Added some unit test to study consistent behavior on passing argument by reference.

* clean output buffer for Throwable instead of just Exception

.github/workflows/ci.yml

@@ -65,9 +65,5 @@ jobs:
         restore-keys: |
           Smartyv3-${{ runner.os }}-php-${{ matrix.php-version }}-
 
-    - name: Install dependencies
-      if: steps.composer-cache.outputs.cache-hit != 'true'
-      run: composer install --prefer-dist --no-progress --no-suggest
-
     - name: Run tests with phpunit
-      run: ./phpunit.sh
+      run: ./run-tests.sh

CHANGELOG.md

@@ -6,6 +6,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [3.1.48] - 2023-03-28
+
+### Security
+- Fixed Cross site scripting vulnerability in Javascript escaping.  This addresses CVE-2023-28447.
+
+### Fixed
+- Output buffer is now cleaned for internal PHP errors as well, not just for Exceptions [#514](https://github.com/smarty-php/smarty/issues/514)
+
 ## [3.1.47] - 2022-09-14
 
 ### Security
@@ -14,7 +22,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Fixed
 - Fixed use of `rand()` without a parameter in math function [#794](https://github.com/smarty-php/smarty/issues/794)
 - Fixed unselected year/month/day not working in html_select_date [#395](https://github.com/smarty-php/smarty/issues/395)
-
+- Updated requirement contraint for 'php' in composer.json to correctly reflect that Smarty3 does not support PHP8. Please upgrade to Smarty4 to use PHP8. 
+ 
 ## [3.1.46] - 2022-08-01
 
 ### Fixed

docker-compose.yml

@@ -7,7 +7,7 @@ services:
     volumes:
       - .:/app
     working_dir: /app
-    entrypoint: sh ./utilities/testrunners/run-test.sh
+    entrypoint: sh ./run-tests.sh
   php54:
     extends:
       service: base

libs/Smarty.class.php

@@ -111,7 +111,7 @@ class Smarty extends Smarty_Internal_TemplateBase
     /**
      * smarty version
      */
-    const SMARTY_VERSION = '3.1.47';
+    const SMARTY_VERSION = '3.1.48';
     /**
      * define variable scopes
      */

libs/plugins/modifier.escape.php

@@ -188,7 +188,9 @@ function smarty_modifier_escape($string, $esc_type = 'html', $char_set = null, $
                     // see https://html.spec.whatwg.org/multipage/scripting.html#restrictions-for-contents-of-script-elements
                     '<!--' => '<\!--',
                     '<s'   => '<\s',
-                    '<S'   => '<\S'
+                    '<S'   => '<\S',
+	                "`" => "\\\\`",
+	                "\${" => "\\\\\\$\\{"
                 )
             );
         case 'mail':

libs/plugins/modifiercompiler.escape.php

@@ -92,7 +92,9 @@ function smarty_modifiercompiler_escape($params, Smarty_Internal_TemplateCompile
                 // see https://html.spec.whatwg.org/multipage/scripting.html#restrictions-for-contents-of-script-elements
                 return 'strtr(' .
                        $params[ 0 ] .
-                       ', array("\\\\" => "\\\\\\\\", "\'" => "\\\\\'", "\"" => "\\\\\"", "\\r" => "\\\\r", "\\n" => "\\\n", "</" => "<\/", "<!--" => "<\!--", "<s" => "<\s", "<S" => "<\S" ))';
+                       ', array("\\\\" => "\\\\\\\\", "\'" => "\\\\\'", "\"" => "\\\\\"", "\\r" => "\\\\r", 
+                       "\\n" => "\\\n", "</" => "<\/", "<!--" => "<\!--", "<s" => "<\s", "<S" => "<\S",
+                       "`" => "\\\\`", "\${" => "\\\\\\$\\{"))';
         }
     } catch (SmartyException $e) {
         // pass through to regular plugin fallback

libs/sysplugins/smarty_internal_templatebase.php

@@ -246,7 +246,15 @@ abstract class Smarty_Internal_TemplateBase extends Smarty_Internal_Data
                 error_reporting($_smarty_old_error_level);
             }
             return $result;
-        } catch (Exception $e) {
+        } catch (Exception $e) { // PHP 5.x specific
+            while (ob_get_level() > $level) {
+                ob_end_clean();
+            }
+            if (isset($_smarty_old_error_level)) {
+                error_reporting($_smarty_old_error_level);
+            }
+            throw $e;
+        } catch (Throwable $e) { // For PHP ^7.0 this can also catch Errors
             while (ob_get_level() > $level) {
                 ob_end_clean();
             }

run-tests-for-all-php-versions.sh

@@ -0,0 +1,46 @@
+#!/bin/bash
+Help()
+{
+   # Display Help
+   echo "Runs PHPUnit tests for all PHP versions supported by this version of Smarty."
+   echo
+   echo "Syntax: $0 [-e|h]"
+   echo "options:"
+   echo "e     Exclude a group of unit tests, e.g. -e 'slow'"
+   echo "h     Print this Help."
+   echo
+}
+
+Exclude=""
+
+# Get the options
+while getopts ":he:" option; do
+   case $option in
+      e) # Exclude
+        echo $OPTARG
+         Exclude=$OPTARG;;
+      h) # display Help
+         Help
+         exit;;
+     \?) # Invalid option
+         echo "Error: Invalid option"
+         exit;;
+   esac
+done
+
+if [ -z $Exclude ];
+then
+  Entrypoint="./run-tests.sh"
+else
+   Entrypoint="./run-tests.sh $Exclude"
+fi
+
+# Runs tests for all supported PHP versions
+docker-compose run --entrypoint "$Entrypoint" php54 && \
+docker-compose run --entrypoint "$Entrypoint" php55 && \
+docker-compose run --entrypoint "$Entrypoint" php56 && \
+docker-compose run --entrypoint "$Entrypoint" php70 && \
+docker-compose run --entrypoint "$Entrypoint" php71 && \
+docker-compose run --entrypoint "$Entrypoint" php72 && \
+docker-compose run --entrypoint "$Entrypoint" php73 && \
+docker-compose run --entrypoint "$Entrypoint" php74

