Twig_Loader_String is deprecated

[CarsonF]

Safe twig uses Twig_Loader_String which is deprecated as of 1.18.1

[rarila]

Some hint to solve this: twigphp/Twig#1641

[bobdenotter]

Ah, that workaround seems doable.. Great example, too!

$env = new \Twig_Environment(new \Twig_Loader_Array());
$template = $env->createTemplate('Hello, {{ name }}');
echo $env->render($template, array('name' => 'Bob')); // Hello, Bob

[rarila]

@bobdenotter you only like it because of that example name ;-)

[jeroenvdgulik]

$env = new \Twig_Environment(new \Twig_Loader_Array());

This won't work as Twig_Loader_Array() expects a template as constructor parameter

[GwendolenLynch]

@jeroenvdgulik yeah, we're just planning on implementing our own class sans a better idea.

[jeroenvdgulik]

It took me some time to figure this out so maybe this is useful for you guys. This works:

$env = new \Twig_Environment(new \Twig_Loader_Array(['my_template_name' => 'Hello, {{ name }}']));
$html = $env->render('my_template_name', array('name' => 'Bob'));

[CarsonF]

I think what we need to do is not have a separate safe_twig environment, but just use the Sandbox Extension they provide.

Twig functions/filters can already be defined with an is_safe option. And we can create a SecurityPolicy for more custom stuff.

[GwendolenLynch]

Bumping this to a 2.4 milestone as @CarsonF has a branch in progress, but has too much flux for this stage in 2.3-dev.

[SahAssar]

Any progress on this?

[CarsonF]

Nope. We could probably just copy their source.
But there's a reason they deprecated it. It's basically impossible to cache.

[GwendolenLynch]

Ha… I've been meaning to bring this up with you for a couple of weeks, @CarsonF

It isn't super urgent right now, as it won't bite until next major anyway. But keep this open to track @SahAssar

[CarsonF]

Fixed in 3.3 with sandbox