Merge branch 'release/5.8.2'

{html_image} already escaped alt and pass-through attributes, but emitted
file, path_prefix, href/link, width and height raw, letting an untrusted
value break out of the generated tag. Escape these at output time; the
unescaped values are still used for getimagesize()/DPI math. Escaping uses
htmlspecialchars with double_encode=false, so existing entities and values
like "100%" are preserved (no BC break for legitimate values).

{html_select_date} treated day_size/month_size/year_size as strings and
emitted them raw into size="…"; cast them to int to match
{html_select_time} and close the breakout.

The remaining flagged parameters (mailto extra; html_table *_attr/
trailpad/caption/loop; html_radios/html_checkboxes separator;
html_select_* *_extra/field_separator and the unrecognised-attribute
pass-through) intentionally emit raw markup as documented, so escaping
them would break backwards compatibility. Add a security note to those
docs pages instead, telling authors to escape untrusted values themselves.

Adds tests for html_image escaping (incl. benign-value/no-double-encode
checks) and the html_select_date size cast.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

AGENTS.md

@@ -1,9 +1,13 @@
 # AGENTS.md
 
+This file is the single source of truth for AI coding assistants working in this repo (including Claude Code, claude.ai/code).
+
 ## Project
 
 Smarty v5 — PHP template engine. Single Composer package (`smarty/smarty`), namespace `Smarty\`, source in `src/`, autoloaded via PSR-4. Supports PHP 7.2–8.5.
 
+Do not use PHP syntax newer than 7.2 in `src/` unless it is guarded for older runtimes.
+
 ## Commands
 
 ```bash
@@ -59,6 +63,7 @@ After editing a `.plex` or `.y` file, run `make -B` to regenerate. The generator
 - All tests extend `PHPUnit_Smarty` (defined in `tests/PHPUnit_Smarty.php`), which provides `setUpSmarty($dir)`.
 - Test suite root: `tests/UnitTests/`. Typical test `setUp()` calls `$this->setUpSmarty(__DIR__)`.
 - Each test directory may have its own `templates/`, `configs/` subdirectories. Compiled output goes to `templates_c/` and `cache/` (auto-created by the test harness).
+- Running the suite scatters generated `templates_c/`, `cache/`, and `templates_tmp/` directories (and empty runtime `templates/`/`configs/` dirs) throughout `tests/` and the repo root. These are not tracked — treat them as noise in `git status`, never commit them, and clean them with `git clean -fd` (exclude tool dirs like `.serena`).
 - Three test files are excluded in `phpunit.xml`: Memcache, APC, and HttpModifiedSince tests (require external services).
 - Tests needing MySQL/PDO are gated by constants in `tests/Config.php` (disabled by default).
 
@@ -73,3 +78,10 @@ Markdown in `docs/`, built with mkdocs + Material theme. Preview: `mkdocs serve`
 ## Release
 
 `./make-release.sh <version>` — only v5.x.x. Updates changelog and version constant, creates a merge commit and tag on `master`.
+
+### Changelog
+
+Every change that should appear in `CHANGELOG.md` must add a new markdown file under `changelog/`. At release time `utilities/update-changelog.php` concatenates all `changelog/*.md` files into the `## [Unreleased]` section, so:
+
+- One file per change, containing a single line that starts with a dash (`- ...`). The filename is arbitrary; name it after the issue number (e.g. `1036.md`) when there is one, otherwise use a short descriptive slug.
+- Include a markdown link to the relevant issue when one exists, e.g. `[#1036](https://github.com/smarty-php/smarty/issues/1036)`. Omit the link when there is no public issue (e.g. embargoed security reports).

CHANGELOG.md

@@ -6,6 +6,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [5.8.2] - 2026-06-24
+- Security: prevent symlinks inside a trusted `secure_dir`/template directory from being used to read files outside of it (CWE-22 path traversal), affecting `{include}` and `{fetch}` of local files
+- Security: `{html_image}` now escapes the `file`, `path_prefix`, `href`/`link`, `width` and `height` attributes (it already escaped `alt` and pass-through attributes), and `{html_select_date}` casts `day_size`/`month_size`/`year_size` to int (matching `{html_select_time}`), preventing untrusted values passed into these attributes from breaking out of the generated HTML (CWE-79)
+- Security: `{fetch}` no longer follows HTTP redirects for remote resources while a security policy is active, preventing an open redirect on a trusted host from bypassing `trusted_uri` (CWE-918 server-side request forgery)
+- Fixed "Attempt to assign property step on null" error when using a {for} loop inside a block of an extended template [#1036](https://github.com/smarty-php/smarty/issues/1036)
+
+
+## [5.8.1] - 2026-06-23
+- Re-activated unit tests for user literals, which were previously disabled due to a bug in refactoring to v5.
+- fixed a bug where child template's block content leaked into subsequent rendering of the parent template [#1189](https://github.com/smarty-php/smarty/issues/1189)
+- Moved all unit test-generated output from inside the working tree to tmp files [#1178](https://github.com/smarty-php/smarty/issues/1178)
+
+
 ## [5.8.0] - 2026-02-15
 - Added support for Backed Enums for php versions >= 8.1 [#1171](https://github.com/smarty-php/smarty/pull/1171)
 - Added support for new 'matches' operator doing regex matching [#1169](https://github.com/smarty-php/smarty/pull/1169)

TODO.txt

@@ -11,10 +11,10 @@
 ## include inline
 - Re-introduce merge_compiled_includes and the {include inline} attribute?
 
-## Output buffering
-- Fix ob_ output buffering commands being scattered around the codebase
+## Output buffering (major)
+- Fix ob_ output buffering commands being scattered around the codebase: Smarty's output model is fundamentally "echo everything, wrap in a buffer to capture". An alternative that would be where rendering returns a string rather than echoing — but that touches the entire compiled template format (the unifunc functions all echo) and is a large change.
 
-## Review public static vars
+## Review public static vars (major)
 - such as _CHARSET and _IS_WINDOWS
 
 ## Block / inheritance
@@ -24,9 +24,8 @@
 ## Plugin system
 - fix template security checks in one place in compiler
 
-## Beatify output
+## Beatify output (major)
 - compiled templates could be proper classes, possibly using [nette/php-generator](https://packagist.org/packages/nette/php-generator)
 
 ## Unrelated / other
 - review (and avoid) use of 'clone' keyword
-- what is 'user literal support', why are unit tests skipped?

changelog/1179.md

@@ -1 +0,0 @@
-- Moved all unit test-generated output from inside the working tree to tmp files [#1178](https://github.com/smarty-php/smarty/issues/1178)

docs/designers/language-custom-functions/language-function-html-checkboxes.md

@@ -27,6 +27,13 @@ which item(s) are selected by default as well.
 -   All parameters that are not in the list above are printed as
     name/value-pairs inside each of the created <input\>-tags.
 
+> **Security note**
+>
+> The `separator` attribute is written into the generated HTML without escaping,
+> so it can contain markup such as `separator='<br />'`. If its value originates
+> from untrusted input, escape it yourself first to avoid cross-site scripting
+> (XSS). Option values and labels are escaped automatically.
+
 ## Examples
 ```php
 <?php

