Fixed PHPUnit expected Exceptions.

.github/workflows/ci.yml

@@ -28,7 +28,6 @@ jobs:
           - "7.3"
           - "7.4"
           - "8.0"
-          - "8.1"
 
         compiler:
           - default

CHANGELOG.md

@@ -6,19 +6,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-### Added
-- PHP8.1 compatibility [#711](https://github.com/smarty-php/smarty/pull/711)
-
-## [4.0.4] - 2022-01-18
-
-### Fixed
-- Fixed illegal characters bug in math function security check [#702](https://github.com/smarty-php/smarty/issues/702)
-
-## [4.0.3] - 2022-01-10
-
-### Security
-- Prevent evasion of the `static_classes` security policy. This addresses CVE-2021-21408
-
 ## [4.0.2] - 2022-01-10
 
 ### Security

lexer/smarty_internal_templateparser.y

@@ -747,9 +747,6 @@ value(res)       ::= doublequoted_with_quotes(s). {
 
 
 value(res)    ::= varindexed(vi) DOUBLECOLON static_class_access(r). {
-    if ($this->security && $this->security->static_classes !== array()) {
-        $this->compiler->trigger_template_error('dynamic static class not allowed by security setting');
-    }
     $prefixVar = $this->compiler->getNewPrefixVariable();
     if (vi['var'] === '\'smarty\'') {
         $this->compiler->appendPrefixCode("<?php {$prefixVar} = ". $this->compiler->compileTag('private_special_variable',array(),vi['smarty_internal_index']).';?>');

libs/Smarty.class.php

@@ -98,7 +98,7 @@ class Smarty extends Smarty_Internal_TemplateBase
     /**
      * smarty version
      */
-    const SMARTY_VERSION = '4.0.4';
+    const SMARTY_VERSION = '4.0.2';
     /**
      * define variable scopes
      */

libs/plugins/function.math.php

@@ -70,7 +70,7 @@ function smarty_function_math($params, $template)
     $number = '(?:\d+(?:[,.]\d+)?|pi|π)'; // What is a number
     $functionsOrVars = '((?:0x[a-fA-F0-9]+)|([a-zA-Z_\x7f-\xff][a-zA-Z0-9_\x7f-\xff]*))';
     $operators = '[+\/*\^%-]'; // Allowed math operators
-    $regexp = '/^(('.$number.'|'.$functionsOrVars.'|('.$functionsOrVars.'\s*\((?1)+\)|\((?1)+\)))(?:'.$operators.'(?1))?)+$/';
+    $regexp = '/^(('.$number.'|'.$functionsOrVars.'|('.$functionsOrVars.'\s*\((?1)+\)|\((?1)+\)))(?:'.$operators.'(?2))?)+$/';
 
     if (!preg_match($regexp, $equation)) {
         trigger_error("math: illegal characters", E_USER_WARNING);

libs/sysplugins/smarty_internal_cacheresource_file.php

@@ -196,8 +196,8 @@ class Smarty_Internal_CacheResource_File extends Smarty_CacheResource
      */
     public function hasLock(Smarty $smarty, Smarty_Template_Cached $cached)
     {
-        clearstatcache(true, $cached->lock_id ?? '');
+        clearstatcache(true, $cached->lock_id);
-        if (null !== $cached->lock_id && is_file($cached->lock_id)) {
+        if (is_file($cached->lock_id)) {
             $t = filemtime($cached->lock_id);
             return $t && (time() - $t < $smarty->locking_timeout);
         } else {

libs/sysplugins/smarty_internal_compile_function.php

@@ -157,7 +157,7 @@ class Smarty_Internal_Compile_Functionclose extends Smarty_Internal_CompileBase
             $output = "<?php echo \"/*%%SmartyNocache:{$compiler->template->compiled->nocache_hash}%%*/<?php ";
             $output .= "\\\$_smarty_tpl->smarty->ext->_tplFunction->restoreTemplateVariables(\\\$_smarty_tpl, '{$_name}');?>\n";
             $output .= "/*/%%SmartyNocache:{$compiler->template->compiled->nocache_hash}%%*/\";\n?>";
-            $output .= "<?php echo str_replace('{$compiler->template->compiled->nocache_hash}', \$_smarty_tpl->compiled->nocache_hash ?? '', ob_get_clean());\n";
+            $output .= "<?php echo str_replace('{$compiler->template->compiled->nocache_hash}', \$_smarty_tpl->compiled->nocache_hash, ob_get_clean());\n";
             $output .= "}\n}\n";
             $output .= "/*/ {$_funcName}_nocache */\n\n";
             $output .= "?>\n";

