mirror of
https://github.com/twigphp/Twig.git
synced 2026-08-26 19:46:40 +00:00
Fabien Potencier
ea3f7a2844
The name passed to MacroReferenceExpression is emitted as raw PHP in
compile() via "->{$name}(...)". Callers were expected to validate
the name, but a missing check led to CVE-2026-XXXXX (PHP code injection
via _self / import macro reference): defense-in-depth, validate the
name in the constructor so the class is safe by construction.