Merge branch 'release/4.5.3' into support/4

* Fixed a code injection vulnerability in extends-tag

* update tests for smarty v4

CHANGELOG.md

@@ -6,14 +6,23 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-### Changed
+## [4.5.3] - 2024-05-28
+- Fixed a code injection vulnerability in extends-tag. This addresses CVE-2024-35226.
+
+
+## [4.5.2] - 2024-04-06
+- Fixed argument must be passed by reference error introduced in v4.5.1 [#964](https://github.com/smarty-php/smarty/issues/964)
+
+## [4.5.1] - 2024-03-18
 - Using unregistered static class methods in expressions now also triggers a deprecation notice because we will drop support for this in the next major release [#813](https://github.com/smarty-php/smarty/issues/813)
 
+## [4.5.0] - 2024-03-18
+- (this release accidentally didn't contain any changes, fixed in 4.5.1)
+
 ## [4.4.1] - 2024-02-26
 - Fixed internal release-tooling
 
 ## [4.4.0] - 2024-02-26
-### Changed
 - Using the `|implode`, `|json_encode` and `|substr` modifiers does not generate a deprecation warning anymore as they will continue to be supported in v5 [#939](https://github.com/smarty-php/smarty/issues/939) 
 
 ### Added

docs/designers/language-builtin-functions/language-function-section.md

@@ -178,14 +178,14 @@ The above example will output:
 </p>
 <p>
   name: Jack Jones<br />
-  home phone: 777-555-5555<br />
+  home: 777-555-5555<br />
-  cell phone: 888-555-5555<br />
+  cell: 888-555-5555<br />
   e-mail: jack@myexample.com
 </p>
 <p>
   name: Jane Munson<br />
-  home phone: 000-555-5555<br />
+  home: 000-555-5555<br />
-  cell phone: 123456<br />
+  cell: 123456<br />
   e-mail: jane@myexample.com
 </p>
 ```

libs/Smarty.class.php

@@ -107,7 +107,7 @@ class Smarty extends Smarty_Internal_TemplateBase
     /**
      * smarty version
      */
-    const SMARTY_VERSION = '4.4.1';
+    const SMARTY_VERSION = '4.5.3';
     /**
      * define variable scopes
      */

libs/sysplugins/smarty_internal_compile_extends.php

@@ -30,7 +30,7 @@ class Smarty_Internal_Compile_Extends extends Smarty_Internal_Compile_Shared_Inh
      *
      * @var array
      */
-    public $optional_attributes = array('extends_resource');
+    public $optional_attributes = array();
 
     /**
      * Attribute definition: Overwrites base class.
@@ -62,29 +62,7 @@ class Smarty_Internal_Compile_Extends extends Smarty_Internal_Compile_Shared_Inh
         }
         // add code to initialize inheritance
         $this->registerInit($compiler, true);
-        $file = trim($_attr[ 'file' ], '\'"');
+        $this->compileEndChild($compiler, $_attr[ 'file' ]);
-        if (strlen($file) > 8 && substr($file, 0, 8) === 'extends:') {
-            // generate code for each template
-            $files = array_reverse(explode('|', substr($file, 8)));
-            $i = 0;
-            foreach ($files as $file) {
-                if ($file[ 0 ] === '"') {
-                    $file = trim($file, '".');
-                } else {
-                    $file = "'{$file}'";
-                }
-                $i++;
-                if ($i === count($files) && isset($_attr[ 'extends_resource' ])) {
-                    $this->compileEndChild($compiler);
-                }
-                $this->compileInclude($compiler, $file);
-            }
-            if (!isset($_attr[ 'extends_resource' ])) {
-                $this->compileEndChild($compiler);
-            }
-        } else {
-            $this->compileEndChild($compiler, $_attr[ 'file' ]);
-        }
         $compiler->has_code = false;
         return '';
     }
@@ -115,44 +93,4 @@ class Smarty_Internal_Compile_Extends extends Smarty_Internal_Compile_Shared_Inh
                 '') . ");\n?>"
         );
     }
-
-    /**
-     * Add code for including subtemplate to end of template
-     *
-     * @param \Smarty_Internal_TemplateCompilerBase $compiler
-     * @param string                                $template subtemplate name
-     *
