Sandbox security escalation allowing users to read configuration about twigbridge

[barryvdh]

Well we should probably fix that indeed. Not sure how though.

[bytestream]

@MaxKorlaar Thanks for logging this. If you have any thoughts on the below, please comment :)

@barryvdh We'd have to handle it here -

TwigBridge/src/Node/GetAttrNode.php

Line 132 in 2054abd

if (Template::METHOD_CALL !== $type and is_a($object, 'Illuminate\Database\Eloquent\Model')) {

It's been a while since I looked at this but could we not just change is_a($object, 'Illuminate\Database\Eloquent\Model') to $object instanceof ArrayAccess. The is_a code has been here pretty much sicne the beginning. I've just copied it around in my previous PRs.

Not sure why twigphp/Twig#1863 was rejected / closed which did what I'm suggesting. Possibly - twigphp/Twig#106 (comment)

[bytestream]

See #398

[bytestream]

I've decided to just override base_template_class when I'm using a security policy.

abstract class Template extends \Twig\Template
{
    /**
     * {@inheritdoc}
     */
    public function display(array $context, array $blocks = [])
    {
        \Twig\Template::display($context, $blocks);
    }
}