libs/sysplugins/smarty_internal_config_file_compiler.php

@@ -158,7 +158,7 @@ class Smarty_Internal_Config_File_Compiler
         }
         // template header code
         $template_header =
-            "<?php /* Smarty version " . Smarty::SMARTY_VERSION . ", created on " . date("Y-m-d H:i:s") .
+            "<?php /* Smarty version " . Smarty::SMARTY_VERSION . ", created on " . strftime("%Y-%m-%d %H:%M:%S") .
             "\n";
         $template_header .= "         compiled from '{$this->template->source->filepath}' */ ?>\n";
         $code = '<?php $_smarty_tpl->smarty->ext->configLoad->_loadConfigVars($_smarty_tpl, ' .

libs/sysplugins/smarty_internal_runtime_codeframe.php

@@ -45,7 +45,7 @@ class Smarty_Internal_Runtime_CodeFrame
             $properties[ 'cache_lifetime' ] = $_template->cache_lifetime;
         }
         $output = "<?php\n";
-        $output .= "/* Smarty version {$properties[ 'version' ]}, created on " . date("Y-m-d H:i:s") .
+        $output .= "/* Smarty version {$properties[ 'version' ]}, created on " . strftime("%Y-%m-%d %H:%M:%S") .
                    "\n  from '" . str_replace('*/', '* /', $_template->source->filepath) . "' */\n\n";
         $output .= "/* @var Smarty_Internal_Template \$_smarty_tpl */\n";
         $dec = "\$_smarty_tpl->_decodeProperties(\$_smarty_tpl, " . var_export($properties, true) . ',' .

libs/sysplugins/smarty_internal_templatecompilerbase.php

@@ -1135,7 +1135,7 @@ abstract class Smarty_Internal_TemplateCompilerBase
             flush();
         }
         $e = new SmartyCompilerException($error_text);
-        $e->setLine($line);
+        $e->line = $line;
         $e->source = trim(preg_replace('![\t\r\n]+!', ' ', $match[ $line - 1 ]));
         $e->desc = $args;
         $e->template = $this->template->source->filepath;

libs/sysplugins/smarty_internal_templateparser.php

@@ -2397,9 +2397,6 @@ public static $yy_action = array(
     }
 // line 749 "../smarty/lexer/smarty_internal_templateparser.y"
     public function yy_r94(){
-	    if ($this->security && $this->security->static_classes !== array()) {
-		    $this->compiler->trigger_template_error('dynamic static class not allowed by security setting');
-	    }
     $prefixVar = $this->compiler->getNewPrefixVariable();
     if ($this->yystack[$this->yyidx + -2]->minor['var'] === '\'smarty\'') {
         $this->compiler->appendPrefixCode("<?php {$prefixVar} = ". $this->compiler->compileTag('private_special_variable',array(),$this->yystack[$this->yyidx + -2]->minor['smarty_internal_index']).';?>');

libs/sysplugins/smartycompilerexception.php

@@ -16,12 +16,11 @@ class SmartyCompilerException extends SmartyException
     }
 
     /**
-     * @param int $line
+     * The line number of the template error
+     *
+     * @type int|null
      */
-    public function setLine($line)
+    public $line = null;
-    {
-        $this->line = $line;
-    }
 
     /**
      * The template source snippet relating to the error

tests/UnitTests/CacheResourceTests/_shared/CacheResourceTestCommon.php

@@ -30,8 +30,7 @@ class CacheResourceTestCommon extends PHPUnit_Smarty
 
     public function compiledPrefilter($text, Smarty_Internal_Template $tpl)
     {
-        $replace = $tpl->getTemplateVars('test');
+        return str_replace('#', $tpl->getTemplateVars('test'), $text);
-        return str_replace('#', $replace ?? '', $text);
     }
 
     /**

tests/UnitTests/ResourceTests/Stream/StreamResourceTest.php

@@ -234,7 +234,7 @@ class ResourceStream
         $v = &$GLOBALS[$this->varname];
         $l = strlen($data);
         $p = &$this->position;
-        $v = substr($v ?? '', 0, $p) . $data . substr($v ?? '', $p += $l);
+        $v = substr($v, 0, $p) . $data . substr($v, $p += $l);
 
         return $l;
     }

tests/UnitTests/SecurityTests/SecurityTest.php

@@ -257,41 +257,19 @@ class SecurityTest extends PHPUnit_Smarty
         $this->assertEquals('25', $this->smarty->fetch($tpl));
     }
 
