mirror of
https://github.com/twigphp/Twig.git
synced 2026-10-25 13:16:31 +00:00
Fabien Potencier
8dd0383353
* 3.x: (23 commits)
Bump version
Prepare the 3.26.0 release
Update CHANGELOG
Document that the sandbox doesn't protect against resource exhaustion
Document template_from_string caveats when used in a sandboxed env
Pre-escape HTML input on the `spaceless` filter
Add docs on Markup about the goal of this class in the context of a sandbox
Fix sandbox bypass in the "column" filter
Fix sandbox `__toString` bypasses
Validate macro name in MacroReferenceExpression constructor
Fix sandbox bypass: PHP code injection via _self / import macro reference
Fix deprecations in tests
Fix sandbox bypass in the `{% sandbox %}` tag when including a preloaded template
Encode single quotes as \x27 in Compiler::string()
Fix sandbox bypass: PHP code injection via {% use %} template name
Fix unbounded memoisation of `IntlDateFormatter` / `NumberFormatter`
Fix deprecation
[Profiler] Escape template and profile names in HtmlDumper
Bump version
Fix sandbox bypass: propagate sandbox state to checkArrow for source-policy sandboxing
...
# Conflicts:
# CHANGELOG
# doc/filters/spaceless.rst
# extra/cssinliner-extra/CssInlinerExtension.php
# extra/inky-extra/InkyExtension.php
# extra/markdown-extra/MarkdownExtension.php
# src/Environment.php
# src/ExpressionParser/Infix/DotExpressionParser.php
# src/Extension/CoreExtension.php
# src/Node/Expression/FilterExpression.php
# src/Node/Expression/FunctionExpression.php
# src/Node/Expression/TestExpression.php
# src/Node/ModuleNode.php
# src/NodeVisitor/SandboxNodeVisitor.php
# src/Resources/core.php
# src/TokenParser/SandboxTokenParser.php
# tests/Extension/SandboxTest.php
101 lines
2.9 KiB
PHP
101 lines
2.9 KiB
PHP
<?php
|
|
|
|
/*
|
|
* This file is part of Twig.
|
|
*
|
|
* (c) Fabien Potencier
|
|
*
|
|
* For the full copyright and license information, please view the LICENSE
|
|
* file that was distributed with this source code.
|
|
*/
|
|
|
|
namespace Twig\Extra\Markdown\Tests;
|
|
|
|
use PHPUnit\Framework\Attributes\DataProvider;
|
|
use PHPUnit\Framework\TestCase;
|
|
use Twig\Environment;
|
|
use Twig\Extra\Markdown\DefaultMarkdown;
|
|
use Twig\Extra\Markdown\ErusevMarkdown;
|
|
use Twig\Extra\Markdown\LeagueMarkdown;
|
|
use Twig\Extra\Markdown\MarkdownExtension;
|
|
use Twig\Extra\Markdown\MarkdownRuntime;
|
|
use Twig\Extra\Markdown\MichelfMarkdown;
|
|
use Twig\Loader\ArrayLoader;
|
|
use Twig\RuntimeLoader\RuntimeLoaderInterface;
|
|
|
|
class FunctionalTest extends TestCase
|
|
{
|
|
#[DataProvider('getMarkdownTests')]
|
|
public function testMarkdown(string $template, string $expected)
|
|
{
|
|
foreach ([LeagueMarkdown::class, ErusevMarkdown::class, /* MichelfMarkdown::class, */ DefaultMarkdown::class] as $class) {
|
|
$twig = new Environment(new ArrayLoader([
|
|
'index' => $template,
|
|
'html' => <<<EOF
|
|
Hello
|
|
=====
|
|
|
|
Great!
|
|
EOF,
|
|
]));
|
|
$twig->addExtension(new MarkdownExtension());
|
|
$twig->addRuntimeLoader(new class($class) implements RuntimeLoaderInterface {
|
|
private $class;
|
|
|
|
public function __construct(string $class)
|
|
{
|
|
$this->class = $class;
|
|
}
|
|
|
|
public function load(string $c): ?object
|
|
{
|
|
return MarkdownRuntime::class === $c ? new $c(new $this->class()) : null;
|
|
}
|
|
});
|
|
$this->assertMatchesRegularExpression('{'.$expected.'}m', trim($twig->render('index')));
|
|
}
|
|
}
|
|
|
|
public static function getMarkdownTests()
|
|
{
|
|
return [
|
|
[<<<EOF
|
|
{% apply markdown_to_html %}
|
|
Hello
|
|
=====
|
|
|
|
Great!
|
|
{% endapply %}
|
|
EOF, "<h1>Hello</h1>\n+<p>Great!</p>"],
|
|
[<<<EOF
|
|
{% apply markdown_to_html %}
|
|
Hello
|
|
=====
|
|
|
|
Great!
|
|
{% endapply %}
|
|
EOF, "<h1>Hello</h1>\n+<p>Great!</p>"],
|
|
["{{ include('html')|markdown_to_html }}", "<h1>Hello</h1>\n+<p>Great!</p>"],
|
|
];
|
|
}
|
|
|
|
public function testMarkdownToHtmlIsNotSafeInJsContext()
|
|
{
|
|
$twig = new Environment(new ArrayLoader([
|
|
'index' => "{% autoescape 'js' %}{{ '# Hello'|markdown_to_html }}{% endautoescape %}",
|
|
]));
|
|
$twig->addExtension(new MarkdownExtension());
|
|
$twig->addRuntimeLoader(new class implements RuntimeLoaderInterface {
|
|
public function load(string $c): ?object
|
|
{
|
|
return MarkdownRuntime::class === $c ? new $c(new DefaultMarkdown()) : null;
|
|
}
|
|
});
|
|
|
|
$output = $twig->render('index');
|
|
|
|
$this->assertStringNotContainsString('<h1>', $output);
|
|
$this->assertMatchesRegularExpression('{\\\\u003[Cc]h1\\\\u003[Ee]Hello\\\\u003[Cc]\\\\/h1\\\\u003[Ee]}', $output);
|
|
}
|
|
}
|