protected $safeAnalysis;
protected $traverser;
protected $defaultStrategy = false;
+ protected $safeVars = array();
public function __construct()
{
if ($env->hasExtension('escaper') && $defaultStrategy = $env->getExtension('escaper')->getDefaultStrategy($node->getAttribute('filename'))) {
$this->defaultStrategy = $defaultStrategy;
}
+ $this->safeVars = array();
} elseif ($node instanceof Twig_Node_AutoEscape) {
$this->statusStack[] = $node->getAttribute('value');
} elseif ($node instanceof Twig_Node_Block) {
$this->statusStack[] = isset($this->blocks[$node->getAttribute('name')]) ? $this->blocks[$node->getAttribute('name')] : $this->needEscaping($env);
+ } elseif ($node instanceof Twig_Node_Import) {
+ $this->safeVars[] = $node->getNode('var')->getAttribute('name');
}
return $node;
{
if ($node instanceof Twig_Node_Module) {
$this->defaultStrategy = false;
+ $this->safeVars = array();
} elseif ($node instanceof Twig_Node_Expression_Filter) {
return $this->preEscapeFilterNode($node, $env);
} elseif ($node instanceof Twig_Node_Print) {
if (null === $this->traverser) {
$this->traverser = new Twig_NodeTraverser($env, array($this->safeAnalysis));
}
+
+ $this->safeAnalysis->setSafeVars($this->safeVars);
+
$this->traverser->traverse($expression);
$safe = $this->safeAnalysis->getSafe($expression);
}
class Twig_NodeVisitor_SafeAnalysis implements Twig_NodeVisitorInterface
{
protected $data = array();
+ protected $safeVars = array();
+
+ public function setSafeVars($safeVars)
+ {
+ $this->safeVars = $safeVars;
+ }
public function getSafe(Twig_NodeInterface $node)
{
} else {
$this->setSafe($node, array());
}
+ } elseif ($node instanceof Twig_Node_Expression_GetAttr && $node->getNode('node') instanceof Twig_Node_Expression_Name) {
+ $name = $node->getNode('node')->getAttribute('name');
+ // attributes on template instances are safe
+ if ('_self' == $name || in_array($name, $this->safeVars)) {
+ $this->setSafe($node, array('all'));
+ } else {
+ $this->setSafe($node, array());
+ }
} else {
$this->setSafe($node, array());
}