docs/designers/language-custom-functions/language-function-html-radios.md

@@ -28,6 +28,13 @@ selected by default as well.
 -   All parameters that are not in the list above are output as
     name/value-pairs inside each of the created `<input>`-tags.
 
+> **Security note**
+>
+> The `separator` attribute is written into the generated HTML without escaping,
+> so it can contain markup such as `separator='<br />'`. If its value originates
+> from untrusted input, escape it yourself first to avoid cross-site scripting
+> (XSS). Option values and labels are escaped automatically.
+
 ## Examples
 
 ```php

docs/designers/language-custom-functions/language-function-html-select-date.md

@@ -47,6 +47,14 @@ name/value-pairs inside the `<select>` tags of day, month and year.
 > There is an useful php function on the [date tips page](../../appendixes/tips.md)
 > for converting `{html_select_date}` form values to a timestamp.
 
+> **Security note**
+>
+> The `*_extra` attributes, `field_separator`/`option_separator`, and any
+> unrecognised parameter (which is emitted as a raw attribute on the `<select>`
+> tag) are written into the generated HTML without escaping. If any of these
+> values originate from untrusted input, escape them yourself first to avoid
+> cross-site scripting (XSS).
+
 ## Exaples
 
 Template code

docs/designers/language-custom-functions/language-function-html-select-time.md

@@ -47,6 +47,14 @@ parseable by PHP's [`strtotime()`](https://www.php.net/strtotime).
 | meridian\_empty       | null                                                   | If supplied then the first element of the meridian's select-box has this value as it's label and "" as it's value. This is useful to make the select-box read "Please select an meridian" for example.                                                                                                                                                                                   |
 
 
+> **Security note**
+>
+> The `*_extra` attributes, `field_separator`/`option_separator`, and any
+> unrecognised parameter (which is emitted as a raw attribute on the `<select>`
+> tag) are written into the generated HTML without escaping. If any of these
+> values originate from untrusted input, escape them yourself first to avoid
+> cross-site scripting (XSS).
+
 ## Examples
 
 ```smarty

docs/designers/language-custom-functions/language-function-html-table.md

@@ -31,6 +31,15 @@ dumps an array of data into an HTML `<table>`.
 -   `trailpad` is the value put into the trailing cells on the last
     table row if there are any present.
 
+> **Security note**
+>
+> The `loop`/`cols` data and the `caption`, `trailpad`, `table_attr`, `tr_attr`,
+> `td_attr` and `th_attr` attributes are written into the generated HTML without
+> escaping (this is by design — e.g. `table_attr='border="1"'`). If any of these
+> values originate from untrusted input, escape them yourself first (e.g. with the
+> [`escape`](../language-modifiers/language-modifier-escape.md) modifier) to avoid
+> cross-site scripting (XSS).
+
 ## Examples
 
 ```php

docs/designers/language-custom-functions/language-function-mailto.md

@@ -24,6 +24,14 @@ spiders to lift email addresses off of a site.
 > you can use hex encoding too.
 
 
+> **Security note**
+>
+> The `extra` attribute is written into the generated `<a>` tag without escaping,
+> so that you can add attributes such as `extra='class="mailto"'`. If you pass a
+> value that originates from untrusted input, escape it yourself first (e.g. with
+> the [`escape`](../language-modifiers/language-modifier-escape.md) modifier) to
+> avoid cross-site scripting (XSS).
+
 ## Examples
 
 ```smarty

phpunit.xml

@@ -20,7 +20,6 @@
         <testsuite name="foo">
             <directory>./tests/UnitTests/</directory>
             <exclude>./tests/UnitTests/CacheResourceTests/Memcache/CacheResourceCustomMemcacheTest.php</exclude>
-            <exclude>./tests/UnitTests/CacheResourceTests/Apc/CacheResourceCustomApcTest.php</exclude>
             <exclude>./tests/UnitTests/CacheModify/ModifiedSince/HttpModifiedSinceTest.php</exclude>
         </testsuite>
     </testsuites>

src/Cacheresource/File.php

@@ -143,7 +143,7 @@ class File extends Base
      *
      * @param Template $_template template object
      *
-     * @return string  content
+     * @return string|false content
      */
     public function retrieveCachedContent(Template $_template)
     {

