You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Hardens the twigOperator grid transformer on top of #2054.
Templates render in a dedicated Twig environment with the sandbox always enabled and without Pimcore's Twig extensions or the application's Twig configuration.
No method or property access on objects. Core's sandbox class and method lists are accepted for BC but not applied; no pimcore_* function can be called (registered ones are blocked, allow-listed ones ignored).
Values are converted to plain data before rendering: dates to ISO 8601 strings, consent values, JsonSerializable objects and enums to their data, other objects to null.
range() returns at most 1000 elements (best effort; .. and nested loops are not limited).
New extension point: services tagged pimcore_studio_backend.twig_operator_extension.
BC: constructor signatures and interfaces unchanged; new TwigOperatorEnvironmentProviderInterface with a deprecated, fail-closed fallback. Behaviour changes for templates are listed in the 2026.4.0 upgrade note.
The advanced-column fix that was part of this PR shipped separately in #2071.
Hardens TwigOperator rendering and corrects localized advanced-column exports.
Changes:
Adds an isolated, deny-all Twig sandbox with value sanitization and extension support.
Prevents unwanted default-language fallback and exports top-level null as ''.
Adds regression tests and upgrade documentation.
Review assessment:
The fixes target the correct transformer, resolver, and Twig initialization boundaries.
Regression tests and documentation are comprehensive.
Blocking issues remain: mixed range bounds bypass the cap (SandboxExtensionInitializer.php:278), and previously public Twig contracts introduce breaking changes without deprecation paths.
Range cap bypass (mixed bounds such as range('a', 1000000)) is fixed: the check is only skipped when both bounds are non-numeric strings; otherwise the span is computed treating a non-numeric bound as 0. Regression tests added for both bound orders.
The cap rejects valid ranges whose endpoints are not evenly divisible by the step. For example, PHP's range(0, 1999, 2) contains exactly 1,000 values (0 through 1998), but this expression computes 1000.5 and throws. Floor the quotient before adding one, and cover a non-unit step at the cap in the regression tests.
Builds on #2054: core's sandbox lists still apply, on top of a dedicated
environment, plain-data values and a capped range().
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Addresses the review on #2064: sandbox always on in the isolated environment,
decorated initializers fail closed, known value objects become plain data.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hardens the
twigOperatorgrid transformer on top of #2054.pimcore_*function can be called (registered ones are blocked, allow-listed ones ignored).JsonSerializableobjects and enums to their data, other objects to null.range()returns at most 1000 elements (best effort;..and nested loops are not limited).pimcore_studio_backend.twig_operator_extension.TwigOperatorEnvironmentProviderInterfacewith a deprecated, fail-closed fallback. Behaviour changes for templates are listed in the 2026.4.0 upgrade note.The advanced-column fix that was part of this PR shipped separately in #2071.
🤖 Generated with Claude Code