mirror of
https://github.com/twigphp/Twig.git
synced 2026-10-09 21:35:40 +00:00
Fabien Potencier
19099de78e
* 3.x: Skip the sandbox `__toString` check on arguments whose PHP parameter type cannot implicitly coerce to string Fix CS Bump version Prepare the 3.27.1 release Fix inconsistent array access with a Stringable key Preserve IteratorAggregate identity in sandbox __toString walker Fix tests Bump version Prepare the 3.27.0 release Fix sandbox filter/tag/function allow-list bypass when sandbox state changes between renders Document new support for any expression as a dynamic mapping key Fix sandbox __toString policy bypass via dynamic mapping keys Fix deprecation notices in tests Guard sandbox `__toString` walker against self-referencing iterables Fix sandbox `__toString` bypass via `Stringable` + `Traversable` containers Fix sandbox `__toString` bypass via the `in` and `not in` operators Fix sandbox __toString bypass via Traversable in join/replace filters Mark new SourcePolicyInterface column filter tests as @group legacy Fix sandbox bypass in the "column" filter under SourcePolicyInterface Fix sandbox bypass in deprecated internal wrappers # Conflicts: # CHANGELOG # src/Environment.php # src/Node/Expression/ArrayExpression.php # src/Node/Expression/CallExpression.php # src/Resources/core.php # src/Template.php # src/Util/CallableArgumentsExtractor.php # src/Util/ReflectionCallable.php # tests/Extension/SandboxTest.php # tests/Resources/LegacyCoreTest.php # tests/TemplateTest.php