System\Twig\SecurityPolicy

Overview

SecurityPolicy is a security policy using an allow-list

Implements

• Twig\Sandbox\SecurityPolicyInterface

Protected Properties

protected array $blockedClassMethods

blockedClassMethods lists forbidden methods per class. Each entry holds only methods unique to that class; forwarded methods are pulled in via $blockedClassForwarders.

protected array $eagerLoadMethods

eagerLoadMethods accept relation constraints that are invoked as callables, so their callable arguments are stripped.

protected array $blockedClassForwarders

blockedClassForwarders maps a class to the class its __call forwards to, so the sandbox enforces both blocklists for one receiver.

protected array $blockMethods

blockMethods is a list of forbidden methods

protected array $allowMethods

allowMethods is a list of allowed methods

Public Methods

public __construct()

public __construct(): void

public static addExtensionToTwig()

public static addExtensionToTwig($twig): void

addExtensionToTwig will add the appropriate policy based on configuration. The policy only used in safe mode.

public castMethodObjectToSafeObject()

public castMethodObjectToSafeObject($object): void

castMethodObjectToSafeObject casts unsafe objects used by method calls to proxy objects that protect from arbitrary callable methods, such as using 'passthru' to execute shell commands.

public checkMethodAllowed()

public checkMethodAllowed($obj, $method): void 

public checkPropertyAllowed()

public checkPropertyAllowed($obj, $property): void 

public checkSecurity()

public checkSecurity($tags, $filters, $functions): void 

public stripCallableArguments()

public stripCallableArguments($object, $method, $arguments): array 

stripCallableArguments removes callable constraints passed to eager loading methods, keeping plain relation names intact.

Protected Methods

protected checkMethodAllowedAllowlist()

protected checkMethodAllowedAllowlist($obj, $method): void

protected checkMethodAllowedBlocklist()

protected checkMethodAllowedBlocklist($obj, $method): void

protected stripKeyedCallables()

protected stripKeyedCallables($value): array 

stripKeyedCallables nulls callables stored under string keys, where relation constraints live.