-	/**
+/**
-	 * test not trusted PHP function
+ * test not trusted PHP function
-	 * @runInSeparateProcess
+  * @runInSeparateProcess
-	 * @preserveGlobalState disabled
+  * @preserveGlobalState disabled
-	 */
+  */
-	public function testNotTrustedStaticClass()
+    public function testNotTrustedStaticClass()
-	{
+    {
         $this->expectException('SmartyException');
         $this->expectExceptionMessage('access to static class \'mysecuritystaticclass\' not allowed by security setting');
         $this->smarty->security_policy->static_classes = array('null');
         $this->smarty->fetch('string:{mysecuritystaticclass::square(5)}');
     }
 
-	/**
-	 * test not trusted PHP function
-	 */
-	public function testNotTrustedStaticClassEval()
-	{
-		$this->expectException('SmartyException');
-		$this->expectExceptionMessage('dynamic static class not allowed by security setting');
-		$this->smarty->security_policy->static_classes = array('null');
-		$this->smarty->fetch('string:{$test = "mysecuritystaticclass"}{$test::square(5)}');
-	}
-
-	/**
-	 * test not trusted PHP function
-	 */
-	public function testNotTrustedStaticClassSmartyVar()
-	{
-		$this->expectException('SmartyException');
-		$this->expectExceptionMessage('dynamic static class not allowed by security setting');
-		$this->smarty->security_policy->static_classes = array('null');
-		$this->smarty->fetch('string:{$smarty.template_object::square(5)}');
-	}
-
     public function testChangedTrustedDirectory()
     {
         $this->smarty->security_policy->secure_dir = array(
@@ -366,9 +344,9 @@ class SecurityTest extends PHPUnit_Smarty
 
     /**
      * In security mode, accessing $smarty.template_object should be illegal.
+     * @expectedException SmartyCompilerException
      */
     public function testSmartyTemplateObject() {
-        $this->expectException(SmartyCompilerException::class);
         $this->smarty->display('string:{$smarty.template_object}');
     }
 
@@ -416,7 +394,7 @@ class ResourceStreamSecurity
         $v = &$GLOBALS[$this->varname];
         $l = strlen($data);
         $p = &$this->position;
-        $v = substr($v ?? '', 0, $p) . $data . substr($v ?? '', $p += $l);
+        $v = substr($v, 0, $p) . $data . substr($v, $p += $l);
 
         return $l;
     }

tests/UnitTests/TemplateSource/TagTests/TemplateFunction/CompileFunctionTest.php

@@ -435,9 +435,9 @@ class CompileFunctionTest extends PHPUnit_Smarty
 
     /**
      * Test handling of function names that are a security risk
+     * @expectedException        SmartyCompilerException
      */
     public function testIllegalFunctionName() {
-        $this->expectException(SmartyCompilerException::class);
 	    $this->smarty->fetch('string:{function name=\'rce(){};echo "hi";function \'}{/function}');
     }
 

tests/UnitTests/TemplateSource/ValueTests/Math/MathTest.php

@@ -44,14 +44,6 @@ class MathTest extends PHPUnit_Smarty
         $this->assertEquals($expected, $this->smarty->fetch($tpl));
     }
 
-    public function testMultipleOperators()
-    {
-        $this->smarty->disableSecurity();
-        $expected = "2 -- 2";
-        $tpl = $this->smarty->createTemplate('eval:{$x = 5}{$y = 4}{math equation="x - y + 1" x=$x y=$y} -- {math equation="5 - 4 + 1"}');
-        $this->assertEquals($expected, $this->smarty->fetch($tpl));
-    }
-
     public function testSyntaxSin()
     {
         $this->smarty->disableSecurity();

tests/UnitTests/TemplateSource/ValueTests/Variables/Stream/StreamVariableTest.php

@@ -96,7 +96,7 @@ class VariableStream
         $v = &$GLOBALS[$this->varname];
         $l = strlen($data);
         $p = &$this->position;
-        $v = substr($v ?? '', 0, $p) . $data . substr($v ?? '', $p += $l);
+        $v = substr($v, 0, $p) . $data . substr($v, $p += $l);
 
         return $l;
     }