fix(deps): update dependency twig/twig to v3.11.1 [security] - autoclosed #499
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
3.10.3
->3.11.1
GitHub Vulnerability Alerts
CVE-2024-45411
Description
Under some circumstances, the sandbox security checks are not run which allows user-contributed templates to bypass the sandbox restrictions.
The security issue happens when all these conditions are met:
include()
function which references a template name (likeincluded.twig
) and not aTemplate
orTemplateWrapper
instance;include()
call but in a non-sandbox context (possible as the sandbox has been globally disabled).Resolution
The patch ensures that the sandbox security checks are always run at runtime.
Credits
We would like to thank Fabien Potencier for reporting and fixing the issue.
Release Notes
twigphp/Twig (twig/twig)
v3.11.1
Compare Source
v3.11.0
Compare Source
Twig\Cache\ChainCache
andTwig\Cache\ReadOnlyFilesystemCache
Node
deprecated
tagConstantExpression
as being@final
find
filterOptimizerNodeVisitor
PrintNode
shuffle
filtersingular
andplural
filters inStringExtension
Twig\Node\Expression\CallExpression::compileArguments()
Twig\ExpressionParser\parseHashExpression()
in favor ofTwig\ExpressionParser::parseMappingExpression()
Twig\ExpressionParser\parseArrayExpression()
in favor ofTwig\ExpressionParser::parseSequenceExpression()
sequence
andmapping
testsTwig\Node\Expression\NameExpression::isSimple()
andTwig\Node\Expression\NameExpression::isSpecial()
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.