[austinderrick]

Summary

System\Twig\Engine::get() sets Loader::$allowInclude to true while it loads a template, which lets the loader resolve any readable local file path as a template, and sets it back afterward. When loading throws (a missing template or a syntax error), the reset never runs, so local file inclusion stays enabled for the rest of the process. The previous value is now restored in a finally block.

Under PHP-FPM the open gate lasts until the end of the failed request. Under a persistent worker such as Laravel Octane it lasts for every later request the worker serves.

Split out of #1511 so it can be reviewed on its own.

Testing

modules/system/tests/twig/EngineTest.php covers a successful render, a load that throws, a local file that must not resolve after a failed load, and restoring the previous value rather than forcing false. The throw tests fail without the change.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: e91c303b-543a-457c-819b-1776d857a1cb

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}