Using the Twig Sandbox Extension

Twig offers a Sandbox extension that enables the use of the {% sandbox %} tag with the {% include %} and {% include_content %} tags.

This extension is particularly useful for controlling which tags, filters, and functions are allowed within templates, enhancing security during dynamic template rendering.

To configure and use the Twig Sandbox extension in your OXID eShop, perform the following steps.

Procedure

Create a sandbox extension factory.

class SandboxExtensionFactory
{
    public static function getExtension(): Twig\Extension\SandboxExtension
    {
        $policy = new Twig\Sandbox\SecurityPolicy(
            allowedTags: ['for'],
            allowedFilters: ['escape', 'raw'],
            allowedFunctions: ['range'],
        );
        return new Twig\Extension\SandboxExtension($policy);
    }
}

To register the sandbox extension, define the necessary services in your component’s or module’s services.yaml file as follows:

ACME\Twig\Extensions\SandboxExtensionFactory:
  class: ACME\Twig\Extensions\SandboxExtensionFactory

Twig\Extension\SandboxExtension:
  factory: ['ACME\Twig\Extensions\SandboxExtensionFactory', 'getExtension']
  tags: [ 'twig.extension' ]

Clear the cache.
```
vendor/bin/oe-console oe:cache:clear
```

To enforce the sandbox policy, wrap template includes with the {% sandbox %} tag.

{% sandbox %}
    {% include 'user.html.twig' %}
{% endsandbox %}

# Or

{% sandbox %}
    {% include_content "sandbox_test" %}
{% endsandbox %}

Templates that do not comply with the defined sandbox policy will trigger a Twig\Sandbox\SecurityError exception.