如何解决用户提交模板代码的安全隐患？IntaroTwigSandboxBundle助你构建安全的沙箱环境

<code class="bash">composer require intaro/twig-sandbox-bundle</code>

<pre class="brush:php;toolbar:false;">// config/bundles.php
return [
    // ...
    Intaro\TwigSandboxBundle\IntaroTwigSandboxBundle::class => ['all' => true],
];

<pre class="brush:php;toolbar:false;">// Acme/DemoBundle/Entity/Product.php

namespace Acme\DemoBundle\Entity;

use Doctrine\ORM\Mapping as ORM;
use Intaro\TwigSandboxBundle\Annotation\Sandbox; // 或者直接使用 Intaro\TwigSandboxBundle\Attribute\Sandbox

#[ORM\Table]
#[ORM\Entity]
class Product
{
    #[ORM\Column(name: 'id', type: 'integer')]
    #[ORM\Id]
    #[ORM\GeneratedValue(strategy: "AUTO")]
    private ?int $id = null;

    #[ORM\Column(name: 'name', type: 'string', length: 255)]
    #[Sandbox(type: 'string')] // 允许在沙箱中访问 'name' 属性
    private string $name = '';

    #[ORM\Column(name: 'quantity', type: 'integer', nullable: true)]
    private ?int $quantity = null; // 注意：这里没有 #[Sandbox] 属性

    #[Sandbox(type: 'int')] // 允许在沙箱中访问 getId() 方法
    public function getId(): ?int
    {
        return $this->id;
    }

    public function setName(string $name): self
    {
        $this->name = $name;
        return $this;
    }

    #[Sandbox] // 允许在沙箱中访问 getName() 方法
    public function getName(): string
    {
        return $this->name;
    }

    public function setQuantity(?int $quantity): self
    {
        $this->quantity = $quantity;
        return $this;
    }

    public function getQuantity(): ?int
    {
        return $this->quantity;
    }
}

<pre class="brush:php;toolbar:false;">use Acme\DemoBundle\Entity\Product;
use Intaro\TwigSandboxBundle\Builder\EnvironmentBuilder;
use Twig\Error\RuntimeError; // 引入 Twig 运行时错误

class ExampleService
{
    private EnvironmentBuilder $environmentBuilder;

    public function __construct(EnvironmentBuilder $environmentBuilder)
    {
        $this->environmentBuilder = $environmentBuilder;
    }

    public function renderProductTemplate(): void
    {
        // 获取一个沙箱化的 Twig 环境
        $twig = $this->environmentBuilder->getSandboxEnvironment();

        $product = new Product();
        $product->setName('Awesome Gadget');
        $product->setQuantity(5);

        // 成功的渲染：只访问了允许的属性
        $html1 = $twig->render(
            'Product: {{ product.name }} (ID: {{ product.id }})',
            ['product' => $product]
        );
        echo "成功渲染: " . $html1 . "\n"; // 输出: Product: Awesome Gadget (ID: )

        // 尝试访问未允许的属性，将抛出异常
        try {
            $html2 = $twig->render(
                'Product: {{ product.name }} in quantity {{ product.quantity }}',
                ['product' => $product]
            );
            echo "尝试渲染2: " . $html2 . "\n";
        } catch (RuntimeError $e) {
            echo "渲染失败（预期）：" . $e->getMessage() . "\n";
            // 错误信息类似 "Method "getQuantity" is not allowed for object "Acme\DemoBundle\Entity\Product"."
        }
    }
}

<pre class="brush:php;toolbar:false;"># config/packages/intaro_twig_sandbox.yaml
parameters:
    intaro.twig_sandbox.policy_tags:
        - 'for'
        - 'if'
        - 'set'
    intaro.twig_sandbox.policy_filters:
        - 'upper'
        - 'date'
    intaro.twig_sandbox.policy_functions:
        - 'date'