PhpWriter: complex expression in strings prohibited in sandbox mode

nette · Jan 4, 2022 · a0090af · a0090af
1 parent a6d67d7
commit a0090af
Show file tree

Hide file tree

Showing 2 changed files with 20 additions and 0 deletions.
diff --git a/src/Latte/Compiler/PhpWriter.php b/src/Latte/Compiler/PhpWriter.php
@@ -222,6 +222,14 @@ public function validateTokens(MacroTokens $tokens): void
 					trigger_error('Backtick operator is deprecated in Latte.', E_USER_DEPRECATED);
 				}
 
+			} elseif (
+				$this->policy
+				&& $tokens->isCurrent($tokens::T_STRING)
+				&& $tokenValue[0] === '"'
+				&& (strpos($tokenValue, '{$') !== false || strpos($tokenValue, '${') !== false)
+			) {
+				throw new CompileException('Forbidden complex expressions in strings.');
+
 			} elseif (
 				Helpers::startsWith($tokenValue, '$ʟ_')
 				|| ($this->policy && $tokens->isCurrent('$this'))

diff --git a/tests/Latte/Policy.violations.phpt b/tests/Latte/Policy.violations.phpt
@@ -132,3 +132,15 @@ Assert::exception(function () use ($latte) {
 Assert::exception(function () use ($latte) {
 	$latte->compile('{do new stdClass}');
 }, Latte\CompileException::class, "Forbidden keyword 'new' inside tag.");
+
+Assert::exception(function () use ($latte) {
+	$latte->compile('{="{$var}"}');
+}, Latte\CompileException::class, 'Forbidden complex expressions in strings.');
+
+Assert::exception(function () use ($latte) {
+	$latte->compile('{="${var}"}');
+}, Latte\CompileException::class, 'Forbidden complex expressions in strings.');
+
+Assert::noError(function () use ($latte) {
+	$latte->compile('{=\'${var}\'}');
+});