Skip to content
This repository was archived by the owner on Sep 29, 2019. It is now read-only.

Conversation

@CamaroSS
Copy link
Contributor

PHP can recognize an array or a string as a callable, causing unwanted changes to the template rendering process.
Example:

$template = new Template('Hello, {{ username }}!');
$context = new Context(['username' => 'Max']);
echo $template->render($context);

Expected:
Hello, Max!

Got:
Hello, !

It happens because 'max' is a function name in PHP, and is_callable('max') evaluates to true.
We have to be more strict here.

@idlesign
Copy link
Owner

Thank you.
Yeah, that looks like a security hole also.
We need to extend tests with that case to verify all goes fine.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants