dja icon indicating copy to clipboard operation
dja copied to clipboard

Fixed: some strings and arrays in the context can break the template rendering due to PHP callables

Open CamaroSS opened this issue 9 years ago • 1 comments

PHP can recognize an array or a string as a callable, causing unwanted changes to the template rendering process. Example:

$template = new Template('Hello, {{ username }}!');
$context = new Context(['username' => 'Max']);
echo $template->render($context);

Expected: Hello, Max!

Got: Hello, !

It happens because 'max' is a function name in PHP, and is_callable('max') evaluates to true. We have to be more strict here.

CamaroSS avatar Jun 15 '15 14:06 CamaroSS

Thank you. Yeah, that looks like a security hole also. We need to extend tests with that case to verify all goes fine.

idlesign avatar Jun 16 '15 13:06 idlesign