Security context

Highlights

Auth Bypass: 6 prior fixes. Scrutinize any change in this area.

src/Extension/CoreExtension.php: most-fixed (4 issues). Treat as high-risk during review.

16 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Sandbox Bypass: The sandbox policy can be circumvented during array processing (e.g., using the 'column' filter or dynamically evaluated properties via SourcePolicyInterface), allowing unauthorized access to restricted object properties or functions. Developers must strictly invoke checkPropertyAllowed and propagate active sandbox flags.

Code Injection: Unvalidated template names, macro references, or identifier strings compiled directly into template outputs can result in raw PHP injection. Robust regex validation of compilation identifiers is required prior to subcompilation.

Auth Bypass: Passing complex container types (e.g., Traversable, dual Stringable-Traversable objects, or dynamic arrays) to filters like 'join' or array keys can bypass standard __toString security policy checks unless element-wise recursion and coercion validation are recursively executed.