mirror of
https://github.com/twigphp/Twig.git
synced 2026-09-01 21:17:21 +00:00
Fabien Potencier
02262dee80
This PR was squashed before being merged into the 2.x branch.
Discussion
----------
Fix premature loop exit in Security Policy lookup of allowed methods/properties
The current security policy logic exits too soon when checking permissions for allowed classes and their methods/properties, causing false negatives in situations involving classes related by inheritance.
Consider the following configuration:
```
'methods' => [
'App\BasicCollection' => ['sortAlphabetically'],
'App\AdvancedCollection'=> ['sortByTimestamp'],
],
```
where `AdvancedCollection` is a subclass of `BasicCollection`, and `mylist` is an instance of `AdvancedCollection`
If you try to call `{{ mylist.sortByTimestamp() }}`, the current code will first match `mylist` against `App\BasicCollection`. Since `sortByTimestamp` is not an allowed method for `App\BasicCollection`, the code will exit the loop and incorrectly deny access. It will never get to checking `App\AdvancedCollection`.
Note that reordering classes in the config can't solve this issue. If you flipped the order, then it would fail for `{{ mylist.sortAlphabetically() }}` instead.
This pull request fixes the issue by only exiting the loop early when both the class and method/property match.
Commits
-------
5e1838db Fix premature loop exit in Security Policy lookup of allowed methods/properties
Twig, the flexible, fast, and secure template language for PHP
==============================================================
Twig is a template language for PHP.
Twig uses a syntax similar to the Django and Jinja template languages which
inspired the Twig runtime environment.
**Twig version 2 end of maintainance is scheduled for end of December 2023.**
Please, upgrade at your earliest convenience.
Sponsors
--------
.. raw:: html
<a href="https://blackfire.io/docs/introduction?utm_source=twig&utm_medium=github_readme&utm_campaign=logo">
<img src="https://static.blackfire.io/assets/intemporals/logo/png/blackfire-io_secondary_horizontal_transparent.png?1" width="255px" alt="Blackfire.io">
</a>
More Information
----------------
Read the `documentation`_ for more information.
.. _documentation: https://twig.symfony.com/documentation