diff --git a/app/config/eccube/packages/twig_extensions.yaml b/app/config/eccube/packages/twig_extensions.yaml index 50840691d51..eec807cedf8 100644 --- a/app/config/eccube/packages/twig_extensions.yaml +++ b/app/config/eccube/packages/twig_extensions.yaml @@ -8,3 +8,146 @@ services: #Twig\Extensions\DateExtension: ~ Twig\Extensions\IntlExtension: ~ #Twig\Extensions\TextExtension: ~ + + eccube.twig_sandbox.policy: + class: Twig\Sandbox\SecurityPolicy + arguments: + $allowedTags: "%eccube.twig_sandbox.allowed_tags%" + $allowedFilters: "%eccube.twig_sandbox.allowed_filters%" + $allowedFunctions: "%eccube.twig_sandbox.allowed_functions%" + $allowedMethods: "%eccube.twig_sandbox.allowed_methods%" + $allowedProperties: "%eccube.twig_sandbox.allowed_properties%" + eccube.twig_sandbox.extension: + class: Twig\Extension\SandboxExtension + arguments: + - '@eccube.twig_sandbox.policy' + - false + tags: ['twig.extension'] + Eccube\Twig\Sandbox\SecurityPolicyDecorator: + decorates: 'eccube.twig_sandbox.policy' +parameters: + eccube.twig_sandbox.allowed_tags: + - 'apply' + - 'block' + - 'deprecated' + - 'embed' + - 'extends' + - 'flush' + - 'for' + - 'if' + - 'set' + - 'spaceless' + - 'verbatim' + - 'with' + - 'form_theme' + - 'stopwatch' + - 'trans' + - 'trans_default_domain' + eccube.twig_sandbox.allowed_filters: + - 'abs' + - 'batch' + - 'capitalize' + - 'column' + - 'convert_encoding' + - 'date' + - 'date_modify' + - 'default' + - 'escape' + - 'first' + - 'format' + - 'join' + - 'json_encode' + - 'keys' + - 'last' + - 'length' + - 'lower' + - 'merge' + - 'nl2br' + - 'number_format' + - 'replace' + - 'reverse' + - 'round' + - 'slice' + - 'spaceless' + - 'split' + - 'striptags' + - 'title' + - 'trim' + - 'upper' + - 'url_encode' + - 'abbr_class' + - 'abbr_method' + - 'file_link' + - 'format_args' + - 'format_args_as_text' + - 'humanize' + - 'trans' + - 'yaml_dump' + - 'yaml_encode' + - 'date_day' + - 'date_day_with_weekday' + - 'date_format' + - 'date_min' + - 'date_sec' + - 'doctrine_pretty_query' + - 'doctrine_replace_query_parameters' + - 'e' + - 'ellipsis' + - 'file_ext_icon' + - 'form_encode_currency' + - 'format_log_message' + - 'no_image_product' + - 'price' + - 'time_ago' + - 'doctrine_minify_query' + - 'localizedcurrency' + - 'localizeddate' + - 'localizednumber' + - 'transchoice' + eccube.twig_sandbox.allowed_functions: + - 'cycle' + - 'date' + - 'max' + - 'min' + - 'random' + - 'range' + - 'absolute_url' + - 'asset' + - 'asset_version' + - 'csrf_token' + - 'is_granted' + - 'logout_path' + - 'logout_url' + - 'path' + - 'relative_path' + - 'url' + - 'active_menus' + - 'class_categories_as_json' + - 'csrf_token_for_anchor' + - 'currency_symbol' + - 'get_all_carts' + - 'get_cart' + - 'get_carts_total_price' + - 'get_carts_total_quantity' + - 'has_errors' + - 'is_reduced_tax_rate' + - 'product' + - 'workflow_can' + - 'workflow_has_marked_place' + - 'workflow_marked_places' + - 'workflow_transitions' + - 'device_version' + - 'full_view_url' + - 'is_android_os' + - 'is_device' + - 'is_full_view' + - 'is_ios' + - 'is_mobile' + - 'is_mobile_view' + - 'is_not_mobile_view' + - 'is_tablet' + - 'is_tablet_view' + eccube.twig_sandbox.allowed_methods: + 'Symfony\Bridge\Twig\AppVariable': [ 'getrequest' ] + 'Symfony\Component\HttpFoundation\Request': [ 'geturi' ] + eccube.twig_sandbox.allowed_properties: [] diff --git a/codeception/_support/AcceptanceTester.php b/codeception/_support/AcceptanceTester.php index e13b11a4a88..f11b6655b23 100644 --- a/codeception/_support/AcceptanceTester.php +++ b/codeception/_support/AcceptanceTester.php @@ -100,6 +100,7 @@ public function logoutAsMember() { $I = $this; $I->amOnPage('/'); + $I->wait(1); $isLogin = $I->grabTextFrom('.ec-headerNaviRole .ec-headerNav .ec-headerNav__item:nth-child(3) a'); if ($isLogin == 'ログアウト') { $I->wait(1); diff --git a/codeception/acceptance/EA06ContentsManagementCest.php b/codeception/acceptance/EA06ContentsManagementCest.php index 42d8179cb57..8a548e4fc93 100644 --- a/codeception/acceptance/EA06ContentsManagementCest.php +++ b/codeception/acceptance/EA06ContentsManagementCest.php @@ -240,7 +240,7 @@ public function contentsmanagement_レイアウト管理(\AcceptanceTester $I) LayoutEditPage::at($I) ->レイアウト名('あたらしいレイアウト') ->登録(); - + $I->wait(1); $I->see('保存しました'); } diff --git a/codeception/acceptance/EF02ProductCest.php b/codeception/acceptance/EF02ProductCest.php index 2109ec75ae4..24630532375 100644 --- a/codeception/acceptance/EF02ProductCest.php +++ b/codeception/acceptance/EF02ProductCest.php @@ -109,6 +109,7 @@ public function product_商品一覧表示件数(\AcceptanceTester $I) // 表示件数の選択リストを変更する $listPage->表示件数設定(40); + $I->wait(1); // 変更された表示件数分が1画面に表示される $expected = ($productNum >= 40) ? 40 : $productNum; diff --git a/composer.lock b/composer.lock index 2a5e407506e..cb6b09d8a62 100644 --- a/composer.lock +++ b/composer.lock @@ -2774,6 +2774,7 @@ "keywords": [ "diff" ], + "abandoned": true, "time": "2018-02-15T16:58:55+00:00" }, { @@ -3266,6 +3267,7 @@ "annotations", "controllers" ], + "abandoned": "Symfony", "time": "2019-07-08T08:31:25+00:00" }, { @@ -3589,6 +3591,7 @@ "mail", "mailer" ], + "abandoned": "symfony/mailer", "time": "2019-11-12T09:31:26+00:00" }, { @@ -3871,6 +3874,7 @@ "type": "tidelift" } ], + "abandoned": true, "time": "2020-10-24T10:57:07+00:00" }, { @@ -4153,6 +4157,7 @@ "type": "tidelift" } ], + "abandoned": "symfony/error-handler", "time": "2020-10-24T10:57:07+00:00" }, { @@ -5319,7 +5324,7 @@ "type": "tidelift" } ], - "abandoned": "use `EnglishInflector` from the String component instead", + "abandoned": "EnglishInflector from the String component", "time": "2020-10-24T10:57:07+00:00" }, { @@ -6904,6 +6909,7 @@ "type": "tidelift" } ], + "abandoned": true, "time": "2021-05-19T12:03:21+00:00" }, { @@ -7210,6 +7216,7 @@ ], "description": "Symfony SwiftmailerBundle", "homepage": "http://symfony.com", + "abandoned": "symfony/mailer", "time": "2019-11-07T21:01:35+00:00" }, { @@ -7933,6 +7940,7 @@ "type": "tidelift" } ], + "abandoned": true, "time": "2020-10-24T10:57:07+00:00" }, { @@ -8123,32 +8131,32 @@ }, { "name": "twig/twig", - "version": "v2.12.2", + "version": "v2.15.5", "source": { "type": "git", "url": "https://github.com/twigphp/Twig.git", - "reference": "d761fd1f1c6b867ae09a7d8119a6d95d06dc44ed" + "reference": "fc02a6af3eeb97c4bf5650debc76c2eda85ac22e" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/twigphp/Twig/zipball/d761fd1f1c6b867ae09a7d8119a6d95d06dc44ed", - "reference": "d761fd1f1c6b867ae09a7d8119a6d95d06dc44ed", + "url": "https://api.github.com/repos/twigphp/Twig/zipball/fc02a6af3eeb97c4bf5650debc76c2eda85ac22e", + "reference": "fc02a6af3eeb97c4bf5650debc76c2eda85ac22e", "shasum": "" }, "require": { - "php": "^7.0", + "php": ">=7.1.3", "symfony/polyfill-ctype": "^1.8", - "symfony/polyfill-mbstring": "^1.3" + "symfony/polyfill-mbstring": "^1.3", + "symfony/polyfill-php72": "^1.8" }, "require-dev": { "psr/container": "^1.0", - "symfony/debug": "^3.4|^4.2", - "symfony/phpunit-bridge": "^4.4@dev|^5.0" + "symfony/phpunit-bridge": "^4.4.9|^5.0.9|^6.0" }, "type": "library", "extra": { "branch-alias": { - "dev-master": "2.12-dev" + "dev-master": "2.15-dev" } }, "autoload": { @@ -8172,7 +8180,6 @@ }, { "name": "Twig Team", - "homepage": "https://twig.symfony.com/contributors", "role": "Contributors" }, { @@ -8186,7 +8193,17 @@ "keywords": [ "templating" ], - "time": "2019-11-11T16:52:09+00:00" + "funding": [ + { + "url": "https://github.com/fabpot", + "type": "github" + }, + { + "url": "https://tidelift.com/funding/github/packagist/twig/twig", + "type": "tidelift" + } + ], + "time": "2023-05-03T17:49:41+00:00" }, { "name": "vlucas/phpdotenv", diff --git a/package-lock.json b/package-lock.json index 2b04dcb814f..a585b51a048 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,6 +1,6 @@ { "name": "eccube", - "version": "4.0.6-p3", + "version": "4.0.6-p4", "lockfileVersion": 1, "requires": true, "dependencies": { diff --git a/package.json b/package.json index d04fd3ec707..1af3bf261a8 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "eccube", - "version": "4.0.6-p3", + "version": "4.0.6-p4", "description": "EC-CUBE EC open platform.", "main": "index.js", "directories": { diff --git a/src/Eccube/Common/Constant.php b/src/Eccube/Common/Constant.php index 5f3d3575c4c..c8cd428abf3 100644 --- a/src/Eccube/Common/Constant.php +++ b/src/Eccube/Common/Constant.php @@ -18,7 +18,7 @@ class Constant /** * EC-CUBE VERSION. */ - const VERSION = '4.0.6-p3'; + const VERSION = '4.0.6-p4'; /** * Enable value. diff --git a/src/Eccube/Resource/template/default/Product/detail.twig b/src/Eccube/Resource/template/default/Product/detail.twig index b0eb9c5c538..16d0cb0efbf 100755 --- a/src/Eccube/Resource/template/default/Product/detail.twig +++ b/src/Eccube/Resource/template/default/Product/detail.twig @@ -375,7 +375,7 @@ file that was distributed with this source code. {% if Product.freearea %}
- {{ include(template_from_string(Product.freearea)) }} + {{ include(template_from_string(Product.freearea), sandboxed = true) }}
{% endif %} diff --git a/src/Eccube/Resource/template/default/default_frame.twig b/src/Eccube/Resource/template/default/default_frame.twig index 1c83277beab..c97109c3efc 100644 --- a/src/Eccube/Resource/template/default/default_frame.twig +++ b/src/Eccube/Resource/template/default/default_frame.twig @@ -28,7 +28,7 @@ file that was distributed with this source code. {% endif %} {% if Page.meta_tags is not empty %} - {{ include(template_from_string(Page.meta_tags)) }} + {{ include(template_from_string(Page.meta_tags), sandboxed = true) }} {% endif %} diff --git a/src/Eccube/Twig/Extension/IgnoreTwigSandboxErrorExtension.php b/src/Eccube/Twig/Extension/IgnoreTwigSandboxErrorExtension.php new file mode 100644 index 00000000000..210b8ff1fe5 --- /dev/null +++ b/src/Eccube/Twig/Extension/IgnoreTwigSandboxErrorExtension.php @@ -0,0 +1,78 @@ + true, 'needs_context' => true, 'is_safe' => ['all']]), + ]; + } + + /** + * twig sandboxの例外を操作します + * app_env = devの場合、エラーを表示する + * app_env = prodの場合、エラーを表示しない + * + * @param Environment $env + * @param $context + * @param $template + * @param $variables + * @param $withContext + * @param $ignoreMissing + * @param $sandboxed + * + * @return string|void + * + * @throws LoaderError + * @throws SecurityError + */ + public function twig_include(Environment $env, $context, $template, $variables = [], $withContext = true, $ignoreMissing = false, $sandboxed = false) + { + try { + return \twig_include($env, $context, $template, $variables, $withContext, $ignoreMissing, $sandboxed); + } catch (SecurityError $e) { + + // devではエラー画面が表示されるようにする + $appEnv = env('APP_ENV'); + if ($appEnv === 'dev') { + throw $e; + } else { + // ログ出力 + log_warning($e->getMessage(), ['exception' => $e]); + + // 例外がスローされた場合、sandboxが効いた状態になってしまうため追加 + $sandbox = $env->getExtension(SandboxExtension::class); + if (!