [], self::$templates, functions: ['include']); try { $twig->load('3_basic')->render(self::$params); $this->fail('Sandbox throws a SecurityError exception when the included file is sandboxed'); } catch (SecurityNotAllowedTagError $e) { $this->assertEquals('if', $e->getTagName()); } } public function testMacrosInASandbox() { $twig = $this->getEnvironment(true, ['autoescape' => 'html'], ['index' => <<{{ text }}

{% endmacro %} {{- macros.test('username') }} EOF ], ['macro', 'import'], ['escape']); $this->assertEquals('

username

', $twig->load('index')->render([])); } public function testSandboxDisabledAfterIncludeFunctionError() { $twig = $this->getEnvironment(false, [], self::$templates); $e = null; try { $twig->load('1_include')->render(self::$params); } catch (\Throwable $e) { } if (null === $e) { $this->fail('An exception should be thrown for this test to be valid.'); } $this->assertFalse($twig->getExtension(SandboxExtension::class)->isSandboxed(), 'Sandboxed include() function call should not leave Sandbox enabled when an error occurs.'); } public function testSandboxWithNoClosureFilter() { $twig = $this->getEnvironment(true, ['autoescape' => 'html'], ['index' => <<expectException(RuntimeError::class); $this->expectExceptionMessage('The callable passed to the "filter" filter must be a Closure in sandbox mode in "index" at line 1.'); $twig->load('index')->render([]); } public function testSandboxWithClosureFilter() { $twig = $this->getEnvironment(true, ['autoescape' => 'html'], ['index' => << v != "")|join(", ") }} EOF ], [], ['escape', 'filter', 'join']); $this->assertSame('foo, bar', $twig->load('index')->render([])); } public function testMultipleClassMatchesViaInheritanceInAllowedMethods() { $twig_child_first = $this->getEnvironment(true, [], self::$templates, [], [], [ 'Twig\Tests\Extension\ChildClass' => ['ChildMethod'], 'Twig\Tests\Extension\ParentClass' => ['ParentMethod'], ]); $twig_parent_first = $this->getEnvironment(true, [], self::$templates, [], [], [ 'Twig\Tests\Extension\ParentClass' => ['ParentMethod'], 'Twig\Tests\Extension\ChildClass' => ['ChildMethod'], ]); try { $twig_child_first->load('1_childobj_childmethod')->render(self::$params); } catch (SecurityError $e) { $this->fail('This test case is malfunctioning as even the child class method which comes first is not being allowed.'); } try { $twig_parent_first->load('1_childobj_parentmethod')->render(self::$params); } catch (SecurityError $e) { $this->fail('This test case is malfunctioning as even the parent class method which comes first is not being allowed.'); } try { $twig_parent_first->load('1_childobj_childmethod')->render(self::$params); } catch (SecurityError $e) { $this->fail('checkMethodAllowed is exiting prematurely after matching a parent class and not seeing a method allowed on a child class later in the list'); } try { $twig_child_first->load('1_childobj_parentmethod')->render(self::$params); } catch (SecurityError $e) { $this->fail('checkMethodAllowed is exiting prematurely after matching a child class and not seeing a method allowed on its parent class later in the list'); } $this->expectNotToPerformAssertions(); } protected function getEnvironment($sandboxed, $options, $templates, $tags = [], $filters = [], $methods = [], $properties = [], $functions = [], $sourcePolicy = null) { $loader = new ArrayLoader($templates); $twig = new Environment($loader, array_merge(['debug' => true, 'cache' => false, 'autoescape' => false], $options)); $policy = new SecurityPolicy($tags, $filters, $methods, $properties, $functions); $twig->addExtension(new SandboxExtension($policy, $sandboxed, $sourcePolicy)); return $twig; } public function testSandboxSourcePolicyEnableReturningFalse() { $twig = $this->getEnvironment(false, [], self::$templates, [], [], [], [], [], new class() implements \Twig\Sandbox\SourcePolicyInterface { public function enableSandbox(Source $source): bool { return '1_basic' != $source->getName(); } }); $this->assertEquals('FOO', $twig->load('1_basic')->render(self::$params)); } public function testSandboxSourcePolicyEnableReturningTrue() { $twig = $this->getEnvironment(false, [], self::$templates, [], [], [], [], [], new class() implements \Twig\Sandbox\SourcePolicyInterface { public function enableSandbox(Source $source): bool { return '1_basic' === $source->getName(); } }); $this->expectException(SecurityError::class); $twig->load('1_basic')->render([]); } public function testSandboxSourcePolicyFalseDoesntOverrideOtherEnables() { $twig = $this->getEnvironment(true, [], self::$templates, [], [], [], [], [], new class() implements \Twig\Sandbox\SourcePolicyInterface { public function enableSandbox(Source $source): bool { return false; } }); $this->expectException(SecurityError::class); $twig->load('1_basic')->render([]); } } class ParentClass { public function ParentMethod() { } } class ChildClass extends ParentClass { public function ChildMethod() { } } class FooObject { public static $called = ['__toString' => 0, 'foo' => 0, 'getFooBar' => 0]; public $bar = 'bar'; public static function reset() { self::$called = ['__toString' => 0, 'foo' => 0, 'getFooBar' => 0]; } public function __toString() { ++self::$called['__toString']; return 'foo'; } public function foo() { ++self::$called['foo']; return 'foo'; } public function getFooBar() { ++self::$called['getFooBar']; return 'foobar'; } public function getAnotherFooObject() { return new self(); } }