fixed partial output leak when a PHP fatal error occurs

twigphp · May 3, 2019 · cad5caa · cad5caa
1 parent ed083c8
commit cad5caa
Show file tree

Hide file tree

Showing 10 changed files with 12 additions and 11 deletions.
diff --git a/CHANGELOG b/CHANGELOG
@@ -1,5 +1,6 @@
 * 1.40.2 (2019-XX-XX)
 
+ * fixed partial output leak when a PHP fatal error occurs
  * optimized context access on PHP 7.4
 
 * 1.40.1 (2019-04-29)

diff --git a/src/Extension/DebugExtension.php b/src/Extension/DebugExtension.php
@@ -54,7 +54,7 @@ function twig_var_dump(Environment $env, $context, array $vars = [])
         return;
     }
 
-    ob_start();
+    ob_start(function ($in) {return ''; });
 
     if (!$vars) {
         $vars = [];

diff --git a/src/Node/MacroNode.php b/src/Node/MacroNode.php
@@ -104,7 +104,7 @@ public function compile(Compiler $compiler)
             ->outdent()
             ->write("]);\n\n")
             ->write("\$blocks = [];\n\n")
-            ->write("ob_start();\n")
+            ->write("ob_start(function (\$in) {return ''; });\n")
             ->write("try {\n")
             ->indent()
             ->subcompile($this->getNode('body'))

diff --git a/src/Node/SetNode.php b/src/Node/SetNode.php
@@ -58,7 +58,7 @@ public function compile(Compiler $compiler)
         } else {
             if ($this->getAttribute('capture')) {
                 $compiler
-                    ->write("ob_start();\n")
+                    ->write("ob_start(function (\$in) {return ''; });\n")
                     ->subcompile($this->getNode('values'))
                 ;
             }

diff --git a/src/Node/SpacelessNode.php b/src/Node/SpacelessNode.php
@@ -31,7 +31,7 @@ public function compile(Compiler $compiler)
     {
         $compiler
             ->addDebugInfo($this)
-            ->write("ob_start();\n")
+            ->write("ob_start(function (\$in) {return ''; });\n")
             ->subcompile($this->getNode('body'))
             ->write("echo trim(preg_replace('/>\s+</', '><', ob_get_clean()));\n")
         ;

diff --git a/src/Template.php b/src/Template.php
@@ -253,7 +253,7 @@ public function displayBlock($name, array $context, array $blocks = [], $useBloc
      */
     public function renderParentBlock($name, array $context, array $blocks = [])
     {
-        ob_start();
+        ob_start(function ($in) {return ''; });
         $this->displayParentBlock($name, $context, $blocks);
 
         return ob_get_clean();
@@ -274,7 +274,7 @@ public function renderParentBlock($name, array $context, array $blocks = [])
      */
     public function renderBlock($name, array $context, array $blocks = [], $useBlocks = true)
     {
-        ob_start();
+        ob_start(function ($in) {return ''; });
         $this->displayBlock($name, $context, $blocks, $useBlocks);
 
         return ob_get_clean();
@@ -417,7 +417,7 @@ public function display(array $context, array $blocks = [])
     public function render(array $context)
     {
         $level = ob_get_level();
-        ob_start();
+        ob_start(function ($in) {return ''; });
         try {
             $this->display($context);
         } catch (\Exception $e) {

diff --git a/src/TemplateWrapper.php b/src/TemplateWrapper.php
@@ -96,7 +96,7 @@ public function renderBlock($name, $context = [])
     {
         $context = $this->env->mergeGlobals($context);
         $level = ob_get_level();
-        ob_start();
+        ob_start(function ($in) {return ''; });
         try {
             $this->template->displayBlock($name, $context);
         } catch (\Exception $e) {

diff --git a/test/Twig/Tests/Node/MacroTest.php b/test/Twig/Tests/Node/MacroTest.php
@@ -59,7 +59,7 @@ public function getfoo(\$__foo__ = null, \$__bar__ = "Foo"$declaration)
 
     \$blocks = [];
 
-    ob_start();
+    ob_start(function (\$in) {return ''; });
     try {
         echo "foo";
     } catch (\Exception \$e) {

diff --git a/test/Twig/Tests/Node/SetTest.php b/test/Twig/Tests/Node/SetTest.php
@@ -49,7 +49,7 @@ public function getTests()
         $node = new SetNode(true, $names, $values, 1);
         $tests[] = [$node, <<<EOF
 // line 1
-ob_start();
+ob_start(function (\$in) {return ''; });
 echo "foo";
 \$context["foo"] = ('' === \$tmp = ob_get_clean()) ? '' : new Markup(\$tmp, \$this->env->getCharset());
 EOF

diff --git a/test/Twig/Tests/Node/SpacelessTest.php b/test/Twig/Tests/Node/SpacelessTest.php
@@ -32,7 +32,7 @@ public function getTests()
         return [
             [$node, <<<EOF
 // line 1
-ob_start();
+ob_start(function (\$in) {return ''; });
 echo "<div>   <div>   foo   </div>   </div>";
 echo trim(preg_replace('/>\s+</', '><', ob_get_clean()));
 EOF