[Followup] Implement the Twig Sandbox Policy as a service collection

Created on 18 October 2015, about 10 years ago
Updated 21 April 2025, 7 months ago

πŸ› Twig templates can call delete() on entities and other objects Fixed added the ability to whitelist what object methods were allowed to be called from a Twig template. These whitelists can be customized in a site's settings.php file by adding the appropriate $settings[' ... '] variable. This requires modules that need access to new method names to include extra documentation explaining how this is done and could lead to less secure code if site builders accidentally replace the default values instead of adding to them. See the original change record β†’ for more details.

Allowing modules and theme's to implement a service to handle white- or blacklisting a given method call would solve this. Similar to the node access ssytem, a service could respond ALLOW/DENY/NEUTRAL, allowing core to maintain it's current list while a module could add additional method names or have even greater restrictions in situations where Twig templates may come from untrusted sources (eg: user generated).

πŸ“Œ Task
Status

RTBC

Version

11.0 πŸ”₯

Component

theme system

Created by

πŸ‡ΊπŸ‡ΈUnited States mikeker

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

  • πŸ‡³πŸ‡ΏNew Zealand quietone

    There has only been two comments here in 10 years. Is there anything to do here?

    I am setting the status to Postponed (maintainer needs more info). If we don't receive additional information to help with the issue, it may be closed after three months.

    Thanks!

  • πŸ‡³πŸ‡ΏNew Zealand quietone
  • Merge request !13469Implement TwigAllowed method attribute β†’ (Open) created by geek-merlin
  • Pipeline finished with Success
    30 days ago
    Total: 705s
    #625800
  • Pipeline finished with Failed
    30 days ago
    Total: 174s
    #625809
  • Pipeline finished with Success
    30 days ago
    Total: 2083s
    #625814
  • Status changed to Needs review 29 days ago
  • Pipeline finished with Failed
    1 day ago
    Total: 684s
    #654240
  • Pipeline finished with Failed
    1 day ago
    Total: 170s
    #654246
  • Pipeline finished with Failed
    about 24 hours ago
    Total: 273s
    #654903
  • Pipeline finished with Success
    about 17 hours ago
    Total: 3855s
    #655227
Production build 0.71.5 2024