-     * @throws \SmartyCompilerException
-     * @throws \SmartyException
-     */
-    private function compileInclude(Smarty_Internal_TemplateCompilerBase $compiler, $template)
-    {
-        $compiler->parser->template_postfix[] = new Smarty_Internal_ParseTree_Tag(
-            $compiler->parser,
-            $compiler->compileTag(
-                'include',
-                array(
-                    $template,
-                    array('scope' => 'parent')
-                )
-            )
-        );
-    }
-
-    /**
-     * Create source code for {extends} from source components array
-     *
-     * @param \Smarty_Internal_Template $template
-     *
-     * @return string
-     */
-    public static function extendsSourceArrayCode(Smarty_Internal_Template $template)
-    {
-        $resources = array();
-        foreach ($template->source->components as $source) {
-            $resources[] = $source->resource;
-        }
-        return $template->smarty->left_delimiter . 'extends file=\'extends:' . join('|', $resources) .
-               '\' extends_resource=true' . $template->smarty->right_delimiter;
-    }
 }

libs/sysplugins/smarty_internal_templatecompilerbase.php

@@ -455,15 +455,29 @@ abstract class Smarty_Internal_TemplateCompilerBase
             $this->smarty->_current_file = $this->template->source->filepath;
             // get template source
             if (!empty($this->template->source->components)) {
-                // we have array of inheritance templates by extends: resource
+				$_compiled_code = '<?php $_smarty_tpl->_loadInheritance(); $_smarty_tpl->inheritance->init($_smarty_tpl, true); ?>';
-                // generate corresponding source code sequence
+
-                $_content =
+				$i = 0;
-                    Smarty_Internal_Compile_Extends::extendsSourceArrayCode($this->template);
+				$reversed_components = array_reverse($this->template->getSource()->components);
+				foreach ($reversed_components as $source) {
+					$i++;
+					if ($i === count($reversed_components)) {
+						$_compiled_code .= '<?php $_smarty_tpl->inheritance->endChild($_smarty_tpl); ?>';
+					}
+					$_compiled_code .= $this->compileTag(
+						'include',
+						[
+							var_export($source->resource, true),
+							['scope' => 'parent'],
+						]
+					);
+				}
+				$_compiled_code = $this->postFilter($_compiled_code, $this->template);
             } else {
                 // get template source
                 $_content = $this->template->source->getContent();
+				$_compiled_code = $this->postFilter($this->doCompile($this->preFilter($_content), true));
             }
-            $_compiled_code = $this->postFilter($this->doCompile($this->preFilter($_content), true));
             if (!empty($this->required_plugins[ 'compiled' ]) || !empty($this->required_plugins[ 'nocache' ])) {
                 $_compiled_code = '<?php ' . $this->compileRequiredPlugins() . "?>\n" . $_compiled_code;
             }
@@ -640,17 +654,18 @@ abstract class Smarty_Internal_TemplateCompilerBase
                         return $func_name . '(' . $parameter[ 0 ] . ')';
                     }
                 } else {
-					$first_param = array_shift($parameter);
+
-					$modifier = array_merge(array($name), $parameter);
+					if (
-					// Now, compile the function call as a modifier
+						!$this->smarty->loadPlugin('smarty_modifiercompiler_' . $name)
-					return $this->compileTag(
+						&& !isset($this->smarty->registered_plugins[Smarty::PLUGIN_MODIFIER][$name])
-						'private_modifier',
+						&& !in_array($name, ['time', 'join', 'is_array', 'in_array'])
-						array(),
+					) {
-						array(
+						trigger_error('Using unregistered function "' . $name . '" in a template is deprecated and will be ' .
-							'modifierlist' => array($modifier),
+							'removed in a future release. Use Smarty::registerPlugin to explicitly register ' .
-							'value'        => $first_param
