Mirrors/grav
1
0
Fork 0
mirror of https://github.com/getgrav/grav.git synced 2025-02-20 19:56:53 +01:00
Code Issues Packages Projects Releases Wiki Activity

also handle SSTI in reduce twig filter + function

Browse Source
This commit is contained in:
Andy Miller 2023-06-14 11:08:17 -06:00
parent 71bbed12f9
commit 244758d438
No known key found for this signature in database
GPG Key ID: 9F2CF38AEBDB0AE0
2 changed files with 29 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
CHANGELOG.md
View File

@ -4,10 +4,11 @@
1. [](#new)
* Added a new `system.languages.debug` option that adds a `<span class="translate-debug"></span>` around strings translated with `|t`. This can be styled by the theme as needed.
1. [](#improved)
* More robust SSTI handling in `|filter` and `|map`
* More robust SSTI handling in `filter`, `map`, and `reduce` Twig filters and functions
* Various SSTI improvements `Utils::isDangerousFunction()`
1. [](#bugfix)
* Fixed Twig `|map()` allowing code execution
* Fixed Twig `|reduce()` allowing code execution
# v1.7.41.2
## 06/01/2023

32
system/src/Grav/Common/Twig/Extension/GravExtension.php
View File

@ -171,9 +171,10 @@ class GravExtension extends AbstractExtension implements GlobalsInterface
new TwigFilter('count', 'count'),
new TwigFilter('array_diff', 'array_diff'),
// Security fix
new TwigFilter('filter', [$this, 'filterFilter'], ['needs_environment' => true]),
new TwigFilter('map', [$this, 'mapFilter'], ['needs_environment' => true]),
// Security fixes
new TwigFilter('filter', [$this, 'filterFunc'], ['needs_environment' => true]),
new TwigFilter('map', [$this, 'mapFunc'], ['needs_environment' => true]),
new TwigFilter('reduce', [$this, 'reduceFunc'], ['needs_environment' => true]),
];
}
@ -250,6 +251,11 @@ class GravExtension extends AbstractExtension implements GlobalsInterface
new TwigFunction('count', 'count'),
new TwigFunction('array_diff', 'array_diff'),
new TwigFunction('parse_url', 'parse_url'),
// Security fixes
new TwigFunction('filter', [$this, 'filterFunc'], ['needs_environment' => true]),
new TwigFunction('map', [$this, 'mapFunc'], ['needs_environment' => true]),
new TwigFunction('reduce', [$this, 'reduceFunc'], ['needs_environment' => true]),
];
}
@ -1706,7 +1712,7 @@ class GravExtension extends AbstractExtension implements GlobalsInterface
* @return array|CallbackFilterIterator
* @throws RuntimeError
*/
function filterFilter(Environment $env, $array, $arrow)
function filterFunc(Environment $env, $array, $arrow)
{
if (!$arrow instanceof \Closure && !is_string($arrow) || Utils::isDangerousFunction($arrow)) {
throw new RuntimeError('Twig |filter("' . $arrow . '") is not allowed.');
@ -1722,7 +1728,7 @@ class GravExtension extends AbstractExtension implements GlobalsInterface
* @return array|CallbackFilterIterator
* @throws RuntimeError
*/
function mapFilter(Environment $env, $array, $arrow)
function mapFunc(Environment $env, $array, $arrow)
{
if (!$arrow instanceof \Closure && !is_string($arrow) || Utils::isDangerousFunction($arrow)) {
throw new RuntimeError('Twig |map("' . $arrow . '") is not allowed.');
@ -1730,4 +1736,20 @@ class GravExtension extends AbstractExtension implements GlobalsInterface
return twig_array_map($env, $array, $arrow);
}
/**
* @param Environment $env
* @param array $array
* @param callable|string $arrow
* @return array|CallbackFilterIterator
* @throws RuntimeError
*/
function reduceFunc(Environment $env, $array, $arrow)
{
if (!$arrow instanceof \Closure && !is_string($arrow) || Utils::isDangerousFunction($arrow)) {
throw new RuntimeError('Twig |reduce("' . $arrow . '") is not allowed.');
}
return twig_array_map($env, $array, $arrow);
}
}