Fabien Potencier 2e4b6d286e security #cve-2026-47732 [Sandbox] Fix __toString() support (fabpot) ...

This PR was merged into the twig-3.x branch.

2026-05-20 07:31:34 +02:00

..

Cache

…

Extension

Fix sandbox __toString bypasses

2026-05-20 00:18:59 +02:00

Fixtures

Add html_attr_relaxed escaping strategy

2026-02-08 18:59:07 +01:00

Loader

…

Node

Validate macro name in MacroReferenceExpression constructor

2026-05-19 23:42:31 +02:00

NodeVisitor

Fix sandbox __toString bypasses

2026-05-20 00:18:59 +02:00

Profiler

[Profiler] Escape template and profile names in HtmlDumper

2026-05-19 18:54:32 +02:00

Resources

Fix sandbox bypass: propagate sandbox state to checkArrow for source-policy sandboxing

2026-05-16 18:56:08 +01:00

Runtime

Add html_attr_relaxed escaping strategy

2026-02-08 18:59:07 +01:00

TokenParser

Fix CS

2026-02-07 09:07:38 +01:00

Util

…

CompilerTest.php

Encode single quotes as \x27 in Compiler::string()

2026-05-19 22:58:27 +02:00

ContainerRuntimeLoaderTest.php

…

CustomExtensionTest.php

…

DeprecatedCallableInfoTest.php

Fix CS

2026-02-07 09:07:38 +01:00

drupal_test.sh

…

DummyBackedEnum.php

…

DummyUnitEnum.php

…

EnvironmentTest.php

Fix CS

2026-02-07 09:07:38 +01:00

ErrorTest.php

…

ExpressionParserTest.php

Add getOperatorTokens() to ExpressionParserInterface to separate operator token registration from parser identity

2026-02-24 21:13:06 +01:00

FactoryRuntimeLoaderTest.php

…

FileExtensionEscapingStrategyTest.php

…

FilesystemHelper.php

…

IntegrationTest.php

Fix CS

2026-02-07 09:07:38 +01:00

LexerTest.php

Add getOperatorTokens() to ExpressionParserInterface to separate operator token registration from parser identity

2026-02-24 21:13:06 +01:00

ParserTest.php

Make embeds deterministic

2026-05-16 09:48:23 +01:00

TemplateTest.php

Fix null coalescing operator with imported macros

2026-02-25 08:38:54 +01:00

TemplateWrapperTest.php

…

TokenStreamTest.php

…