Fix double semicolon in getRightDelimiter method (#1202)

The built-in stream: resource type let a template bypass Security stream
restrictions. BasePlugin::load() matches the 'stream' sysplugin before the
stream_get_wrappers()/isTrustedStream() check, so a resource such as
stream:php://filter/read=convert.base64-encode/resource=/path was opened by
StreamPlugin::getContent() via fopen() on the nested php:// wrapper without
ever validating it. This bypassed Security::$streams (including
Security::$streams = null) and allowed reading arbitrary local files.

Parse the wrapper scheme from the resolved path in StreamPlugin::getContent()
and validate it with Security::isTrustedStream() before fopen(), giving the
stream: resource the same check the direct wrapper path already receives.

Adds regression tests covering the disabled-streams bypass, the
not-on-allowlist case, and a positive test that an explicitly allowed wrapper
still works.

CHANGELOG.md

@@ -6,6 +6,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [5.8.4] - 2026-06-29
+- Fixed a `TypeError` on PHP 8 when `Security::$static_classes` was set to a non-array value (e.g. the string `'none'`) to disable static class access; any non-array value now cleanly denies access. Use `Security::$static_classes = null` to disable access to all static classes.
+- Security: the built-in `stream:` resource type now validates the nested stream wrapper against the security policy, so a template such as `stream:php://filter/...` can no longer bypass `Security::$streams` (including `Security::$streams = null`) to read local files (CWE-22)
+
+
 ## [5.8.3] - 2026-06-28
 - fixed a regression from #1189 where a child template's block override no longer applied to a template {include}d by the parent [#1192](https://github.com/smarty-php/smarty/issues/1192)
 

changelog/security-stream-resource-wrapper-bypass.md

@@ -1 +0,0 @@
-- Security: the built-in `stream:` resource type now validates the nested stream wrapper against the security policy, so a template such as `stream:php://filter/...` can no longer bypass `Security::$streams` (including `Security::$streams = null`) to read local files (CWE-22)

docker-compose.yml

@@ -1,4 +1,3 @@
-version: "2"
 services:
   base:
     build:

src/Security.php

@@ -52,7 +52,7 @@ class Security {
 	/**
 	 * This is an array of trusted static classes.
 	 * If empty access to all static classes is allowed.
-	 * If set to 'none' none is allowed.
+	 * To disable access to all static classes set $static_classes = null.
 	 *
 	 * @var array
 	 */
@@ -206,7 +206,11 @@ class Security {
 	 * @return boolean                 true if class is trusted
 	 */
 	public function isTrustedStaticClass($class_name, $compiler) {
-		if (isset($this->static_classes)
+		// Only an array enables access: an empty array allows all classes, a
+		// populated array is an allowlist. Any other value (null, or the
+		// documented "none") denies all. Using is_array() rather than isset()
+		// also avoids a PHP 8 TypeError from passing a non-array to in_array().
+		if (is_array($this->static_classes)
 			&& (empty($this->static_classes) || in_array($class_name, $this->static_classes))
 		) {
 			return true;

src/Smarty.php

@@ -54,7 +54,7 @@ class Smarty extends \Smarty\TemplateBase {
 	/**
 	 * smarty version
 	 */
-	const SMARTY_VERSION = '5.8.3';
+	const SMARTY_VERSION = '5.8.4';
 
 	/**
 	 * define caching modes

src/Template.php

@@ -535,7 +535,7 @@ class Template extends TemplateBase {
 	 */
 	public function getRightDelimiter()
 	{
-		return $this->right_delimiter ?? $this->getSmarty()->getRightDelimiter();;
+		return $this->right_delimiter ?? $this->getSmarty()->getRightDelimiter();
 	}
 
 	/**

tests/UnitTests/SecurityTests/SecurityTest.php

@@ -243,6 +243,39 @@ class SecurityTest extends PHPUnit_Smarty
 		$this->smarty->fetch('string:{$smarty.template_object::square(5)}');
 	}
 
+	/**
+	 * The default (empty array) allows access to all static classes. Documents
+	 * the backwards-compatible behaviour.
+	 */
+	public function testStaticClassAllowedByDefault()
+	{
+		$this->smarty->security_policy->static_classes = array();
+		$this->assertEquals('25', $this->smarty->fetch('string:{mysecuritystaticclass::square(5)}'));
+	}
+
+	/**
+	 * Setting static_classes to null disables access to all static classes.
+	 */
+	public function testStaticClassDeniedWhenNull()
+	{
+		$this->expectException(\Smarty\Exception::class);
+		$this->expectExceptionMessage("access to static class 'mysecuritystaticclass' not allowed by security setting");
+		$this->smarty->security_policy->static_classes = null;
+		$this->smarty->fetch('string:{mysecuritystaticclass::square(5)}');
+	}
+
+	/**
+	 * Regression: a non-array value such as the string 'none' must deny access
+	 * cleanly instead of raising a PHP 8 TypeError from in_array().
+	 */
+	public function testStaticClassDeniedWhenNonArray()
+	{
+		$this->expectException(\Smarty\Exception::class);
+		$this->expectExceptionMessage("access to static class 'mysecuritystaticclass' not allowed by security setting");
+		$this->smarty->security_policy->static_classes = 'none';
+		$this->smarty->fetch('string:{mysecuritystaticclass::square(5)}');
+	}
+
 	public function testChangedTrustedDirectory()
 	{
 		$this->smarty->security_policy->secure_dir = array(