SafeCollection

System\Twig\SecurityPolicy\SafeCollection

Overview

SafeCollection is a collection proxy class that is safe for use in Twig without exposing callable functions, which are unusable in Twig anyway.

Implements

October\Contracts\Twig\CallsAnyMethod

Protected Properties

protected Collection $collection

collection instance

protected array $hybridCallableArgs

hybridCallableArgs are methods that can take a string value or a callable array. This allows callable strings that might be used as attributes, e.g. 'passthru'. Entries are lowercased in __construct for case-insensitive matching.

protected array $blockedMethods

blockedMethods that could be used to instantiate arbitrary classes or call static methods on arbitrary classes. Entries are lowercased in __construct for case-insensitive matching.

Public Methods

public __call()

public __call(string $method, array $parameters): mixed

__call magic

public __construct()

public __construct($collection): void

Protected Methods

protected forwardCallTo()

protected forwardCallTo(
    mixed $object,
    string $method,
    array $parameters
): mixed

Forward a method call to the given object.

protected forwardDecoratedCallTo()

protected forwardDecoratedCallTo(
    mixed $object,
    string $method,
    array $parameters
): mixed

Forward a method call to the given object, returning $this if the forwarded call returned itself.

protected stripCallables()

protected stripCallables($value, $method): void

stripCallables walks the value and nulls out any callable found at any depth. Hybrid methods (contains, groupBy, etc.) keep string values because they may be used as attribute names. The $method argument is expected to be already lowercased by the caller.

Arrays are checked as callables themselves before being recursed into, so a [class, method] / [object, method] tuple is neutralised as a whole rather than walked element-by-element (which would leave the tuple intact since each element is individually non-callable).

protected static throwBadMethodCallException()

protected static throwBadMethodCallException(string $method): never

Throw a bad method call exception for the given method.

Contents