Enforce the sandbox Markup exception for every security policy#4839
Merged
Conversation
fabpot
force-pushed
the
hardcoded-checks-removal
branch
2 times, most recently
from
ba1ae6e to
bfaddc9
Compare
fabpot
force-pushed
the
hardcoded-checks-removal
branch
from
bfaddc9 to
b1cac7c
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This is (maybe) my last change in 4.x to remove things that were hardcoded in 3.x.
It moves the sandbox exception for
Twig\Markupout of the defaultSecurityPolicyand into the runtime string-coercion check: now, only__toString()is allowed by default and custom security policies inherit that automatically.The branch also removes the hardcoded
Templatebypass fromSecurityPolicy::checkMethodAllowed(): template attribute access is already rejected earlier byCoreExtension::getAttribute(), so the policy-level exception was dead code (IIRC, it was needed in the old days for calling macros, but not anymore).