N°5564 - ⬆️ twig bump

2026-02-12 23:14:18 +01:00 · 2022-12-26 09:42:56 +01:00
parent 94d7d94bff
commit 0fad249124
10 changed files with 52 additions and 58 deletions
--- a/composer.lock
+++ b/composer.lock
@@ -4974,16 +4974,16 @@
        },
        {
            "name": "twig/twig",
-            "version": "v3.4.2",
+            "version": "v3.4.3",
            "source": {
                "type": "git",
                "url": "https://github.com/twigphp/Twig.git",
-                "reference": "e07cdd3d430cd7e453c31b36eb5ad6c0c5e43077"
+                "reference": "c38fd6b0b7f370c198db91ffd02e23b517426b58"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/twigphp/Twig/zipball/e07cdd3d430cd7e453c31b36eb5ad6c0c5e43077",
-                "reference": "e07cdd3d430cd7e453c31b36eb5ad6c0c5e43077",
+                "url": "https://api.github.com/repos/twigphp/Twig/zipball/c38fd6b0b7f370c198db91ffd02e23b517426b58",
+                "reference": "c38fd6b0b7f370c198db91ffd02e23b517426b58",
                "shasum": ""
            },
            "require": {
@@ -5034,7 +5034,7 @@
            ],
            "support": {
                "issues": "https://github.com/twigphp/Twig/issues",
-                "source": "https://github.com/twigphp/Twig/tree/v3.4.2"
+                "source": "https://github.com/twigphp/Twig/tree/v3.4.3"
            },
            "funding": [
                {
@@ -5046,7 +5046,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2022-08-12T06:47:24+00:00"
+            "time": "2022-09-28T08:42:51+00:00"
        },
        {
            "name": "webmozart/assert",
--- a/lib/composer/InstalledVersions.php
+++ b/lib/composer/InstalledVersions.php
@@ -24,21 +24,8 @@ use Composer\Semver\VersionParser;
 */
 class InstalledVersions
 {
-    /**
-     * @var mixed[]|null
-     * @psalm-var array{root: array{name: string, version: string, reference: string, pretty_version: string, aliases: string[], dev: bool, install_path: string, type: string}, versions: array<string, array{dev_requirement: bool, pretty_version?: string, version?: string, aliases?: string[], reference?: string, replaced?: string[], provided?: string[], install_path?: string, type?: string}>}|array{}|null
-     */
    private static $installed;
-
-    /**
-     * @var bool|null
-     */
    private static $canGetVendors;
-
-    /**
-     * @var array[]
-     * @psalm-var array<string, array{root: array{name: string, version: string, reference: string, pretty_version: string, aliases: string[], dev: bool, install_path: string, type: string}, versions: array<string, array{dev_requirement: bool, pretty_version?: string, version?: string, aliases?: string[], reference?: string, replaced?: string[], provided?: string[], install_path?: string, type?: string}>}>
-     */
    private static $installedByVendor = array();

    /**
--- a/lib/composer/installed.json
+++ b/lib/composer/installed.json
@@ -5311,17 +5311,17 @@
        },
        {
            "name": "twig/twig",
-            "version": "v3.4.2",
-            "version_normalized": "3.4.2.0",
+            "version": "v3.4.3",
+            "version_normalized": "3.4.3.0",
            "source": {
                "type": "git",
                "url": "https://github.com/twigphp/Twig.git",
-                "reference": "e07cdd3d430cd7e453c31b36eb5ad6c0c5e43077"
+                "reference": "c38fd6b0b7f370c198db91ffd02e23b517426b58"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/twigphp/Twig/zipball/e07cdd3d430cd7e453c31b36eb5ad6c0c5e43077",
-                "reference": "e07cdd3d430cd7e453c31b36eb5ad6c0c5e43077",
+                "url": "https://api.github.com/repos/twigphp/Twig/zipball/c38fd6b0b7f370c198db91ffd02e23b517426b58",
+                "reference": "c38fd6b0b7f370c198db91ffd02e23b517426b58",
                "shasum": ""
            },
            "require": {
@@ -5333,7 +5333,7 @@
                "psr/container": "^1.0",
                "symfony/phpunit-bridge": "^4.4.9|^5.0.9|^6.0"
            },
-            "time": "2022-08-12T06:47:24+00:00",
+            "time": "2022-09-28T08:42:51+00:00",
            "type": "library",
            "extra": {
                "branch-alias": {
@@ -5374,7 +5374,7 @@
            ],
            "support": {
                "issues": "https://github.com/twigphp/Twig/issues",
-                "source": "https://github.com/twigphp/Twig/tree/v3.4.2"
+                "source": "https://github.com/twigphp/Twig/tree/v3.4.3"
            },
            "funding": [
                {
--- a/lib/composer/installed.php
+++ b/lib/composer/installed.php
@@ -5,7 +5,7 @@
        'type' => 'project',
        'install_path' => __DIR__ . '/../../',
        'aliases' => array(),
-        'reference' => '64d9eef7c926f98aa1aabe61294397be308dd885',
+        'reference' => '1cac1890774b4defa212a142f88348f2f8743f4c',
        'name' => 'combodo/itop',
        'dev' => true,
    ),
@@ -25,7 +25,7 @@
            'type' => 'project',
            'install_path' => __DIR__ . '/../../',
            'aliases' => array(),
-            'reference' => '64d9eef7c926f98aa1aabe61294397be308dd885',
+            'reference' => '1cac1890774b4defa212a142f88348f2f8743f4c',
            'dev_requirement' => false,
        ),
        'combodo/tcpdf' => array(
@@ -717,12 +717,12 @@
            'dev_requirement' => false,
        ),
        'twig/twig' => array(
-            'pretty_version' => 'v3.4.2',
-            'version' => '3.4.2.0',
+            'pretty_version' => 'v3.4.3',
+            'version' => '3.4.3.0',
            'type' => 'library',
            'install_path' => __DIR__ . '/../twig/twig',
            'aliases' => array(),
-            'reference' => 'e07cdd3d430cd7e453c31b36eb5ad6c0c5e43077',
+            'reference' => 'c38fd6b0b7f370c198db91ffd02e23b517426b58',
            'dev_requirement' => false,
        ),
        'webmozart/assert' => array(
--- a/lib/twig/twig/.gitattributes
+++ b/lib/twig/twig/.gitattributes
@@ -1,4 +1,4 @@
-/doc/** export-ignore
-/extra/** export-ignore
-/tests export-ignore
+/doc/ export-ignore
+/extra/ export-ignore
+/tests/ export-ignore
 /phpunit.xml.dist export-ignore
--- a/lib/twig/twig/.github/workflows/documentation.yml
+++ b/lib/twig/twig/.github/workflows/documentation.yml
@@ -4,6 +4,7 @@ on:
    pull_request:
    push:
        branches:
+            - '2.x'
            - '3.x'

