Add unit test

trigger a notice if an incorrect modifier was used (E.g.|escape:quotes vs |escape:quote).

CHANGELOG.md

@@ -6,11 +6,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+- modifier escape now triggers a E_USER_NOTICE when an unsupported escape type is used https://github.com/smarty-php/smarty/pull/649
+
+### Fixed
+- Fixed render crash when using inline include with a string template https://github.com/smarty-php/smarty/issues/639
+
 ## [3.1.39] - 2021-02-17
 
 ### Security
-- Prevent access to `$smarty.template_object` in sandbox mode
-- Fixed code injection vulnerability by using illegal function names in `{function name='blah'}{/function}` 
+- Prevent access to `$smarty.template_object` in sandbox mode. This addresses CVE-2021-26119.
+- Fixed code injection vulnerability by using illegal function names in `{function name='blah'}{/function}`. This addresses CVE-2021-26120.
 
 ## [3.1.38] - 2021-01-08
 

SECURITY.md

@@ -0,0 +1,19 @@
+# Security Policy
+
+## Supported Versions
+
+Smarty currently supports the latest minor version of Smarty 3 and Smarty 4. (Smarty 4 has not been released yet.)
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 4.0.x   | :white_check_mark: |
+| 3.1.x   | :white_check_mark: |
+| < 3.1   | :x:                |
+
+## Reporting a Vulnerability
+
+ If you have discovered a security issue with Smarty, please contact us at mail [at] simonwisselink.nl. Do not 
+ disclose your findings publicly and PLEASE PLEASE do not file an Issue.
+ 
+We will try to confirm the vulnerability and develop a fix if appropriate. When we release the fix, we will publish 
+a security release. Please let us know if you want to be credited.

libs/plugins/modifier.escape.php

@@ -250,6 +250,7 @@ function smarty_modifier_escape($string, $esc_type = 'html', $char_set = null, $
             }
             return $return;
         default:
+            trigger_error("escape: unsupported type: $esc_type - returning unmodified string", E_USER_NOTICE);
             return $string;
     }
 }

libs/sysplugins/smarty_internal_template.php

@@ -317,7 +317,7 @@ class Smarty_Internal_Template extends Smarty_Internal_TemplateBase
                 $tpl->template_resource = $template;
                 $tpl->cache_id = $cache_id;
                 $tpl->compile_id = $compile_id;
-                if (isset($uid)) {
+                if (isset($uid) && isset($tpl->compiled->file_dependency[ $uid ])) {
                     // for inline templates we can get all resource information from file dependency
                     list($filepath, $timestamp, $type) = $tpl->compiled->file_dependency[ $uid ];
                     $tpl->source = new Smarty_Template_Source($smarty, $filepath, $type, $filepath);

tests/UnitTests/TemplateSource/TagTests/Include/CompileIncludeTest.php

@@ -324,4 +324,12 @@ class CompileIncludeTest extends PHPUnit_Smarty
                      array("A{include file='include_spacing3.tpl'}B\nC", "AbarB\nC", '3_Newline3', $i++),
         );
     }
+
+	/**
+	 * Test Inline Include with string template
+	 */
+	public function testInlineStringInclude()
+	{
+		$this->assertEquals('include-inline', $this->smarty->fetch('inline_string_include.tpl'));
+	}
 }

tests/UnitTests/TemplateSource/TagTests/Include/templates/inline_string_include.tpl

@@ -0,0 +1 @@
+{include "string:include-inline" inline}