zf3-twig icon indicating copy to clipboard operation
zf3-twig copied to clipboard

Published 20 hours ago • verified publisher icon OxCom

Bump twig to v3.4.3 in composer.json

Open OxCom opened this issue 1 year ago • 0 comments

Fix security issue

When using the filesystem loader to load templates for which the name is a user input, it is possible to use the source or include statement to read arbitrary files from outside the templates directory when using a namespace like @somewhere/../some.file (in such a case, validation is bypassed).

  • [x] Dump Twig to v3.4.3
  • [ ] Drop support for PHP version less then 7.4
  • [ ] Update tests to handle latest version of twig and laminas

OxCom avatar Jul 06 '23 06:07 OxCom