Security context

Highlights

Cross-Site Scripting: 2 prior fixes. Scrutinize any change in this area.

src/Latte/Sandbox/SandboxExtension.php: most-fixed (2 issues). Treat as high-risk during review.

4 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Sandbox Escape: Bypasses in callable checks and AST parsing allow templates to invoke unauthorized methods, leading to arbitrary code execution within the sandbox context. Defensive checks must handle modern syntax structures (like first-class callables) and filter control characters.

Command Injection: The PHP helper validators execute external syntax checkers or linters. Spawning these processes via shell-parsing functions like proc_open with a raw string opens injection vulnerabilities unless command arguments are passed as a strictly sanitized array.

Cross-Site Scripting: Dynamic attribute generation allows injection of malicious key-value pairs. Failing to validate the names of dynamic attributes in n:attr tags enables attackers to write arbitrary event handlers or inject raw script elements.