+							'a custom modifier.', E_USER_DEPRECATED);
-						)
+					}
-					);
+
+					return $name . '(' . implode(',', $parameter) . ')';
                 }
             } else {
                 $this->trigger_template_error("unknown function '{$name}'");

make-release.sh

@@ -15,7 +15,7 @@ php utilities/update-smarty-version-number.php $1
 git add changelog CHANGELOG.md libs/Smarty.class.php
 git commit -m "version bump"
 
-git checkout support/4.3
+git checkout support/4
 git pull
 git merge --no-ff "release/$1"
 git branch -d "release/$1"

tests/UnitTests/SmartyMethodsTests/GetTemplateVars/GetTemplateVarsTest.php

@@ -109,4 +109,17 @@ class GetTemplateVarsTest extends PHPUnit_Smarty
         $this->assertEquals("bar2", $this->smarty->getTemplateVars('foo2', $data2, false));
         $this->assertEquals("", $this->smarty->getTemplateVars('blar', $data2, false));
     }
+
+    public function testSimpleCallReturnsArrayWithAllValues()
+    {
+        $this->smarty->assign('foo', 'bar');
+        $this->smarty->assign('i', 3);
+
+        $vars = $this->smarty->getTemplateVars();
+
+        $this->assertArrayHasKey('foo', $vars);
+        $this->assertArrayHasKey('i', $vars);
+        $this->assertEquals('bar', $vars['foo']);
+        $this->assertEquals(3,$vars['i']);
+    }
 }

tests/UnitTests/TemplateSource/TagTests/BockExtend/CompileBlockExtendsTest.php

@@ -1371,8 +1371,38 @@ class CompileBlockExtendsTest extends PHPUnit_Smarty
         );
     }
 
-	public function testBlockWithAssign() {
+    public function testBlockWithAssign() {
-		$this->assertEquals('Captured content is: Content with lots of html here', $this->smarty->fetch('038_child.tpl'));
+        $this->assertEquals('Captured content is: Content with lots of html here', $this->smarty->fetch('038_child.tpl'));
-	}
+    }
+
+    /**
+     * Test escaping of file parameter
+     */
+    public function testEscaping()
+    {
+        $this->expectException(SmartyException::class);
+        $this->expectExceptionMessageRegExp('/Unable to load.*/');
+        $this->assertEquals('hello world', $this->smarty->fetch('escaping.tpl'));
+    }
+
+    /**
+     * Test escaping of file parameter 2
+     */
+    public function testEscaping2()
+    {
+        $this->expectException(SmartyException::class);
+        $this->expectExceptionMessageRegExp('/Unable to load.*/');
+        $this->assertEquals('hello world', $this->smarty->fetch('escaping2.tpl'));
+    }
+
+    /**
+     * Test escaping of file parameter 3
+     */
+    public function testEscaping3()
+    {
+        $this->expectException(SmartyException::class);
+        $this->expectExceptionMessageRegExp('/Unable to load.*/');
+        $this->assertEquals('hello world', $this->smarty->fetch('escaping3.tpl'));
+    }
 
 }

tests/UnitTests/TemplateSource/TagTests/BockExtend/templates/escaping.tpl

@@ -0,0 +1 @@
+{extends "extends:helloworld.tpl', var_dump(shell_exec('ls')), 1, 2, 3, 4, 5, 6);}}?>"}

tests/UnitTests/TemplateSource/TagTests/BockExtend/templates/escaping2.tpl

@@ -0,0 +1 @@
+{extends 'extends:"helloworld.tpl\', var_dump(shell_exec(\'ls\')), 1, 2, 3, 4, 5, 6);}}?>'}

tests/UnitTests/TemplateSource/TagTests/BockExtend/templates/escaping3.tpl

@@ -0,0 +1 @@
+{extends file='extends:"helloworld.tpl'|cat:"', var_dump(shell_exec('ls')), 1, 2, 3, 4, 5, 6);}}?>"}

tests/UnitTests/TemplateSource/TagTests/Include/CompileIncludeTest.php

@@ -82,6 +82,18 @@ class CompileIncludeTest extends PHPUnit_Smarty
         $this->assertEquals('I1I2I3', $content, $text);
     }
 
+    /**
+     * test template name escaping
+     */
+    public function testIncludeFilenameEscaping()
+    {
+        $this->expectException(SmartyException::class);
+        $this->expectExceptionMessageRegExp('/Unable to load.*/');
+        $tpl = $this->smarty->createTemplate('test_include_security.tpl');
+        $content = $this->smarty->fetch($tpl);
+        $this->assertEquals("hello world", $content);
