Add $entity->toUrl() and $entity->toLink() methods to allowed methods list in Twig sandbox policy

Reroll for 10.1

Just run into this again after an internal discussion where we debated Twig vs PHP:

{{ url('entity.node.canonical', { 'node': node.id }) }}

or

$variables['node_url'] = $node->toUrl()->setAbsolute()->toString();

I couldn't believe there wasn't a simpler way, and then I found this issue again.

I would also note that the url() Twig function already assumes all URLs will be absolute:

    $options['absolute'] = TRUE;
    $generated_url = $this->urlGenerator->generateFromRoute($name, $parameters, $options, TRUE);

+++ b/core/lib/Drupal/Core/Template/TwigSandboxPolicy.php
@@ -56,15 +58,29 @@ public function __construct() {
-      'id',
-      'label',
-      'bundle',
-      'get',
-      '__toString',
-      'toString',
+      EntityInterface::class . '::id',
+      EntityInterface::class . '::label',
+      EntityInterface::class . '::bundle',
+      EntityInterface::class . '::toLink',
+      EntityInterface::class . '::toUrl',

I think we could sidestep this and the BC and deprecation issues if we just assume that a method name (without ::) also means "any class"?

Reroll for 10.3 without tests

Reroll for 10.3 with latest changes applied from issues/3487031 🐛 Performance Degraded after update to twig 3.14.2 Active

📌 Harden TwigSandbox methods Needs work is nearly ready. We should postpone this issue on getting that committed, first.