mirror of
https://github.com/twigphp/Twig.git
synced 2026-08-17 12:11:33 +00:00
Fabien Potencier
679447fa29
This is a defense-in-depth measure: callers must always concatenate the
result into a double-quoted PHP context, but if one ever (mistakenly)
embeds it inside a single-quoted PHP literal, an attacker-controlled
single quote in the source value could break out of that context. The
previous commit fixed exactly such a bug in ModuleNode for the {% use %}
template name.
Encoding ' as the hex escape \x27 guarantees that the emitted PHP source
never contains a literal single quote derived from user input, while the
decoded runtime value is unchanged. \' is not used because it is not a
recognized escape sequence in PHP double-quoted strings (the backslash
would be kept literally).
68 lines
2.1 KiB
PHP
68 lines
2.1 KiB
PHP
<?php
|
|
|
|
/*
|
|
* This file is part of Twig.
|
|
*
|
|
* (c) Fabien Potencier
|
|
*
|
|
* For the full copyright and license information, please view the LICENSE
|
|
* file that was distributed with this source code.
|
|
*/
|
|
|
|
namespace Twig\Tests;
|
|
|
|
/*
|
|
* This file is part of Twig.
|
|
*
|
|
* (c) Fabien Potencier
|
|
*
|
|
* For the full copyright and license information, please view the LICENSE
|
|
* file that was distributed with this source code.
|
|
*/
|
|
|
|
use PHPUnit\Framework\TestCase;
|
|
use Twig\Compiler;
|
|
use Twig\Environment;
|
|
use Twig\Loader\ArrayLoader;
|
|
|
|
class CompilerTest extends TestCase
|
|
{
|
|
public function testStringEncodesSingleQuotesAsHexEscape()
|
|
{
|
|
$compiler = new Compiler(new Environment(new ArrayLoader()));
|
|
|
|
// Defense in depth: a single quote in the source value must NOT appear as a
|
|
// literal "'" in the compiled output, so that even if a caller mistakenly
|
|
// concatenates the result into a single-quoted PHP string, the value cannot
|
|
// break out of that context. It must still decode back to the original byte.
|
|
$source = $compiler->string("it's \"a\" test")->getSource();
|
|
|
|
$this->assertStringNotContainsString("'", $source);
|
|
$this->assertSame('"it\\x27s \\"a\\" test"', $source);
|
|
|
|
$decoded = null;
|
|
eval('$decoded = '.$source.';');
|
|
$this->assertSame("it's \"a\" test", $decoded);
|
|
}
|
|
|
|
public function testReprNumericValueWithLocale()
|
|
{
|
|
$compiler = new Compiler(new Environment(new ArrayLoader()));
|
|
|
|
$locale = setlocale(\LC_NUMERIC, '0');
|
|
if (false === $locale) {
|
|
$this->markTestSkipped('Your platform does not support locales.');
|
|
}
|
|
|
|
$required_locales = ['fr_FR.UTF-8', 'fr_FR.UTF8', 'fr_FR.utf-8', 'fr_FR.utf8', 'French_France.1252'];
|
|
if (false === setlocale(\LC_NUMERIC, $required_locales)) {
|
|
$this->markTestSkipped('Could not set any of required locales: '.implode(', ', $required_locales));
|
|
}
|
|
|
|
$this->assertEquals('1.2', $compiler->repr(1.2)->getSource());
|
|
$this->assertStringContainsString('fr', strtolower(setlocale(\LC_NUMERIC, '0')));
|
|
|
|
setlocale(\LC_NUMERIC, $locale);
|
|
}
|
|
}
|