Description

Detects template injection vulnerabilities in PHP applications using the Twig template engine where user input is not properly sanitized before being processed by template functions. This can allow attackers to inject and execute malicious template code, potentially leading to remote code execution.

Detection Strategy

• Checks if Twig template engine library is imported in the codebase

• Identifies usage of dangerous template functions or methods that can process dynamic content

• Analyzes if unsanitized or user-controlled data flows into these template processing functions

• Reports a vulnerability when untrusted input reaches template processing functions without proper escaping or sanitization

Vulnerable code example

<?php
use Twig\Environment;
use Twig\Loader\FilesystemLoader;

$loader = new FilesystemLoader(__DIR__ . '/templates');
$twig = new Environment($loader, ['cache' => false]);

// VULNERABLE: User input directly used as template name without validation...

✅ Secure code example

<?php
use Twig\Environment;
use Twig\Loader\FilesystemLoader;

$loader = new FilesystemLoader(__DIR__ . '/templates');
$twig = new Environment($loader, [
    'cache' => false,
    'autoescape' => true  // Ensure autoescaping is enabled...