src/Compile/Tag/ForTag.php

@@ -51,8 +51,9 @@ class ForTag extends Base {
 					$var = $_statement['var'];
 					$index = '';
 				}
-				$output .= "\$_smarty_tpl->assign($var, null);\n";
-				$output .= "\$_smarty_tpl->tpl_vars[$var]->value{$index} = {$_statement['value']};\n";
+				$itemVar = "\$_smarty_tpl->getVariable({$var})";
+				$output .= "\$_smarty_tpl->assign($var, []);\n";
+				$output .= "{$itemVar}->value{$index} = {$_statement['value']};\n";
 			}
 			if (is_array($_attr['var'])) {
 				$var = $_attr['var']['var'];
@@ -61,7 +62,8 @@ class ForTag extends Base {
 				$var = $_attr['var'];
 				$index = '';
 			}
-			$output .= "if ($_attr[ifexp]) {\nfor (\$_foo=true;$_attr[ifexp]; \$_smarty_tpl->tpl_vars[$var]->value{$index}$_attr[step]) {\n";
+			$itemVar = "\$_smarty_tpl->getVariable({$var})";
+			$output .= "if ($_attr[ifexp]) {\nfor (\$_foo=true;$_attr[ifexp]; {$itemVar}->value{$index}$_attr[step]) {\n";
 		} else {
 			$_statement = $_attr['start'];
 			if (is_array($_statement['var'])) {
@@ -71,21 +73,22 @@ class ForTag extends Base {
 				$var = $_statement['var'];
 				$index = '';
 			}
-			$output .= "\$_smarty_tpl->assign($var, null);";
+			$itemVar = "\$_smarty_tpl->getVariable({$var})";
+			$output .= "\$_smarty_tpl->assign($var, []);";
 			if (isset($_attr['step'])) {
-				$output .= "\$_smarty_tpl->tpl_vars[$var]->step = $_attr[step];";
+				$output .= "{$itemVar}->step = $_attr[step];";
 			} else {
-				$output .= "\$_smarty_tpl->tpl_vars[$var]->step = 1;";
+				$output .= "{$itemVar}->step = 1;";
 			}
 			if (isset($_attr['max'])) {
-				$output .= "\$_smarty_tpl->tpl_vars[$var]->total = (int) min(ceil((\$_smarty_tpl->tpl_vars[$var]->step > 0 ? $_attr[to]+1 - ($_statement[value]) : $_statement[value]-($_attr[to])+1)/abs(\$_smarty_tpl->tpl_vars[$var]->step)),$_attr[max]);\n";
+				$output .= "{$itemVar}->total = (int) min(ceil(({$itemVar}->step > 0 ? $_attr[to]+1 - ($_statement[value]) : $_statement[value]-($_attr[to])+1)/abs({$itemVar}->step)),$_attr[max]);\n";
 			} else {
-				$output .= "\$_smarty_tpl->tpl_vars[$var]->total = (int) ceil((\$_smarty_tpl->tpl_vars[$var]->step > 0 ? $_attr[to]+1 - ($_statement[value]) : $_statement[value]-($_attr[to])+1)/abs(\$_smarty_tpl->tpl_vars[$var]->step));\n";
+				$output .= "{$itemVar}->total = (int) ceil(({$itemVar}->step > 0 ? $_attr[to]+1 - ($_statement[value]) : $_statement[value]-($_attr[to])+1)/abs({$itemVar}->step));\n";
 			}
-			$output .= "if (\$_smarty_tpl->tpl_vars[$var]->total > 0) {\n";
-			$output .= "for (\$_smarty_tpl->tpl_vars[$var]->value{$index} = $_statement[value], \$_smarty_tpl->tpl_vars[$var]->iteration = 1;\$_smarty_tpl->tpl_vars[$var]->iteration <= \$_smarty_tpl->tpl_vars[$var]->total;\$_smarty_tpl->tpl_vars[$var]->value{$index} += \$_smarty_tpl->tpl_vars[$var]->step, \$_smarty_tpl->tpl_vars[$var]->iteration++) {\n";
-			$output .= "\$_smarty_tpl->tpl_vars[$var]->first = \$_smarty_tpl->tpl_vars[$var]->iteration === 1;";
-			$output .= "\$_smarty_tpl->tpl_vars[$var]->last = \$_smarty_tpl->tpl_vars[$var]->iteration === \$_smarty_tpl->tpl_vars[$var]->total;";
+			$output .= "if ({$itemVar}->total > 0) {\n";
+			$output .= "for ({$itemVar}->value{$index} = $_statement[value], {$itemVar}->iteration = 1;{$itemVar}->iteration <= {$itemVar}->total;{$itemVar}->value{$index} += {$itemVar}->step, {$itemVar}->iteration++) {\n";
+			$output .= "{$itemVar}->first = {$itemVar}->iteration === 1;";
+			$output .= "{$itemVar}->last = {$itemVar}->iteration === {$itemVar}->total;";
 		}
 		$output .= '?>';
 

src/FunctionHandler/Fetch.php

@@ -189,7 +189,22 @@ class Fetch extends Base {
 				return;
 			}
 		} else {
-			$content = @file_get_contents($params['file']);
+			if ($protocol && isset($template->getSmarty()->security_policy)) {
+				// Remote resource (e.g. https://) reached through file_get_contents().
+				// isTrustedUri() only validates the initial URL, but file_get_contents()
+				// follows redirects by default, so an open redirect on an otherwise
+				// trusted host could be used to reach a non-trusted target (SSRF).
+				// Disable redirect-following while a security policy is in effect.
+				$context = stream_context_create([
+					'http' => [
+						'follow_location' => 0,
+						'max_redirects' => 1,
+					],
+				]);
+				$content = @file_get_contents($params['file'], false, $context);
+			} else {
+				$content = @file_get_contents($params['file']);
+			}
 			if ($content === false) {
 				throw new Exception("{fetch} cannot read resource '" . $params['file'] . "'");
 			}