run-tests.sh

@@ -0,0 +1,13 @@
+#!/bin/sh
+composer update
+
+php -r 'echo "\nPHP version " . phpversion() . ". ";';
+
+if [ -z $1 ];
+then
+  echo "Running all unit tests.\n"
+  php ./vendor/phpunit/phpunit/phpunit tests
+else
+  echo "Running all unit tests, except tests marked with @group $1.\n"
+  php ./vendor/phpunit/phpunit/phpunit --exclude-group $1 tests
+fi

run_tests_for_all_php_versions.sh

@@ -1,11 +0,0 @@
-# Runs tests for all supported PHP versions >= PHP 5.4.
-# Cannot get 5.2 and 5.3 to run in docker anymore
-
-docker-compose run php54 && \
-docker-compose run php55 && \
-docker-compose run php56 && \
-docker-compose run php70 && \
-docker-compose run php71 && \
-docker-compose run php72 && \
-docker-compose run php73 && \
-docker-compose run php74

tests/UnitTests/TemplateSource/TagTests/PluginModifier/PluginModifierEscapeTest.php

@@ -207,4 +207,25 @@ class PluginModifierEscapeTest extends PHPUnit_Smarty
         $this->assertEquals("sma'rty@»example«.com", $this->smarty->fetch($tpl));
         Smarty::$_MBSTRING = true;
     }
+
+	public function testTemplateLiteralBackticks()
+	{
+		$tpl = $this->smarty->createTemplate('string:{"`Hello, World!`"|escape:"javascript"}');
+		$this->assertEquals("\\`Hello, World!\\`", $this->smarty->fetch($tpl));
+	}
+
+	public function testTemplateLiteralInterpolation()
+	{
+		$tpl = $this->smarty->createTemplate('string:{$vector|escape:"javascript"}');
+		$this->smarty->assign('vector', "`Hello, \${name}!`");
+		$this->assertEquals("\\`Hello, \\\$\\{name}!\\`", $this->smarty->fetch($tpl));
+	}
+
+	public function testTemplateLiteralBackticksAndInterpolation()
+	{
+		$this->smarty->assign('vector', '`${alert(`Hello, ${name}!`)}${`\n`}`');
+		$tpl = $this->smarty->createTemplate('string:{$vector|escape:"javascript"}');
+		$this->assertEquals("\\`\\\$\\{alert(\\`Hello, \\\$\\{name}!\\`)}\\\$\\{\\`\\\\n\\`}\\`", $this->smarty->fetch($tpl));
+	}
+
 }

tests/UnitTests/TemplateSource/ValueTests/Operators/templates_c/.gitignore

@@ -0,0 +1,2 @@
+# Ignore anything in here, but keep this directory
+*

tests/UnitTests/TemplateSource/_Issues/ArgumentMustBePassedByReference961Test.php

@@ -0,0 +1,65 @@
+<?php
+
+class ArgumentMustBePassedByReference961Test extends PHPUnit_Smarty
+{
+
+	/**
+	 * @group issue961
+	 */
+	public function testReset()
+	{
+		$smarty = new Smarty();
+		$smarty->registerPlugin('modifier', 'reset', 'reset');
+		$templateStr = "string:{reset(\$ar)}";
+		$smarty->assign('ar', [1,2,3]);
+		$this->assertEquals(
+			'1',
+			$smarty->fetch($templateStr)
+		);
+	}
+
+	/**
+	 * @group issue961
+	 */
+	public function testResetAsModifier()
+	{
+		$smarty = new Smarty();
+		$templateStr = "string:{\$ar|reset}";
+		$smarty->assign('ar', [1,2,3]);
+		$this->assertEquals(
+			'1',
+			$smarty->fetch($templateStr)
+		);
+	}
+
+	/**
+	 * @group issue961
+	 */
+	public function testResetInExpression()
+	{
+		$smarty = new Smarty();
+		$smarty->registerPlugin('modifier', 'reset', 'reset');
+		$templateStr = "string:{if reset(\$ar)}ok{/if}";
+		$smarty->assign('ar', [1,2,3]);
+		$this->assertEquals(
+			'ok',
+			$smarty->fetch($templateStr)
+		);
+	}
+
+	/**
+	 * @group issue961
+	 * @deprecated
+	 */
+	public function testMatch()
+	{
+		$smarty = new Smarty();
+		$smarty->setErrorReporting(E_ALL & ~ E_USER_DEPRECATED);
+		$smarty->registerPlugin('modifier', 'preg_match', 'preg_match');
+		$templateStr = 'string:{assign var="match" value=null}{if preg_match(\'/([a-z]{4})/\', "a test", $match)}{$match.1}{/if}';
+		$this->assertEquals(
+			'test',
+			$smarty->fetch($templateStr)
+		);
+	}
+}