Fabien Potencier 7923de168b security #cve-2026-46628 Pre-escape HTML input on the spaceless filter (fabpot) ...

This PR was merged into the twig-3.x branch.

2026-05-20 08:53:45 +02:00

..

Attribute

Add a needs_is_sandboxed option for filters, functions, and tests

2026-05-16 18:52:17 +01:00

Cache

…

Error

…

ExpressionParser

Fix sandbox bypass: PHP code injection via _self / import macro reference

2026-05-19 23:41:59 +02:00

Extension

security #cve-2026-46628 Pre-escape HTML input on the spaceless filter (fabpot)

2026-05-20 08:53:45 +02:00

Loader

…

Node

Fix sandbox __toString bypasses

2026-05-20 00:18:59 +02:00

NodeVisitor

Fix sandbox __toString bypasses

2026-05-20 00:18:59 +02:00

Profiler

[Profiler] Escape template and profile names in HtmlDumper

2026-05-19 18:54:32 +02:00

Resources

Fix sandbox bypass in the "column" filter

2026-05-20 07:33:52 +02:00

Runtime

…

RuntimeLoader

…

Sandbox

…

Test

…

TokenParser

Fix sandbox bypass in the {% sandbox %} tag when including a preloaded template

2026-05-19 23:00:58 +02:00

Util

Add a needs_is_sandboxed option for filters, functions, and tests

2026-05-16 18:52:17 +01:00

AbstractTwigCallable.php

Add a needs_is_sandboxed option for filters, functions, and tests

2026-05-16 18:52:17 +01:00

Compiler.php

Encode single quotes as \x27 in Compiler::string()

2026-05-19 22:58:27 +02:00

DeprecatedCallableInfo.php

…

Environment.php

Bump version

2026-05-19 17:02:22 +02:00

ExpressionParser.php

…

ExtensionSet.php

…

FileExtensionEscapingStrategy.php

…

Lexer.php

…

Markup.php

Add docs on Markup about the goal of this class in the context of a sandbox

2026-05-20 08:14:13 +02:00

NodeTraverser.php

…

OperatorPrecedenceChange.php

…

Parser.php

Make embeds deterministic

2026-05-16 09:48:23 +01:00

Source.php

…

Template.php

…

TemplateWrapper.php

…

Token.php

…

TokenStream.php

…

TwigCallableInterface.php

Add a needs_is_sandboxed option for filters, functions, and tests

2026-05-16 18:52:17 +01:00

TwigFilter.php

…

TwigFunction.php

…

TwigTest.php

…