src/FunctionHandler/HtmlImage.php

@@ -65,7 +65,7 @@ class HtmlImage extends Base {
 					break;
 				case 'link':
 				case 'href':
-					$prefix = '<a href="' . $_val . '">';
+					$prefix = '<a href="' . smarty_function_escape_special_chars($_val) . '">';
 					$suffix = '</a>';
 					break;
 				default:
@@ -143,7 +143,12 @@ class HtmlImage extends Base {
 			$width = round($width * $_resize);
 			$height = round($height * $_resize);
 		}
-		return $prefix . '<img src="' . $path_prefix . $file . '" alt="' . $alt . '" width="' . $width . '" height="' .
-			$height . '"' . $extra . ' />' . $suffix;
+		// $alt and the pass-through attributes ($extra) are already escaped above;
+		// escape the remaining value-context params at output time so untrusted
+		// values cannot break out of the attribute (CWE-79). The unescaped $file/
+		// $width/$height are still used for getimagesize()/DPI math above.
+		return $prefix . '<img src="' . smarty_function_escape_special_chars($path_prefix . $file) . '" alt="' . $alt
+			. '" width="' . smarty_function_escape_special_chars($width) . '" height="'
+			. smarty_function_escape_special_chars($height) . '"' . $extra . ' />' . $suffix;
 	}
 }

src/FunctionHandler/HtmlSelectDate.php

@@ -120,9 +120,6 @@ class HtmlSelectDate extends Base {
 				case 'day_value_format':
 				case 'month_format':
 				case 'month_value_format':
-				case 'day_size':
-				case 'month_size':
-				case 'year_size':
 				case 'all_extra':
 				case 'day_extra':
 				case 'month_extra':
@@ -140,6 +137,13 @@ class HtmlSelectDate extends Base {
 				case 'year_id':
 					$$_key = (string)$_value;
 					break;
+				case 'day_size':
+				case 'month_size':
+				case 'year_size':
+					// numeric HTML size attribute; cast to int (consistent with
+					// html_select_time) so it cannot break out of size="…" (CWE-79)
+					$$_key = (int)$_value;
+					break;
 				case 'display_days':
 				case 'display_months':
 				case 'display_years':

src/Runtime/InheritanceRuntime.php

@@ -69,8 +69,12 @@ class InheritanceRuntime {
 	 * @param array $blockNames outer level block name
 	 */
 	public function init(Template $tpl, $initChild, $blockNames = []) {
-		// if called while executing parent template it must be a sub-template with new inheritance root
-		if ($initChild && $this->state === 3 && (strpos($tpl->template_resource, 'extendsall') === false)) {
+		// if called while executing parent template it must be a sub-template with new inheritance root.
+		// A new root is started either by a child template ($initChild) or by a sub-template included
+		// outside of any block rendering (empty source stack); the latter must not inherit the leftover
+		// block overrides of a previously completed inheritance tree (see issue #1189).
+		if (($initChild || empty($this->sourceStack)) && $this->state === 3
+			&& (strpos($tpl->template_resource, 'extendsall') === false)) {
 			$tpl->setInheritance(clone $tpl->getSmarty()->getRuntime('Inheritance'));
 			$tpl->getInheritance()->init($tpl, $initChild, $blockNames);
 			return;

src/Security.php

@@ -474,12 +474,34 @@ class Security {
 	 * @throws \Smarty\Exception
 	 */
 	private function _checkDir($filepath, $dirs) {
-		$directory = dirname($this->smarty->_realpath($filepath, true)) . DIRECTORY_SEPARATOR;
+		// Resolve the canonical, symlink-free path of the requested file so that
+		// a symlink located inside a trusted directory cannot be abused to read
+		// a file outside of it (CWE-22 path traversal). Smarty::_realpath() only
+		// normalizes the path as a string and does not follow symlinks, so we
+		// fall back to it only when the file does not yet exist on disk (e.g.
+		// config/cache paths that are validated before being written).
+		$realpath = @realpath($filepath);
+		$resolved = $realpath !== false ? $realpath : $this->smarty->_realpath($filepath, true);
+		$directory = dirname($resolved) . DIRECTORY_SEPARATOR;
+
+		// Canonicalize the trusted directories the same way. This keeps
+		// legitimate symlinked deployment paths working (e.g. a Capistrano-style
+		// "current" release symlink, or macOS' /var -> /private/var): both the
+		// file and the trusted directories are compared after symlinks have been
+		// resolved.
+		$trusted = [];
+		foreach ($dirs as $dir => $unused) {
+			$trusted[$dir] = true;
+			if (($dirRealpath = @realpath($dir)) !== false) {
+				$trusted[rtrim($dirRealpath, '\\/') . DIRECTORY_SEPARATOR] = true;
+			}
+		}
+
 		$_directory = [];
 		if (!preg_match('#[\\\\/][.][.][\\\\/]#', $directory)) {
 			while (true) {
 				// test if the directory is trusted
-				if (isset($dirs[$directory])) {
+				if (isset($trusted[$directory])) {
 					return $_directory;
 				}
 				// abort if we've reached root

src/Smarty.php

@@ -54,7 +54,7 @@ class Smarty extends \Smarty\TemplateBase {
 	/**
 	 * smarty version
 	 */
-	const SMARTY_VERSION = '5.8.0';
+	const SMARTY_VERSION = '5.8.2';
 
 	/**
 	 * define caching modes

tests/UnitTests/Compiler/Delimiter/UserLiteralTest.php

@@ -17,11 +17,7 @@ class UserliteralTest extends PHPUnit_Smarty
 {
     public function setUp(): void
     {
-        if (!property_exists('Smarty', 'literals')) {
-            $this->markTestSkipped('user literal support');
-        } else {
-            $this->setUpSmarty(__DIR__);
-        }
+        $this->setUpSmarty(__DIR__);
     }
 
 

tests/UnitTests/ResourceTests/Eval/EvalResourceTest.php

@@ -65,15 +65,6 @@ class EvalResourceTest extends PHPUnit_Smarty
         $this->assertEquals('', $this->smarty->fetch($tpl));
     }
 
-    /**
-     * test usesCompiler
-     */
-    public function testUsesCompiler()
-    {
-        $tpl = $this->smarty->createTemplate('eval:hello world');
-        $this->markTestIncomplete();
-    }
-
     /**
      * test isEvaluated
      */

tests/UnitTests/ResourceTests/File/FileResourceTest.php

@@ -86,12 +86,6 @@ class FileResourceTest extends PHPUnit_Smarty
         $this->assertEquals('hello world', $tpl->getSource()->getContent());
     }
 
-    public function testUsesCompiler()
-    {
-        $tpl = $this->smarty->createTemplate('helloworld.tpl');
-	    $this->markTestIncomplete();
-    }
-
     public function testIsEvaluated()
     {
         $tpl = $this->smarty->createTemplate('helloworld.tpl');

tests/UnitTests/ResourceTests/Stream/StreamResourceTest.php

@@ -60,15 +60,6 @@ class StreamResourceTest extends PHPUnit_Smarty
         $this->assertEquals('hello world {$foo}', $tpl->getSource()->getContent());
     }
 
-    /**
-     * test usesCompiler
-     */
-    public function testUsesCompiler()
-    {
-        $tpl = $this->smarty->createTemplate('global:mytest');
-	    $this->markTestIncomplete();
-    }
-
     /**
      * test isEvaluated
      */

tests/UnitTests/ResourceTests/String/StringResourceTest.php

@@ -73,15 +73,6 @@ class StringResourceTest extends PHPUnit_Smarty
         $this->assertEquals('hello world{$foo}', $tpl->getSource()->getContent());
     }
 
-    /**
-     * test usesCompiler
-     */
-    public function testUsesCompiler()
-    {
-        $tpl = $this->smarty->createTemplate('string:hello world');
-	    $this->markTestIncomplete();
-    }
-
     /**
      * test isEvaluated
      */

tests/UnitTests/SecurityTests/SecurityTest.php

@@ -256,6 +256,83 @@ class SecurityTest extends PHPUnit_Smarty
 		);
 		$this->assertEquals("templates_3", $this->smarty->fetch('string:{include file="templates_3/dirname.tpl"}'));
 	}
+
+	/**
+	 * A symlink located inside a trusted secure_dir must not be usable to read
+	 * a file outside of it (CWE-22 path traversal via symlink).
+	 */
+	public function testSymlinkEscapeFromSecureDirIsRejected()
+	{
+		[$secureDir, $outsideFile] = $this->createSymlinkFixture('secret-outside-content');
+		$link = $secureDir . DIRECTORY_SEPARATOR . 'finance_doc';
+		if (!@symlink($outsideFile, $link)) {
+			$this->markTestSkipped('Unable to create symlinks on this platform');
+		}
+
+		$this->smarty->security_policy->secure_dir = array($secureDir . DIRECTORY_SEPARATOR);
+
+		$this->expectException(\Smarty\Exception::class);
+		$this->expectExceptionMessage('not trusted file path');
+		$this->smarty->fetch('string:{include file="' . $link . '"}');
+	}
+
+	/**
+	 * A symlink that stays inside the trusted secure_dir must keep working, so
+	 * legitimate (e.g. deployment) symlinks are not broken by the fix above.
+	 */
+	public function testSymlinkWithinSecureDirIsAllowed()
+	{
+		[$secureDir] = $this->createSymlinkFixture('secret-outside-content');
+		$target = $secureDir . DIRECTORY_SEPARATOR . 'real.tpl';
+		file_put_contents($target, 'inside-content');
+		$link = $secureDir . DIRECTORY_SEPARATOR . 'linked.tpl';
+		if (!@symlink($target, $link)) {
+			$this->markTestSkipped('Unable to create symlinks on this platform');
+		}
+
+		$this->smarty->security_policy->secure_dir = array($secureDir . DIRECTORY_SEPARATOR);
+
+		$this->assertEquals('inside-content', $this->smarty->fetch('string:{include file="' . $link . '"}'));
+	}
+
+	/**
+	 * Builds a temporary directory tree for the symlink tests: a (canonicalized)
+	 * secure directory plus a file located outside of it. The tree is removed in
+	 * tearDown(). Returns [secureDir, outsideFile].
+	 */
+	private function createSymlinkFixture(string $outsideContent): array
+	{
+		$base = sys_get_temp_dir() . DIRECTORY_SEPARATOR . 'smarty_symlink_' . getmypid() . '_' . uniqid();
+		$secureDir = $base . DIRECTORY_SEPARATOR . 'secure';
+		mkdir($secureDir, 0777, true);
+		$outsideFile = $base . DIRECTORY_SEPARATOR . 'outside.txt';
+		file_put_contents($outsideFile, $outsideContent);
+
+		// Canonicalize so secure_dir is symlink-free (sys_get_temp_dir() itself
+		// may sit under a symlink, e.g. /var -> /private/var on macOS).
+		$this->symlinkFixtureDir = realpath($base);
+		return array(realpath($secureDir), realpath($outsideFile));
+	}
+
+	protected function tearDown(): void
+	{
+		if (!empty($this->symlinkFixtureDir) && is_dir($this->symlinkFixtureDir)) {
+			$it = new \RecursiveIteratorIterator(
+				new \RecursiveDirectoryIterator($this->symlinkFixtureDir, \FilesystemIterator::SKIP_DOTS),
+				\RecursiveIteratorIterator::CHILD_FIRST
+			);
+			foreach ($it as $entry) {
+				($entry->isDir() && !$entry->isLink()) ? rmdir($entry->getPathname()) : unlink($entry->getPathname());
+			}
+			rmdir($this->symlinkFixtureDir);
+			$this->symlinkFixtureDir = null;
+		}
+		parent::tearDown();
+	}
+
+	/** @var string|null temp dir created by createSymlinkFixture(), removed in tearDown */
+	private $symlinkFixtureDir = null;
+
 	/**
 	 * test template file exits
 	 *

