dja
dja copied to clipboard
Fixed: some strings and arrays in the context can break the template rendering due to PHP callables
PHP can recognize an array or a string as a callable, causing unwanted changes to the template rendering process. Example:
$template = new Template('Hello, {{ username }}!');
$context = new Context(['username' => 'Max']);
echo $template->render($context);
Expected:
Hello, Max!
Got:
Hello, !
It happens because 'max' is a function name in PHP, and is_callable('max')
evaluates to true
.
We have to be more strict here.
Thank you. Yeah, that looks like a security hole also. We need to extend tests with that case to verify all goes fine.