<?php

[0] Fix | Delete

[1] Fix | Delete

/*

[2] Fix | Delete

* This file is part of Twig.

[3] Fix | Delete

*

[4] Fix | Delete

* (c) Fabien Potencier

[5] Fix | Delete

*

[6] Fix | Delete

* For the full copyright and license information, please view the LICENSE

[7] Fix | Delete

* file that was distributed with this source code.

[8] Fix | Delete

*/

[9] Fix | Delete

namespace WPML\Core\Twig\Sandbox;

[10] Fix | Delete

[11] Fix | Delete

use WPML\Core\Twig\Markup;

[12] Fix | Delete

/**

[13] Fix | Delete

* Represents a security policy which need to be enforced when sandbox mode is enabled.

[14] Fix | Delete

*

[15] Fix | Delete

* @final

[16] Fix | Delete

*

[17] Fix | Delete

* @author Fabien Potencier <fabien@symfony.com>

[18] Fix | Delete

*/

[19] Fix | Delete

class SecurityPolicy implements \WPML\Core\Twig\Sandbox\SecurityPolicyInterface

[20] Fix | Delete

{

[21] Fix | Delete

protected $allowedTags;

[22] Fix | Delete

protected $allowedFilters;

[23] Fix | Delete

protected $allowedMethods;

[24] Fix | Delete

protected $allowedProperties;

[25] Fix | Delete

protected $allowedFunctions;

[26] Fix | Delete

public function __construct(array $allowedTags = [], array $allowedFilters = [], array $allowedMethods = [], array $allowedProperties = [], array $allowedFunctions = [])

[27] Fix | Delete

{

[28] Fix | Delete

$this->allowedTags = $allowedTags;

[29] Fix | Delete

$this->allowedFilters = $allowedFilters;

[30] Fix | Delete

$this->setAllowedMethods($allowedMethods);

[31] Fix | Delete

$this->allowedProperties = $allowedProperties;

[32] Fix | Delete

$this->allowedFunctions = $allowedFunctions;

[33] Fix | Delete

}

[34] Fix | Delete

public function setAllowedTags(array $tags)

[35] Fix | Delete

{

[36] Fix | Delete

$this->allowedTags = $tags;

[37] Fix | Delete

}

[38] Fix | Delete

public function setAllowedFilters(array $filters)

[39] Fix | Delete

{

[40] Fix | Delete

$this->allowedFilters = $filters;

[41] Fix | Delete

}

[42] Fix | Delete

public function setAllowedMethods(array $methods)

[43] Fix | Delete

{

[44] Fix | Delete

$this->allowedMethods = [];

[45] Fix | Delete

foreach ($methods as $class => $m) {

[46] Fix | Delete

$this->allowedMethods[$class] = \array_map('strtolower', \is_array($m) ? $m : [$m]);

[47] Fix | Delete

}

[48] Fix | Delete

}

[49] Fix | Delete

public function setAllowedProperties(array $properties)

[50] Fix | Delete

{

[51] Fix | Delete

$this->allowedProperties = $properties;

[52] Fix | Delete

}

[53] Fix | Delete

public function setAllowedFunctions(array $functions)

[54] Fix | Delete

{

[55] Fix | Delete

$this->allowedFunctions = $functions;

[56] Fix | Delete

}

[57] Fix | Delete

public function checkSecurity($tags, $filters, $functions)

[58] Fix | Delete

{

[59] Fix | Delete

foreach ($tags as $tag) {

[60] Fix | Delete

if (!\in_array($tag, $this->allowedTags)) {

[61] Fix | Delete

throw new \WPML\Core\Twig\Sandbox\SecurityNotAllowedTagError(\sprintf('Tag "%s" is not allowed.', $tag), $tag);

[62] Fix | Delete

}

[63] Fix | Delete

}

[64] Fix | Delete

foreach ($filters as $filter) {

[65] Fix | Delete

if (!\in_array($filter, $this->allowedFilters)) {

[66] Fix | Delete

throw new \WPML\Core\Twig\Sandbox\SecurityNotAllowedFilterError(\sprintf('Filter "%s" is not allowed.', $filter), $filter);

[67] Fix | Delete

}

[68] Fix | Delete

}

[69] Fix | Delete

foreach ($functions as $function) {

[70] Fix | Delete

if (!\in_array($function, $this->allowedFunctions)) {

[71] Fix | Delete

throw new \WPML\Core\Twig\Sandbox\SecurityNotAllowedFunctionError(\sprintf('Function "%s" is not allowed.', $function), $function);

[72] Fix | Delete

}

[73] Fix | Delete

}

[74] Fix | Delete

}

[75] Fix | Delete

public function checkMethodAllowed($obj, $method)

[76] Fix | Delete

{

[77] Fix | Delete

if ($obj instanceof \WPML\Core\Twig_TemplateInterface || $obj instanceof \WPML\Core\Twig\Markup) {

[78] Fix | Delete

return;

[79] Fix | Delete

}

[80] Fix | Delete

$allowed = \false;

[81] Fix | Delete

$method = \strtolower($method);

[82] Fix | Delete

foreach ($this->allowedMethods as $class => $methods) {

[83] Fix | Delete

if ($obj instanceof $class) {

[84] Fix | Delete

$allowed = \in_array($method, $methods);

[85] Fix | Delete

break;

[86] Fix | Delete

}

[87] Fix | Delete

}

[88] Fix | Delete

if (!$allowed) {

[89] Fix | Delete

$class = \get_class($obj);

[90] Fix | Delete

throw new \WPML\Core\Twig\Sandbox\SecurityNotAllowedMethodError(\sprintf('Calling "%s" method on a "%s" object is not allowed.', $method, $class), $class, $method);

[91] Fix | Delete

}

[92] Fix | Delete

}

[93] Fix | Delete

public function checkPropertyAllowed($obj, $property)

[94] Fix | Delete

{

[95] Fix | Delete

$allowed = \false;

[96] Fix | Delete

foreach ($this->allowedProperties as $class => $properties) {

[97] Fix | Delete

if ($obj instanceof $class) {

[98] Fix | Delete

$allowed = \in_array($property, \is_array($properties) ? $properties : [$properties]);

[99] Fix | Delete

break;

[100] Fix | Delete

}

[101] Fix | Delete

}

[102] Fix | Delete

if (!$allowed) {

[103] Fix | Delete

$class = \get_class($obj);

[104] Fix | Delete

throw new \WPML\Core\Twig\Sandbox\SecurityNotAllowedPropertyError(\sprintf('Calling "%s" property on a "%s" object is not allowed.', $property, $class), $class, $property);

[105] Fix | Delete

}

[106] Fix | Delete

}

[107] Fix | Delete

}

[108] Fix | Delete

\class_alias('WPML\\Core\\Twig\\Sandbox\\SecurityPolicy', 'WPML\\Core\\Twig_Sandbox_SecurityPolicy');

[109] Fix | Delete

[110] Fix | Delete