 permissions:
@@ -19,32 +20,32 @@ jobs:
            -   name: "Checkout code"
                uses: actions/checkout@v2

-            -   name: "Set up Python 3.7"
-                uses: actions/setup-python@v1
+            -   name: "Set-up PHP"
+                uses: shivammathur/setup-php@v2
                with:
-                    python-version: '3.7' # Semantic version range syntax or exact version of a Python version
+                    php-version: 8.1
+                    coverage: none
+                    tools: "composer:v2"

-            -   name: "Display Python version"
-                run: python -c "import sys; print(sys.version)"
+            -   name: Get composer cache directory
+                id: composercache
+                working-directory: doc/_build
+                run: echo "::set-output name=dir::$(composer config cache-files-dir)"

-            -   name: "Install Sphinx dependencies"
-                run: sudo apt-get install python-dev build-essential
-
-            -   name: "Cache pip"
+            -   name: Cache dependencies
                uses: actions/cache@v2
                with:
-                    path: ~/.cache/pip
-                    key: ${{ runner.os }}-pip-${{ hashFiles('_build/.requirements.txt') }}
-                    restore-keys: |
-                        ${{ runner.os }}-pip-
+                    path: ${{ steps.composercache.outputs.dir }}
+                    key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
+                    restore-keys: ${{ runner.os }}-composer-

-            -   name: "Install Sphinx + requirements via pip"
-                working-directory: "doc"
-                run: pip install -r _build/.requirements.txt
+            -   name: "Install dependencies"
+                working-directory: doc/_build
+                run: composer install --prefer-dist --no-progress

-            -   name: "Build documentation"
-                working-directory: "doc"
-                run: make -C _build SPHINXOPTS="-nqW -j auto" html
+            -   name: "Build the docs"
+                working-directory: doc/_build
+                run: php build.php --disable-cache

    doctor-rst:
        name: "DOCtor-RST"
--- a/lib/twig/twig/.gitignore
+++ b/lib/twig/twig/.gitignore
@@ -1,3 +1,5 @@
+/doc/_build/vendor
+/doc/_build/output
 /composer.lock
 /phpunit.xml
 /vendor
--- a/lib/twig/twig/CHANGELOG
+++ b/lib/twig/twig/CHANGELOG
@@ -1,3 +1,7 @@
+# 3.4.3 (2022-09-28)
+
+ * Fix a security issue on filesystem loader (possibility to load a template outside a configured directory)
+
 # 3.4.2 (2022-08-12)

 * Allow inherited magic method to still run with calling class
--- a/lib/twig/twig/src/Environment.php
+++ b/lib/twig/twig/src/Environment.php
@@ -38,11 +38,11 @@ use Twig\TokenParser\TokenParserInterface;
 */
 class Environment
 {
-    public const VERSION = '3.4.2';
-    public const VERSION_ID = 30402;
+    public const VERSION = '3.4.3';
+    public const VERSION_ID = 30403;
    public const MAJOR_VERSION = 3;
    public const MINOR_VERSION = 4;
-    public const RELEASE_VERSION = 2;
+    public const RELEASE_VERSION = 3;
    public const EXTRA_VERSION = '';

    private $charset;
--- a/lib/twig/twig/src/Loader/FilesystemLoader.php
+++ b/lib/twig/twig/src/Loader/FilesystemLoader.php
@@ -183,9 +183,9 @@ class FilesystemLoader implements LoaderInterface
        }

        try {
-            $this->validateName($name);
-
            list($namespace, $shortname) = $this->parseName($name);
+
+            $this->validateName($shortname);
        } catch (LoaderError $e) {
            if (!$throw) {
                return null;