Fabien Potencier ea3f7a2844 Validate macro name in MacroReferenceExpression constructor ...

The name passed to MacroReferenceExpression is emitted as raw PHP in
compile() via "->{$name}(...)". Callers were expected to validate
the name, but a missing check led to CVE-2026-XXXXX (PHP code injection
via _self / import macro reference): defense-in-depth, validate the
name in the constructor so the class is safe by construction.

2026-05-19 23:42:31 +02:00

..

Expression

Validate macro name in MacroReferenceExpression constructor

2026-05-19 23:42:31 +02:00

AutoEscapeTest.php

…

BlockReferenceTest.php

…

BlockTest.php

Fix CS

2026-02-07 09:07:38 +01:00

DeprecatedTest.php

Fix CS

2026-02-07 09:07:38 +01:00

DoTest.php

…

EmbedTest.php

…

ForTest.php

…

IfTest.php

…

ImportTest.php

…

IncludeTest.php

Fix CS

2026-02-07 09:07:38 +01:00

MacroTest.php

Fix CS

2026-02-07 09:07:38 +01:00

ModuleTest.php

Fix sandbox bypass: PHP code injection via {% use %} template name

2026-05-19 22:50:45 +02:00

NodeTest.php

Fix CS

2026-02-07 09:07:38 +01:00

PrintTest.php

…

SandboxTest.php

…

SetTest.php

Fix CS

2026-02-07 09:07:38 +01:00

TextTest.php

…

TypesTest.php

…