search

factorial-io / phabalicious

Supports your deployments and every-day devops-tasks
http://docs.phab.io
MIT License
18 stars 3 forks source link

fix(deps): update dependency twig/twig to v3.4.3 [security] #289

Closed renovate[bot] closed 1 year ago

renovate[bot] commented 1 year ago

Mend Renovate

This PR contains the following updates:

Package Type Update Change
twig/twig (source) require minor 3.3.8 -> 3.4.3

GitHub Vulnerability Alerts

CVE-2022-39261

Description

When using the filesystem loader to load templates for which the name is a user input, it is possible to use the source or include statement to read arbitrary files from outside the templates directory when using a namespace like @somewhere/../some.file (in such a case, validation is bypassed).

Resolution

We fixed validation for such template names.

Even if the 1.x branch is not maintained anymore, a new version has been released.

Credits

We would like to thank Dariusz Tytko for reporting the issue and Fabien Potencier for fixing the issue.

Release Notes

twigphp/Twig ### [`v3.4.3`](https://togithub.com/twigphp/Twig/blob/HEAD/CHANGELOG#​343-2022-09-28) [Compare Source](https://togithub.com/twigphp/Twig/compare/v3.4.2...v3.4.3) - Fix a security issue on filesystem loader (possibility to load a template outside a configured directory) ### [`v3.4.2`](https://togithub.com/twigphp/Twig/blob/HEAD/CHANGELOG#​342-2022-08-12) [Compare Source](https://togithub.com/twigphp/Twig/compare/v3.4.1...v3.4.2) - Allow inherited magic method to still run with calling class - Fix CallExpression::reflectCallable() throwing TypeError - Fix typo in naming (currency_code) ### [`v3.4.1`](https://togithub.com/twigphp/Twig/blob/HEAD/CHANGELOG#​341-2022-05-17) [Compare Source](https://togithub.com/twigphp/Twig/compare/v3.4.0...v3.4.1) - Fix optimizing non-public named closures ### [`v3.4.0`](https://togithub.com/twigphp/Twig/blob/HEAD/CHANGELOG#​340-2022-05-22) [Compare Source](https://togithub.com/twigphp/Twig/compare/v3.3.10...v3.4.0) - Add support for named closures ### [`v3.3.10`](https://togithub.com/twigphp/Twig/blob/HEAD/CHANGELOG#​3310-2022-04-06) [Compare Source](https://togithub.com/twigphp/Twig/compare/v3.3.9...v3.3.10) - Enable bytecode invalidation when auto_reload is enabled ### [`v3.3.9`](https://togithub.com/twigphp/Twig/blob/HEAD/CHANGELOG#​339-2022-03-25) [Compare Source](https://togithub.com/twigphp/Twig/compare/v3.3.8...v3.3.9) - Fix custom escapers when using multiple Twig environments - Add support for "constant('class', object)" - Do not reuse internally generated variable names during parsing

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

This PR has been generated by Mend Renovate. View repository job log here.