$sandbox->isSandboxedGlobally()) { + $sandbox->disableSandbox(); + } + } + } + } +} \ No newline at end of file diff --git a/src/Eccube/Twig/Sandbox/SecurityPolicyDecorator.php b/src/Eccube/Twig/Sandbox/SecurityPolicyDecorator.php new file mode 100644 index 00000000000..017fc1c6d7f --- /dev/null +++ b/src/Eccube/Twig/Sandbox/SecurityPolicyDecorator.php @@ -0,0 +1,47 @@ +securityPolicy = $securityPolicy; + } + + public function checkSecurity($tags, $filters, $functions) + { + $this->securityPolicy->checkSecurity($tags, $filters, $functions); + } + + public function checkMethodAllowed($obj, $method) + { + // __toStringの場合はチェックをスキップする + if ($method === '__toString') { + return; + } + $this->securityPolicy->checkMethodAllowed($obj, $method); + } + + public function checkPropertyAllowed($obj, $method) + { + $this->securityPolicy->checkPropertyAllowed($obj, $method); + } +} diff --git a/tests/Eccube/Tests/Twig/Extension/IgnoreTwigSandboxErrorExtensionTest.php b/tests/Eccube/Tests/Twig/Extension/IgnoreTwigSandboxErrorExtensionTest.php new file mode 100644 index 00000000000..12acecb275f --- /dev/null +++ b/tests/Eccube/Tests/Twig/Extension/IgnoreTwigSandboxErrorExtensionTest.php @@ -0,0 +1,109 @@ +createProduct(); + $Product->setFreeArea('__RENDERED__'.$snippet); + $this->entityManager->flush(); + + $crawler = $this->client->request('GET', $this->generateUrl('product_detail', ['id' => $Product->getId()])); + $text = $crawler->text(); + + // $snippetがsandboxで制限された場合はフリーエリアは空で出力されるため、__RENDERED__の出力有無で結果を確認する + self::assertContains($whitelisted ? '__RENDERED__' : '', $text); + } + + /** + * @dataProvider twigSnippetsProvider + * @dataProvider twigVarMetaTagsProvider + */ + public function testMetatags($snippet, $whitelisted) + { + $Page = $this->entityManager->getRepository(Page::class)->find(1); + $Page->setMetaTags('__RENDERED__'.$snippet); + $this->entityManager->flush(); + + $crawler = $this->client->request('GET', $this->generateUrl($Page->getUrl())); + $text = $crawler->text(); + + // ホワイトリストに入っている場合__RENDERED__が表示される + if ($whitelisted) { + self::assertContains('__RENDERED__', $text); + } else { + self::assertNotContains('__RENDERED__', $text); + } + // 入力可能ではない値の場合は、システムエラーが発生する + self::assertNotContains('システムエラーが発生しました', $text); + + } + + public function twigSnippetsProvider() + { + // 0: twigスニペット, 1: ホワイトリスト対象かどうか + return [ + ['{% set foo = "bar" %}', true], + ['{% spaceless %}
test
{% endspaceless %}', true], + ['{% flush %}', true], + ['{% apply lower|escape("html") %}SOME TEXT{% endapply %}', true], + ['{% macro input(name, value, type = "text", size = 20) %}{% endmacro %}', false], + ['{% sandbox %}{% include "user.html" %}{% endsandbox %}', false], + ['{{ "-5"|abs }}', true], + ['{{ "2020/02/01"|date_modify("+1 day")|date("m/d/Y") }}', true], + ['{{ [1, 2, 3, 4]|first }}', true], + ['{{ file|format_file(line, text = null) }}', false], + ['{{ [1, 2, 3]|reduce((carry, v) => carry + v) }}', false], + ['{{ "

test

" |raw }}', false], + ['{{ url("homepage") }}', true], + ['{{ random(1, 100) }}', true], + ['{% for i in range(3, 0) %} {{ i }}, {% endfor %}', true], + ['{{ dump(9) }}', false], + ['{{ constant("RSS", date) }}', false], + ['{{ include(template_from_string("Hello")) }}', false], + ]; + } + + public function twigVarFreeAreaProvider() + { + // 0: twigスニペット, 1: ホワイトリスト対象かどうか + return [ + ['{{ app.user }}', false], + ['{{ Product.name }}', true], + ['{{ app.request.uri }}', true], + ['{{ app.request.getUri }}', true], + ['{{ Product.main_list_image|no_image_product }}', true], + ]; + } + + public function twigVarMetaTagsProvider() + { + // 0: twigスニペット, 1: ホワイトリスト対象かどうか + return [ + ['{{ app.debug }}', false], + ['{{ BaseInfo.shop_name }}', true], + ['{{ app.request.uri }}', true], + ['{{ app.request.getUri }}', true], + ]; + } +} \ No newline at end of file