This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | /** |
||
4 | * This file is part of the TwigBridge package. |
||
5 | * |
||
6 | * @copyright Robert Crowe <[email protected]> |
||
7 | * |
||
8 | * For the full copyright and license information, please view the LICENSE |
||
9 | * file that was distributed with this source code. |
||
10 | */ |
||
11 | |||
12 | /** |
||
13 | * Configuration options for Twig. |
||
14 | */ |
||
15 | return [ |
||
16 | |||
17 | 'twig' => [ |
||
18 | /* |
||
19 | |-------------------------------------------------------------------------- |
||
20 | | Extension |
||
21 | |-------------------------------------------------------------------------- |
||
22 | | |
||
23 | | File extension for Twig view files. |
||
24 | | |
||
25 | */ |
||
26 | 'extension' => 'twig', |
||
27 | |||
28 | /* |
||
29 | |-------------------------------------------------------------------------- |
||
30 | | Accepts all Twig environment configuration options |
||
31 | |-------------------------------------------------------------------------- |
||
32 | | |
||
33 | | http://twig.sensiolabs.org/doc/api.html#environment-options |
||
34 | | |
||
35 | */ |
||
36 | 'environment' => [ |
||
37 | |||
38 | // When set to true, the generated templates have a __toString() method |
||
39 | // that you can use to display the generated nodes. |
||
40 | // default: false |
||
41 | 'debug' => env('APP_DEBUG', false), |
||
42 | |||
43 | // The charset used by the templates. |
||
44 | // default: utf-8 |
||
0 ignored issues
–
show
|
|||
45 | 'charset' => 'utf-8', |
||
46 | |||
47 | // The base template class to use for generated templates. |
||
48 | // default: TwigBridge\Twig\Template |
||
49 | 'base_template_class' => 'TwigBridge\Twig\Template', |
||
50 | |||
51 | // An absolute path where to store the compiled templates, or false to disable caching. If null |
||
52 | // then the cache file path is used. |
||
53 | // default: cache file storage path |
||
54 | 'cache' => null, |
||
55 | |||
56 | // When developing with Twig, it's useful to recompile the template |
||
57 | // whenever the source code changes. If you don't provide a value |
||
58 | // for the auto_reload option, it will be determined automatically based on the debug value. |
||
59 | 'auto_reload' => true, |
||
60 | |||
61 | // If set to false, Twig will silently ignore invalid variables |
||
62 | // (variables and or attributes/methods that do not exist) and |
||
63 | // replace them with a null value. When set to true, Twig throws an exception instead. |
||
64 | // default: false |
||
65 | 'strict_variables' => false, |
||
66 | |||
67 | // If set to true, auto-escaping will be enabled by default for all templates. |
||
68 | // default: true |
||
69 | 'autoescape' => true, |
||
70 | |||
71 | // A flag that indicates which optimizations to apply |
||
72 | // (default to -1 -- all optimizations are enabled; set it to 0 to disable) |
||
73 | 'optimizations' => -1, |
||
74 | ], |
||
75 | |||
76 | /* |
||
77 | |-------------------------------------------------------------------------- |
||
78 | | Global variables |
||
79 | |-------------------------------------------------------------------------- |
||
80 | | |
||
81 | | These will always be passed in and can be accessed as Twig variables. |
||
82 | | NOTE: these will be overwritten if you pass data into the view with the same key. |
||
83 | | |
||
84 | */ |
||
85 | 'globals' => [], |
||
86 | ], |
||
87 | |||
88 | 'extensions' => [ |
||
89 | |||
90 | /* |
||
91 | |-------------------------------------------------------------------------- |
||
92 | | Extensions |
||
93 | |-------------------------------------------------------------------------- |
||
94 | | |
||
95 | | Enabled extensions. |
||
96 | | |
||
97 | | `Twig_Extension_Debug` is enabled automatically if twig.debug is TRUE. |
||
98 | | |
||
99 | */ |
||
100 | 'enabled' => [ |
||
101 | 'TwigBridge\Extension\Loader\Facades', |
||
102 | 'TwigBridge\Extension\Loader\Filters', |
||
103 | 'TwigBridge\Extension\Loader\Functions', |
||
104 | |||
