Fabien Potencier 09c6706407 Fix sandbox bypass in the "column" filter under SourcePolicyInterface

2026-05-27 14:49:52 +02:00

..

Attribute

Add a needs_is_sandboxed option for filters, functions, and tests

2026-05-16 18:52:17 +01:00

Cache

…

Error

Avoid errors when failing to guess the template info for an error

2025-09-02 14:21:58 +02:00

ExpressionParser

Deprecate the fact that the parent, block, and attribute functions are always allowed in a sandboxed template

2026-05-24 21:19:56 +02:00

Extension

Fix sandbox bypass in the "column" filter under SourcePolicyInterface

2026-05-27 14:49:52 +02:00

Loader

Fix CS

2025-02-14 12:57:03 +01:00

Node

Simplify code

2026-05-24 09:57:49 +02:00

NodeVisitor

Deprecate the fact that the parent, block, and attribute functions are always allowed in a sandboxed template

2026-05-24 21:19:56 +02:00

Profiler

Escape root profile name in HtmlDumper

2026-05-23 09:39:26 +02:00

Resources

Fix sandbox bypass in the "column" filter

2026-05-20 07:33:52 +02:00

Runtime

Add html_attr_relaxed escaping strategy

2026-02-08 18:59:07 +01:00

RuntimeLoader

…

Sandbox

Add a strict mode to SecurityPolicy to opt-in to the 4.0 sandbox behavior for the extends/use tags and the parent/block/attribute functions

2026-05-25 13:40:27 +02:00

Test

Fix CS

2026-02-07 09:07:38 +01:00

TokenParser

Fix sandbox bypass in the {% sandbox %} tag when including a preloaded template

2026-05-19 23:00:58 +02:00

Util

Add a needs_is_sandboxed option for filters, functions, and tests

2026-05-16 18:52:17 +01:00

AbstractTwigCallable.php

Add a needs_is_sandboxed option for filters, functions, and tests

2026-05-16 18:52:17 +01:00

Compiler.php

Encode single quotes as \x27 in Compiler::string()

2026-05-19 22:58:27 +02:00

DeprecatedCallableInfo.php

…

Environment.php

Bump version

2026-05-23 08:32:22 +02:00

ExpressionParser.php

Fix compatibility layer

2025-08-17 19:23:48 +02:00

ExtensionSet.php

Fix opcache preload warning for unlinked anonymous class

2026-01-05 19:11:58 +01:00

FileExtensionEscapingStrategy.php

Make in_array() calls strict

2025-02-19 15:29:33 +01:00

Lexer.php

Add getOperatorTokens() to ExpressionParserInterface to separate operator token registration from parser identity

2026-02-24 21:13:06 +01:00

Markup.php

Add docs on Markup about the goal of this class in the context of a sandbox

2026-05-20 08:14:13 +02:00

NodeTraverser.php

…

OperatorPrecedenceChange.php

Fix version

2025-02-14 08:47:54 +01:00

Parser.php

Make embeds deterministic

2026-05-16 09:48:23 +01:00

Source.php

…

Template.php

Fix CS

2026-02-07 09:07:38 +01:00

TemplateWrapper.php

Add return type annotations on Twig 3 to prepare Twig 4

2025-01-24 11:32:59 +01:00

Token.php

Make in_array() calls strict

2025-02-19 15:29:33 +01:00

TokenStream.php

Deprecate Token::getType()

2025-01-24 15:48:04 +01:00

TwigCallableInterface.php

Add a needs_is_sandboxed option for filters, functions, and tests

2026-05-16 18:52:17 +01:00

TwigFilter.php

…

TwigFunction.php

…

TwigTest.php

…