StringTemplateTrait does not fail for missing templates.

[thinkingmedia]

This is a (multiple allowed):

• bug
• enhancement
• feature-discussion (RFC)
• CakePHP Version: 3.2.1
• Platform and Target: Apache, MySQL, Windows 10, PHP 7

What you did

Created a helper that uses the StringTemplateTrait.

class MyHelper extends Helper {
    use StringTemplateTrait;

    protected $_defaultConfig = [
       'templates' => [
             'Bar' => 'hello'
        ]
   ];

   public function Foo() {
       return $this->formatTemplate('Oops',[]);
   }
}

The template Oops does not exist.

Some where else like a view

     <?= $this->My->Foo()." world" ?>

The view still renders without error. No warning is given to the developer that the output is not as expected.

Expected Behavior

Should trigger an error that the template Oops does not exist.

Actual Behavior

The Foo() method returns null which mutates into an empty string. The rendered output for the view is world, but the expected output hello world is not generated.

I experienced this as a security bug in my app. The JavaScript code that was suppose to be injected into the view was from a template, but the name has a spelling mistake. The output for the view mutated the null into an empty string. This resulted in valid JavaScript code that was missing an important chunk from the template.

[markstory]

StringTemplate didn't raise exceptions on purpose to make it more tolerant of programmer error. However, you raise a good point that we should be helping developers find their mistakes.

[markstory]

Pull request #8555 up for 3.3.0.