105 | 'TwigBridge\Extension\Laravel\Auth', |
||
106 | 'TwigBridge\Extension\Laravel\Config', |
||
107 | |||
108 | 'TwigBridge\Extension\Laravel\Input', |
||
109 | 'TwigBridge\Extension\Laravel\Session', |
||
110 | 'TwigBridge\Extension\Laravel\Str', |
||
111 | 'TwigBridge\Extension\Laravel\Translator', |
||
112 | 'TwigBridge\Extension\Laravel\Url', |
||
113 | |||
114 | // 'TwigBridge\Extension\Laravel\Form', |
||
115 | // 'TwigBridge\Extension\Laravel\Html', |
||
116 | // 'TwigBridge\Extension\Laravel\Legacy\Facades', |
||
117 | ], |
||
118 | |||
119 | /* |
||
120 | |-------------------------------------------------------------------------- |
||
121 | | Facades |
||
122 | |-------------------------------------------------------------------------- |
||
123 | | |
||
124 | | Available facades. Access like `{{ Config.get('foo.bar') }}`. |
||
125 | | |
||
126 | | Each facade can take an optional array of options. To mark the whole facade |
||
127 | | as safe you can set the option `'is_safe' => true`. Setting the facade as |
||
128 | | safe means that any HTML returned will not be escaped. |
||
129 | | |
||
130 | | It is advisable to not set the whole facade as safe and instead mark the |
||
131 | | each appropriate method as safe for security reasons. You can do that with |
||
132 | | the following syntax: |
||
133 | | |
||
134 | | <code> |
||
135 | | 'Form' => [ |
||
136 | | 'is_safe' => [ |
||
137 | | 'open' |
||
138 | | ] |
||
139 | | ] |
||
140 | | </code> |
||
141 | | |
||
142 | | The values of the `is_safe` array must match the called method on the facade |
||
143 | | in order to be marked as safe. |
||
144 | | |
||
145 | */ |
||
146 | 'facades' => ["Config", "Auth", "Session", "Input", "Request"], |
||
147 | |||
148 | /* |
||
149 | |-------------------------------------------------------------------------- |
||
150 | | Functions |
||
151 | |-------------------------------------------------------------------------- |
||
152 | | |
||
153 | | Available functions. Access like `{{ secure_url(...) }}`. |
||
154 | | |
||
155 | | Each function can take an optional array of options. These options are |
||
156 | | passed directly to `Twig_SimpleFunction`. |
||
157 | | |
||
158 | | So for example, to mark a function as safe you can do the following: |
||
159 | | |
||
160 | | <code> |
||
161 | | 'link_to' => [ |
||
162 | | 'is_safe' => ['html'] |
||
163 | | ] |
||
164 | | </code> |
||
165 | | |
||
166 | | The options array also takes a `callback` that allows you to name the |
||
167 | | function differently in your Twig templates than what it's actually called. |
||
168 | | |
||
169 | | <code> |
||
170 | | 'link' => [ |
||
171 | | 'callback' => 'link_to' |
||
172 | | ] |
||
173 | | </code> |
||
174 | | |
||
175 | */ |
||
176 | 'functions' => [], |
||
177 | |||
178 | /* |
||
179 | |-------------------------------------------------------------------------- |
||
180 | | Filters |
||
181 | |-------------------------------------------------------------------------- |
||
182 | | |
||
183 | | Available filters. Access like `{{ variable|filter }}`. |
||
184 | | |
||
185 | | Each filter can take an optional array of options. These options are |
||
186 | | passed directly to `Twig_SimpleFilter`. |
||
187 | | |
||
188 | | So for example, to mark a filter as safe you can do the following: |
||
189 | | |
||
190 | | <code> |
||
191 | | 'studly_case' => [ |
||
192 | | 'is_safe' => ['html'] |
||
193 | | ] |
||
194 | | </code> |
||
195 | | |
||
196 | | The options array also takes a `callback` that allows you to name the |
||
197 | | filter differently in your Twig templates than what is actually called. |
||
198 | | |
||
199 | | <code> |
||
200 | | 'snake' => [ |
||
201 | | 'callback' => 'snake_case' |
||
202 | | ] |
||
203 | | </code> |
||
204 | | |
||
205 | */ |
||
206 | 'filters' => [], |
||
207 | ], |
||
208 | ]; |
||
209 |
Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it.
The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production.
This check looks for comments that seem to be mostly valid code and reports them.