nyx/tests/fixtures/ssti/php/safe_twig_constant.php
2026-05-07 01:29:31 -04:00

10 lines
367 B
PHP

<?php
// Safe: Twig\Environment::createTemplate receives a constant template
// source. Variables passed at render time carry user input but do not
// activate SSTI.
function handler() {
$twig = new \Twig\Environment(new \Twig\Loader\ArrayLoader([]));
$tpl = $twig->createTemplate('Hello, {{ name }}');
return $tpl->render(['name' => $_GET['name']]);
}