tests/UnitTests/SmartyMethodsTests/RegisterModifier/RegisterModifierFirstClassCallablesTest.php

@@ -1,50 +1,52 @@
 <?php
-// first class callables where introduced in PHP 8.1
-if (PHP_VERSION_ID >= 80100) {
 
-	/**
-	 * class for register modifier with (first class) callables tests
-	 *
-	 * @runTestsInSeparateProcess
-	 * @preserveGlobalState disabled
-	 * @backupStaticAttributes enabled
-	 */
-	class RegisterModifierFirstClassCallablesTest extends PHPUnit_Smarty
+/**
+ * class for register modifier with (first class) callables tests
+ *
+ * @runTestsInSeparateProcess
+ * @preserveGlobalState disabled
+ * @backupStaticAttributes enabled
+ */
+class RegisterModifierFirstClassCallablesTest extends PHPUnit_Smarty
+{
+	public function setUp(): void
 	{
-		public function setUp(): void
-		{
-			$this->setUpSmarty(__DIR__);
+		// First-class callable syntax (Closure::fromCallable shorthand) requires PHP 8.1+
+		if (PHP_VERSION_ID < 80100) {
+			$this->markTestSkipped('First-class callables require PHP >= 8.1');
 		}
-
-
-
-		public function testRegisterFirstClassCallable()
-		{
-			$this->smarty->registerPlugin(\Smarty\Smarty::PLUGIN_MODIFIER, 'testmodifier', eval('return strrev(...);'));
-			$this->assertEquals('mosredna', $this->smarty->fetch('string:{"andersom"|testmodifier}'));
-		}
-
-		public function testRegisterFirstClassCallableSameName()
-		{
-			$this->smarty->registerPlugin(\Smarty\Smarty::PLUGIN_MODIFIER, 'mymodifier', eval('return strrev(...);'));
-			$this->assertEquals('mosredna', $this->smarty->fetch('string:{"andersom"|mymodifier}'));
-		}
-
-		public function testRegisterFirstClassCallableAsFunc()
-		{
-			$this->smarty->registerPlugin(\Smarty\Smarty::PLUGIN_MODIFIER, 'kprint_r_out', eval('return strrev(...);'));
-			$this->smarty->assign('myVar', 'andersom');
-			$this->assertEquals('mosredna', $this->smarty->fetch('string:{kprint_r_out($myVar)}'));
-		}
-
-		public function testRegisterFirstClassCallableSameNameAsPhpFunc()
-		{
-			$this->smarty->registerPlugin(\Smarty\Smarty::PLUGIN_MODIFIER, 'mymodifierfcc', eval('return strrev(...);'));
-			$this->assertEquals('mosredna', $this->smarty->fetch('string:{mymodifierfcc("andersom")}'));
-		}
-
+		$this->setUpSmarty(__DIR__);
 	}
+
+
+
+	public function testRegisterFirstClassCallable()
+	{
+		$this->smarty->registerPlugin(\Smarty\Smarty::PLUGIN_MODIFIER, 'testmodifier', eval('return strrev(...);'));
+		$this->assertEquals('mosredna', $this->smarty->fetch('string:{"andersom"|testmodifier}'));
+	}
+
+	public function testRegisterFirstClassCallableSameName()
+	{
+		$this->smarty->registerPlugin(\Smarty\Smarty::PLUGIN_MODIFIER, 'mymodifier', eval('return strrev(...);'));
+		$this->assertEquals('mosredna', $this->smarty->fetch('string:{"andersom"|mymodifier}'));
+	}
+
+	public function testRegisterFirstClassCallableAsFunc()
+	{
+		$this->smarty->registerPlugin(\Smarty\Smarty::PLUGIN_MODIFIER, 'kprint_r_out', eval('return strrev(...);'));
+		$this->smarty->assign('myVar', 'andersom');
+		$this->assertEquals('mosredna', $this->smarty->fetch('string:{kprint_r_out($myVar)}'));
+	}
+
+	public function testRegisterFirstClassCallableSameNameAsPhpFunc()
+	{
+		$this->smarty->registerPlugin(\Smarty\Smarty::PLUGIN_MODIFIER, 'mymodifierfcc', eval('return strrev(...);'));
+		$this->assertEquals('mosredna', $this->smarty->fetch('string:{mymodifierfcc("andersom")}'));
+	}
+
 }
+
 function mymodifierfcc($a, $b, $c)
 {
 	return "$a function $b $c";

