Fix sandbox bypass in object destructuring assignment

alexandre-daubois · alexandre-daubois · commit 3fe13f98f890 · 2026-04-28T12:59:06.000+02:00
diff --git a/src/Node/Expression/Binary/ObjectDestructuringSetBinary.php b/src/Node/Expression/Binary/ObjectDestructuringSetBinary.php
@@ -13,6 +13,7 @@
 
 use Twig\Compiler;
 use Twig\Error\SyntaxError;
+use Twig\Extension\SandboxExtension;
 use Twig\Node\Expression\AbstractExpression;
 use Twig\Node\Expression\ArrayExpression;
 use Twig\Node\Expression\Variable\ContextVariable;
@@ -64,7 +65,7 @@ public function compile(Compiler $compiler): void
             if ($i) {
                 $compiler->raw(', ');
             }
-            $compiler->raw('CoreExtension::getAttribute($this->env, $this->source, ')->subcompile($this->getNode('right'))->raw(', ')->repr($mapping['property'])->raw(', [], \\Twig\\Template::ANY_CALL, false, false, false, ')->repr($this->getNode('right')->getTemplateLine())->raw(')');
+            $compiler->raw('CoreExtension::getAttribute($this->env, $this->source, ')->subcompile($this->getNode('right'))->raw(', ')->repr($mapping['property'])->raw(', [], \\Twig\\Template::ANY_CALL, false, false, ')->repr($compiler->getEnvironment()->hasExtension(SandboxExtension::class))->raw(', ')->repr($this->getNode('right')->getTemplateLine())->raw(')');
         }
         $compiler->raw(']');
     }
diff --git a/tests/Extension/SandboxTest.php b/tests/Extension/SandboxTest.php
@@ -423,6 +423,40 @@ public function testSandboxAllowProperty()
         $this->assertEquals('bar', $twig->load('1_basic4')->render(self::$params), 'Sandbox allow some properties');
     }
 
+    public function testSandboxAllowDestructuring()
+    {
+        $template = '{% do {bar: x, foo: y} = obj %}{{ x }}-{{ y }}';
+        $twig = $this->getEnvironment(true, [], ['index' => $template], ['do'], [], ['Twig\Tests\Extension\FooObject' => 'foo'], ['Twig\Tests\Extension\FooObject' => 'bar']);
+        FooObject::reset();
+        $this->assertSame('bar-foo', $twig->load('index')->render(self::$params), 'Sandbox allows destructuring when properties and methods are allowed');
+    }
+
+    public function testSandboxUnallowedDestructuringProperty()
+    {
+        $template = '{% do {bar: x} = obj %}{{ x }}';
+        $twig = $this->getEnvironment(true, [], ['index' => $template], ['do']);
+        try {
+            $twig->load('index')->render(self::$params);
+            $this->fail('Sandbox throws a SecurityError exception if an unallowed property is read via destructuring');
+        } catch (SecurityNotAllowedPropertyError $e) {
+            $this->assertSame('Twig\Tests\Extension\FooObject', $e->getClassName());
+            $this->assertSame('bar', $e->getPropertyName());
+        }
+    }
+
+    public function testSandboxUnallowedDestructuringMethod()
+    {
+        $template = '{% do {foo: y} = obj %}{{ y }}';
+        $twig = $this->getEnvironment(true, [], ['index' => $template], ['do'], [], [], ['Twig\Tests\Extension\FooObject' => 'foo']);
+        try {
+            $twig->load('index')->render(self::$params);
+            $this->fail('Sandbox throws a SecurityError exception if an unallowed method is called via destructuring');
+        } catch (SecurityNotAllowedMethodError $e) {
+            $this->assertSame('Twig\Tests\Extension\FooObject', $e->getClassName());
+            $this->assertSame('foo', $e->getMethodName());
+        }
+    }
+
     public function testSandboxAllowFunction()
     {
         $twig = $this->getEnvironment(true, [], self::$templates, [], [], [], [], ['cycle']);

Original file line number	Diff line number	Diff line change
`@@ -13,6 +13,7 @@`
`13`	`13`
`14`	`14`	`use Twig\Compiler;`
`15`	`15`	`use Twig\Error\SyntaxError;`
	`16`	`+use Twig\Extension\SandboxExtension;`
`16`	`17`	`use Twig\Node\Expression\AbstractExpression;`
`17`	`18`	`use Twig\Node\Expression\ArrayExpression;`
`18`	`19`	`use Twig\Node\Expression\Variable\ContextVariable;`
`@@ -64,7 +65,7 @@ public function compile(Compiler $compiler): void`
`64`	`65`	`if ($i) {`
`65`	`66`	`$compiler->raw(', ');`
`66`	`67`	`}`
`67`		`- $compiler->raw('CoreExtension::getAttribute($this->env, $this->source, ')->subcompile($this->getNode('right'))->raw(', ')->repr($mapping['property'])->raw(', [], \\Twig\\Template::ANY_CALL, false, false, false, ')->repr($this->getNode('right')->getTemplateLine())->raw(')');`
	`68`	`+ $compiler->raw('CoreExtension::getAttribute($this->env, $this->source, ')->subcompile($this->getNode('right'))->raw(', ')->repr($mapping['property'])->raw(', [], \\Twig\\Template::ANY_CALL, false, false, ')->repr($compiler->getEnvironment()->hasExtension(SandboxExtension::class))->raw(', ')->repr($this->getNode('right')->getTemplateLine())->raw(')');`
`68`	`69`	`}`
`69`	`70`	`$compiler->raw(']');`
`70`	`71`	`}`