[pitboss] phase 04: Track J.2 + Track L.2 — SSTI corpus + Jinja2 / ERB / Twig / Thymeleaf / Handlebars adapters

tests/dynamic_fixtures/ssti/php_twig/vuln.php

@@ -0,0 +1,14 @@
+<?php
+// Phase 04 (Track J.2) — PHP Twig SSTI vuln fixture.
+//
+// The body is handed straight to Twig\Environment::createTemplate so
+// an attacker who controls the body reaches Twig's expression
+// evaluator and can render arbitrary expressions.
+use Twig\Environment;
+use Twig\Loader\ArrayLoader;
+
+function run(string $body): string {
+    $twig = new Environment(new ArrayLoader([]));
+    $template = $twig->createTemplate($body);
+    return $template->render([]);
+}