tests/UnitTests/TemplateSource/TagTests/For/CompileForTest.php

@@ -191,4 +191,45 @@ class CompileForTest extends PHPUnit_Smarty
                      array("{for \$x=-1;\$x>=0;\$x--}{\$x}{forelse}{\$buh}{/for}", "buh", 'T14', $i++),
         );
     }
+
+    /**
+     * Test {for} inside an inheritance (extends) template.
+     *
+     * The {for} tag pokes loop bookkeeping (step, total, value, ...) directly
+     * onto its loop Variable. In an extended template the child block renders
+     * with SCOPE_PARENT, so the loop variable is assigned to the parent and was
+     * not resolvable locally, causing 'assign property on null'.
+     *
+     * @see https://github.com/smarty-php/smarty/issues/1036
+     *
+     * @dataProvider dataForInheritance
+     */
+    public function testForInheritance($code, $result, $testName, $caching)
+    {
+        $this->smarty->caching = $caching;
+        $tpl = $this->smarty->createTemplate($code);
+        $this->assertEquals($result, $this->smarty->fetch($tpl), "test - {$testName}");
+    }
+
+    public function dataForInheritance()
+    {
+        $parent = 'extends:string:{block name="content"}{/block}';
+        $cases = array(
+            array('to',     '{for $i=0 to 3}{$i}{/for}',                      '0123'),
+            array('step',   '{for $i=0 to 3 step 2}{$i}{/for}',               '02'),
+            array('max',    '{for $i=0 to 30 max=3}{$i}{/for}',               '012'),
+            array('nested', '{for $i=0 to 1}{for $y=0 to 3}{$y}{/for}{/for}', '01230123'),
+            array('legacy', '{for $i=0; $i<4; $i++}{$i}{/for}',               '0123'),
+        );
+        $data = array();
+        foreach (array(false, true) as $caching) {
+            foreach ($cases as $case) {
+                $code = $parent . '|string:{block name="content"}' . $case[1] . '{/block}';
+                $name = $case[0] . ($caching ? ' (caching)' : '');
+                $data[] = array($code, $case[2], $name, $caching);
+            }
+        }
+        return $data;
+    }
+
 }

tests/UnitTests/TemplateSource/TagTests/PluginFunction/PluginFunctionFetchTest.php

@@ -64,4 +64,93 @@ class PluginFunctionFetchTest extends PHPUnit_Smarty
 		$this->smarty->fetch('string:{fetch file="/templates/../etc/passwd"}');
 	}
 
+	/**
+	 * When a security policy is in effect, {fetch} of a remote resource must not
+	 * follow redirects, otherwise an open redirect on a trusted host could be
+	 * used to bypass trusted_uri and reach an internal target (SSRF, CWE-918).
+	 */
+	public function testFetchRemoteDisablesRedirectsUnderSecurity()
+	{
+		FetchContextCaptureStreamWrapper::$capturedOptions = null;
+		stream_wrapper_register('ssrftest', FetchContextCaptureStreamWrapper::class);
+		try {
+			$this->smarty->enableSecurity();
+			$this->smarty->security_policy->trusted_uri[] = '/^ssrftest:\/\/allowed$/';
+
+			$result = $this->smarty->fetch('string:{fetch file="ssrftest://allowed/data"}');
+
+			$this->assertSame('BODY', $result);
+			$this->assertIsArray(FetchContextCaptureStreamWrapper::$capturedOptions);
+			$this->assertArrayHasKey('http', FetchContextCaptureStreamWrapper::$capturedOptions);
+			$this->assertSame(0, FetchContextCaptureStreamWrapper::$capturedOptions['http']['follow_location']);
+			$this->assertLessThanOrEqual(1, FetchContextCaptureStreamWrapper::$capturedOptions['http']['max_redirects']);
+		} finally {
+			stream_wrapper_unregister('ssrftest');
+		}
+	}
+
+	/**
+	 * Without a security policy there is no trusted_uri to bypass, so the
+	 * redirect-disabling stream context is not applied (backwards compatible).
+	 */
+	public function testFetchRemoteKeepsDefaultBehaviorWithoutSecurity()
+	{
+		FetchContextCaptureStreamWrapper::$capturedOptions = null;
+		stream_wrapper_register('ssrftest', FetchContextCaptureStreamWrapper::class);
+		try {
+			$result = $this->smarty->fetch('string:{fetch file="ssrftest://allowed/data"}');
+
+			$this->assertSame('BODY', $result);
+			$this->assertSame([], FetchContextCaptureStreamWrapper::$capturedOptions);
+		} finally {
+			stream_wrapper_unregister('ssrftest');
+		}
+	}
+
+}
+
+/**
+ * Minimal custom stream wrapper used by the fetch SSRF tests: it records the
+ * stream context options that {fetch} passes to file_get_contents() and returns
+ * a fixed body so the call succeeds without touching the network.
+ */
+class FetchContextCaptureStreamWrapper
+{
+	/** @var resource|null populated by PHP when a context is passed */
+	public $context;
+
+	/** @var array|null options captured from the context on the last open */
+	public static $capturedOptions = null;
+
+	private $read = false;
+
+	public function stream_open($path, $mode, $options, &$opened_path)
+	{
+		self::$capturedOptions = isset($this->context) ? stream_context_get_options($this->context) : [];
+		return true;
+	}
+
+	public function stream_read($count)
+	{
+		if ($this->read) {
+			return '';
+		}
+		$this->read = true;
+		return 'BODY';
+	}
+
+	public function stream_eof()
+	{
+		return $this->read;
+	}
+
+	public function stream_stat()
+	{
+		return [];
+	}
+
+	public function url_stat($path, $flags)
+	{
+		return [];
+	}
 }

tests/UnitTests/TemplateSource/TagTests/PluginFunction/PluginFunctionHtmlImageTest.php