+    }
+
     /**
      * test standard output
      *

tests/UnitTests/TemplateSource/TagTests/Include/templates/test_include_security.tpl

@@ -0,0 +1 @@
+{include file="helloworld.tpl', var_dump(shell_exec('ls')), 1, 2, 3, 4, 5, 6);}}?>"}

tests/UnitTests/TemplateSource/TagTests/Section/CompileSectionTest.php

@@ -148,4 +148,37 @@ class CompileSectionTest extends PHPUnit_Smarty
         );
     }
 
+	public function testNestedArrayAsLoopParameter()
+	{
+		$data = [
+			['name' => 'John Smith', 'home' => '555-555-5555',
+				'cell' => '666-555-5555', 'email' => 'john@myexample.com'],
+			['name' => 'Jack Jones', 'home' => '777-555-5555',
+				'cell' => '888-555-5555', 'email' => 'jack@myexample.com'],
+			['name' => 'Jane Munson', 'home' => '000-555-5555',
+				'cell' => '123456', 'email' => 'jane@myexample.com']
+		];
+		$this->smarty->assign('contacts',$data);
+		$result = $this->smarty->fetch('string:{section name=customer loop=$contacts}
+name: {$contacts[customer].name}
+home: {$contacts[customer].home}
+cell: {$contacts[customer].cell}
+e-mail: {$contacts[customer].email}
+{/section}');
+		$this->assertEquals('name: John Smith
+home: 555-555-5555
+cell: 666-555-5555
+e-mail: john@myexample.com
+name: Jack Jones
+home: 777-555-5555
+cell: 888-555-5555
+e-mail: jack@myexample.com
+name: Jane Munson
+home: 000-555-5555
+cell: 123456
+e-mail: jane@myexample.com
+', $result);
+
+	}
+
 }

tests/UnitTests/TemplateSource/X_Scopes/ScopeTest.php

@@ -299,4 +299,12 @@ class ScopeTest extends PHPUnit_Smarty
         $this->smarty->assign('scope', 'none');
         $r = $this->smarty->fetch('test_function_scope.tpl');
     }
+
+	public function testFunctionScopeIsLocalByDefault()
+	{
+		$r = $this->smarty->fetch('string:{function name=test}{$var="b"}{/function}{$var="a"}{test}{$var}');
+		$this->assertEquals('a', $r);
+	}
+
+
 }

tests/UnitTests/TemplateSource/_Issues/419/ExtendsIssue419Test.php

@@ -32,4 +32,11 @@ class ExtendsIssue419Test extends PHPUnit_Smarty
         $this->assertEquals('child', $this->smarty->fetch('extends:001_parent.tpl|001_child.tpl'));
     }
 
+    public function testextendsSecurity()
+    {
+        $this->expectException(SmartyException::class);
+        $this->expectExceptionMessageRegExp('/Unable to load.*/');
+        $this->assertEquals('child', $this->smarty->fetch('string:{include "001_parent.tpl\', var_dump(shell_exec(\'ls\')), 1, 2, 3, 4, 5, 6);}}?>"}'));
+    }
+
 }

tests/UnitTests/TemplateSource/_Issues/ArgumentMustBePassedByReference961Test.php

@@ -0,0 +1,67 @@
+<?php
+
+class ArgumentMustBePassedByReference961Test extends PHPUnit_Smarty
+{
+
+	/**
+	 * @group issue961
+	 */
+	public function testReset()
+	{
+		$smarty = new Smarty();
+		$smarty->registerPlugin('modifier', 'reset', 'reset');
+		$templateStr = "string:{reset(\$ar)}";
+		$smarty->assign('ar', [1,2,3]);
+		$this->assertEquals(
+			'1',
+			$smarty->fetch($templateStr)
+		);
+	}
+
+	/**
+	 * @group issue961
+	 * @deprecated
+	 */
+	public function testResetAsModifier()
+	{
+		$smarty = new Smarty();
+		try {
+			$templateStr = "string:{\$ar|reset}";
+			$smarty->assign('ar', [1,2,3]);
+			$this->assertEquals(
+				'1',
+				$smarty->fetch($templateStr)
+			);
+		} catch (Exception $e) {
+		}
+	}
+
+	/**
+	 * @group issue961
+	 */
+	public function testResetInExpression()
+	{
+		$smarty = new Smarty();
+		$smarty->registerPlugin('modifier', 'reset', 'reset');
+		$templateStr = "string:{if reset(\$ar)}ok{/if}";
+		$smarty->assign('ar', [1,2,3]);
+		$this->assertEquals(
+			'ok',
+			$smarty->fetch($templateStr)
+		);
+	}
+
+	/**
+	 * @group issue961
+	 */
+	public function testMatch()
+	{
+		$smarty = new Smarty();
+		$smarty->registerPlugin('modifier', 'preg_match', 'preg_match');
+		$templateStr = 'string:{assign var="match" value=null}{if preg_match(\'/([a-z]{4})/\', "a test", $match)}{$match.1}{/if}';
+		$this->assertEquals(
+			'test',
+			$smarty->fetch($templateStr)
+		);
+	}
+}