TwigSandboxPolicy
class TwigSandboxPolicy implements Twig_Sandbox_SecurityPolicyInterface (View source)
Default sandbox policy for Twig templates.
Twig's sandbox extension is usually used to evaluate untrusted code by limiting access to potentially unsafe properties or methods. Since we do not use ViewModels when passing objects to Twig templates, we limit what those objects can do by whitelisting certain classes, method names, and method names with an allowed prefix. All object properties may be accessed.
Properties
| protected array | $whitelisted_methods | An array of whitelisted methods in the form of methodName => TRUE. |
|
| protected array | $whitelisted_prefixes | An array of whitelisted method prefixes -- any method starting with one of these prefixes will be allowed. |
|
| protected array | $whitelisted_classes | An array of class names for which any method calls are allowed. |
Methods
Constructs a new TwigSandboxPolicy object.
{@inheritdoc}
{@inheritdoc}
{@inheritdoc}
Details
__construct()
Constructs a new TwigSandboxPolicy object.
checkSecurity($tags, $filters, $functions)
{@inheritdoc}
checkPropertyAllowed($obj, $property)
{@inheritdoc}
checkMethodAllowed($obj, $method)
{@inheritdoc}