Skip to content
This repository has been archived by the owner on Sep 29, 2019. It is now read-only.

Fixed: some strings and arrays in the context can break the template rendering due to PHP callables #5

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

CamaroSS
Copy link
Contributor

PHP can recognize an array or a string as a callable, causing unwanted changes to the template rendering process.
Example:

$template = new Template('Hello, {{ username }}!');
$context = new Context(['username' => 'Max']);
echo $template->render($context);

Expected:
Hello, Max!

Got:
Hello, !

It happens because 'max' is a function name in PHP, and is_callable('max') evaluates to true.
We have to be more strict here.

@idlesign
Copy link
Owner

Thank you.
Yeah, that looks like a security hole also.
We need to extend tests with that case to verify all goes fine.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants