Add unit test

trigger a notice if an incorrect modifier was used (E.g.|escape:quotes vs |escape:quote).

CHANGELOG.md

@@ -6,11 +6,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+- modifier escape now triggers a E_USER_NOTICE when an unsupported escape type is used https://github.com/smarty-php/smarty/pull/649
+
+### Fixed
+- Fixed render crash when using inline include with a string template https://github.com/smarty-php/smarty/issues/639
+
 ## [3.1.39] - 2021-02-17
 
 ### Security
-- Prevent access to `$smarty.template_object` in sandbox mode
-- Fixed code injection vulnerability by using illegal function names in `{function name='blah'}{/function}` 
+- Prevent access to `$smarty.template_object` in sandbox mode. This addresses CVE-2021-26119.
+- Fixed code injection vulnerability by using illegal function names in `{function name='blah'}{/function}`. This addresses CVE-2021-26120.
 
 ## [3.1.38] - 2021-01-08
 

SECURITY.md

@@ -0,0 +1,19 @@
+# Security Policy
+
+## Supported Versions
+
+Smarty currently supports the latest minor version of Smarty 3 and Smarty 4. (Smarty 4 has not been released yet.)
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 4.0.x   | :white_check_mark: |
+| 3.1.x   | :white_check_mark: |
+| < 3.1   | :x:                |
+
+## Reporting a Vulnerability
+
+ If you have discovered a security issue with Smarty, please contact us at mail [at] simonwisselink.nl. Do not 
+ disclose your findings publicly and PLEASE PLEASE do not file an Issue.
+ 
+We will try to confirm the vulnerability and develop a fix if appropriate. When we release the fix, we will publish 
+a security release. Please let us know if you want to be credited.

libs/plugins/modifier.escape.php

@@ -250,6 +250,7 @@ function smarty_modifier_escape($string, $esc_type = 'html', $char_set = null, $
             }
             return $return;
         default:
+            trigger_error("escape: unsupported type: $esc_type - returning unmodified string", E_USER_NOTICE);
             return $string;
     }
 }

libs/sysplugins/smarty_internal_resource_file.php

@@ -37,8 +37,7 @@ class Smarty_Internal_Resource_File extends Smarty_Resource
                 $source->filepath . ($source->isConfig ? $source->smarty->_joined_config_dir :
                     $source->smarty->_joined_template_dir)
             );
-            // When not doing compile_check, set timestamp to true
-            $source->timestamp = $source->smarty->compile_check ? filemtime($source->filepath) : true;
+            $source->timestamp = filemtime($source->filepath);
         } else {
             $source->timestamp = $source->exists = false;
         }
@@ -51,10 +50,6 @@ class Smarty_Internal_Resource_File extends Smarty_Resource
      */
     public function populateTimestamp(Smarty_Template_Source $source)
     {
-        if (!$source->smarty->compile_check) {
-            $source->timestamp =  $source->exists = true;
-            return;
-        }
         if (!$source->exists) {
             $source->timestamp = $source->exists = is_file($source->filepath);
         }
@@ -73,15 +68,13 @@ class Smarty_Internal_Resource_File extends Smarty_Resource
      */
     public function getContent(Smarty_Template_Source $source)
     {
-        if (($source->smarty->compile_check && !$source->exists)
-            || false === ($content = file_get_contents($source->filepath))
-        ) {
-            throw new SmartyException(
-                'Unable to read ' . ($source->isConfig ? 'config' : 'template') .
-                " {$source->type} '{$source->name}'"
-            );
+        if ($source->exists) {
+            return file_get_contents($source->filepath);
         }
-        return $content;
+        throw new SmartyException(
+            'Unable to read ' . ($source->isConfig ? 'config' : 'template') .
+            " {$source->type} '{$source->name}'"
+        );
     }
 
     /**
@@ -133,17 +126,6 @@ class Smarty_Internal_Resource_File extends Smarty_Resource
             $file = str_replace(DIRECTORY_SEPARATOR === '/' ? '\\' : '/', DIRECTORY_SEPARATOR, $file);
         }
         $_directories = $source->smarty->getTemplateDir(null, $source->isConfig);
-
-        // If possible, assume the file exists when compile_check = false;
-        if (!$source->smarty->compile_check
-            && count($_directories) == 1    // if there are multiple directories, we'll have to scan them
-            && $file[ 0 ] !== '['           // template_dir index
-            && !$source->smarty->use_include_path // cannot optimize when we need to use include path
-        ) {
-            $path = reset($_directories) . $file;
-            return (strpos($path, '.' . DIRECTORY_SEPARATOR) !== false) ? $source->smarty->_realpath($path) : $path;
-        }
-
         // template_dir index?
         if ($file[ 0 ] === '[' && preg_match('#^\[([^\]]+)\](.+)$#', $file, $fileMatch)) {
             $file = $fileMatch[ 2 ];
@@ -175,7 +157,6 @@ class Smarty_Internal_Resource_File extends Smarty_Resource
                 $_directories = $_index_dirs;
             }
         }
-
         // relative file name?
         foreach ($_directories as $_directory) {
             $path = $_directory . $file;

libs/sysplugins/smarty_internal_template.php

@@ -317,7 +317,7 @@ class Smarty_Internal_Template extends Smarty_Internal_TemplateBase
                 $tpl->template_resource = $template;
                 $tpl->cache_id = $cache_id;
                 $tpl->compile_id = $compile_id;
-                if (isset($uid)) {
+                if (isset($uid) && isset($tpl->compiled->file_dependency[ $uid ])) {
                     // for inline templates we can get all resource information from file dependency
                     list($filepath, $timestamp, $type) = $tpl->compiled->file_dependency[ $uid ];
                     $tpl->source = new Smarty_Template_Source($smarty, $filepath, $type, $filepath);

libs/sysplugins/smarty_template_compiled.php

@@ -74,14 +74,9 @@ class Smarty_Template_Compiled extends Smarty_Template_Resource_Base
             $this->filepath .= '.cache';
         }
         $this->filepath .= '.php';
-
-        if ($smarty->compile_check) {
-            $this->timestamp = $this->exists = is_file($this->filepath);
-            if ($this->exists) {
-                $this->timestamp = filemtime($this->filepath);
-            }
-        } else {
-            $this->timestamp = $this->exists = true;
+        $this->timestamp = $this->exists = is_file($this->filepath);
+        if ($this->exists) {
+            $this->timestamp = filemtime($this->filepath);
         }
     }
 
@@ -140,9 +135,8 @@ class Smarty_Template_Compiled extends Smarty_Template_Resource_Base
         if ($source->handler->recompiled) {
             $source->handler->process($_smarty_tpl);
         } elseif (!$source->handler->uncompiled) {
-            if (
-                $smarty->force_compile ||
-                ($_smarty_tpl->compile_check && (!$this->exists || ($source->getTimeStamp() > $this->getTimeStamp())))
+            if (!$this->exists || $smarty->force_compile
+                || ($_smarty_tpl->compile_check && $source->getTimeStamp() > $this->getTimeStamp())
             ) {
                 $this->compileTemplateSource($_smarty_tpl);
                 $compileCheck = $_smarty_tpl->compile_check;

tests/UnitTests/TemplateSource/TagTests/Include/CompileIncludeTest.php

@@ -324,4 +324,12 @@ class CompileIncludeTest extends PHPUnit_Smarty
                      array("A{include file='include_spacing3.tpl'}B\nC", "AbarB\nC", '3_Newline3', $i++),
         );
     }
+
+	/**
+	 * Test Inline Include with string template
+	 */
+	public function testInlineStringInclude()
+	{
+		$this->assertEquals('include-inline', $this->smarty->fetch('inline_string_include.tpl'));
+	}
 }

tests/UnitTests/TemplateSource/TagTests/Include/templates/inline_string_include.tpl

@@ -0,0 +1 @@
+{include "string:include-inline" inline}