@@ -0,0 +1,79 @@
+<?php
+/**
+ * Smarty PHPunit tests of the {html_image} function plugin
+ */
+
+/**
+ * class for {html_image} tests
+ */
+class PluginFunctionHtmlImageTest extends PHPUnit_Smarty
+{
+    public function setUp(): void
+    {
+        $this->setUpSmarty(__DIR__);
+        $this->smarty->setErrorReporting(E_ALL & ~E_DEPRECATED);
+    }
+
+    public function testInit()
+    {
+        $this->assertTrue($this->smarty instanceof \Smarty\Smarty);
+    }
+
+    /**
+     * Passing both width and height skips the getimagesize() lookup, so no real
+     * image file is needed to render the tag.
+     */
+    private function render($params)
+    {
+        $tpl = $this->smarty->createTemplate('eval:{html_image file=$file width=$width height=$height href=$href path_prefix=$path_prefix}');
+        $tpl->assign($params + [
+            'file'        => 'pic.jpg',
+            'width'       => 44,
+            'height'      => 68,
+            'href'        => '',
+            'path_prefix' => '',
+        ]);
+        return $tpl->fetch();
+    }
+
+    public function testHrefIsEscaped()
+    {
+        $result = $this->render(['href' => '"><script>alert(1)</script>']);
+        $this->assertStringNotContainsString('<script>', $result);
+        $this->assertStringContainsString('&lt;script&gt;', $result);
+    }
+
+    public function testWidthIsEscaped()
+    {
+        $result = $this->render(['width' => '44" onload="alert(1)']);
+        $this->assertStringNotContainsString('onload="', $result);
+        $this->assertStringContainsString('&quot;', $result);
+    }
+
+    public function testHeightIsEscaped()
+    {
+        $result = $this->render(['height' => '68" onmouseover="alert(1)']);
+        $this->assertStringNotContainsString('onmouseover="', $result);
+    }
+
+    public function testFileAndPathPrefixAreEscaped()
+    {
+        $result = $this->render(['file' => 'pic.jpg"><script>alert(1)</script>', 'path_prefix' => '"><b>']);
+        $this->assertStringNotContainsString('<script>', $result);
+        $this->assertStringNotContainsString('<b>', $result);
+    }
+
+    /**
+     * Benign values must be unchanged (no breakage, no double-encoding of an
+     * ampersand already present in a URL).
+     */
+    public function testBenignValuesAreUnchanged()
+    {
+        $result = $this->render(['width' => 44, 'height' => 68, 'href' => 'detail.php?id=1&page=2']);
+        $this->assertStringContainsString('width="44"', $result);
+        $this->assertStringContainsString('height="68"', $result);
+        $this->assertStringContainsString('src="pic.jpg"', $result);
+        $this->assertStringContainsString('href="detail.php?id=1&amp;page=2"', $result);
+        $this->assertStringNotContainsString('&amp;amp;', $result);
+    }
+}

tests/UnitTests/TemplateSource/TagTests/PluginFunction/PluginFunctionHtmlSelectDateTest.php

@@ -630,4 +630,25 @@ class PluginFunctionHtmlSelectDateTest extends PHPUnit_Smarty
         $tpl->assign('date_array', $date_array);
         $this->assertEquals($result, $tpl->fetch());
     }
+
+    /**
+     * year_size/month_size/day_size are numeric HTML size attributes and must be
+     * cast to int (like html_select_time), so a value cannot break out of size="…".
+     */
+    public function testSizeAttributesCannotBreakOut()
+    {
+        $tpl = $this->smarty->createTemplate('eval:{html_select_date time=$time year_size=$size}');
+        $tpl->assign('time', mktime(0, 0, 0, 1, 1, 2010));
+        $tpl->assign('size', '2"><script>alert(1)</script>');
+        $result = $tpl->fetch();
+        $this->assertStringNotContainsString('<script>', $result);
+        $this->assertStringContainsString('size="2"', $result);
+    }
+
+    public function testBenignSizeAttributeIsKept()
+    {
+        $tpl = $this->smarty->createTemplate('eval:{html_select_date time=$time year_size=3}');
+        $tpl->assign('time', mktime(0, 0, 0, 1, 1, 2010));
+        $this->assertStringContainsString('size="3"', $tpl->fetch());
+    }
 }

tests/UnitTests/TemplateSource/_Issues/1189/IncludeExtendsBlockLeakIssue1189Test.php

@@ -0,0 +1,33 @@
+<?php
+/**
+ * Smarty PHPunit test reproducing issue #1189.
+ *
+ * When a parent template is {include}d, then a child template that {extends}
+ * the parent overrides a {block}, a subsequent {include} of the parent in the
+ * same render must still show the parent's block content.
+ *
+ * The block override from the extending child must not leak into the later
+ * include of the parent template.
+ *
+ * @see https://github.com/smarty-php/smarty/issues/1189
+ *
+ * @preserveGlobalState    disabled
+ */
+class IncludeExtendsBlockLeakIssue1189Test extends PHPUnit_Smarty
+{
+    public function setUp(): void
+    {
+        $this->setUpSmarty(__DIR__);
+    }
+
+    /**
+     * Sequence: include parent -> include child(extends parent) -> include parent.
+     * Expected: PARENT CHILD PARENT
+     * Bug (#1189): PARENT CHILD CHILD
+     */
+    public function testBlockOverrideDoesNotLeakIntoLaterParentInclude()
+    {
+        $result = $this->smarty->fetch('top.tpl');
+        $this->assertSame('PARENT CHILD PARENT', preg_replace('/\s+/', ' ', trim($result)));
+    }
+}

tests/UnitTests/TemplateSource/_Issues/1189/templates/child.tpl

@@ -0,0 +1,2 @@
+{extends file="parent.tpl"}
+{block name=message}CHILD{/block}

tests/UnitTests/TemplateSource/_Issues/1189/templates/parent.tpl

@@ -0,0 +1 @@
+{block name=message}PARENT{/block}

tests/UnitTests/TemplateSource/_Issues/1189/templates/top.tpl

@@ -0,0 +1 @@
+{include file="parent.tpl"} {include file="child.tpl"} {include file="parent.tpl"}