smarty-php / smarty-php/smarty
Harden Security mode
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 2.3k
- Forks
- 709
- PR merge metrics
- No merged PRs in 30d
Description
The Security API has received a number of security patches over the past years. The root of many of the fixed issues is that Security API was added as an afterthought after creating a very flexible and permissive language first.
For scenarios where Smarty is used in unsafe context, i.e. where the source for templates comes from non-trusted authors, we might want to be way less permissive in what gets compiled into what. That way, we can harden the Security API properly and stop plugging holes.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing Smarty's Security API and the compilation path for templates from untrusted authors. Identify which permissive language behavior the hardened mode must address, then define the restrictions and verify that unsafe templates are rejected while the intended security behavior is preserved.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100