CVE-2023-34251: Improper Control of Generation of Code ('Code Injection') (CWE-94)
value: Grav is a flat-file content management system. Versions prior to 1.7.42 are vulnerable to server side template injection. Remote code execution is possible by embedding malicious PHP code on the administrator screen by a user with page editing privileges. Version 1.7.42 contains a fix for this issue.
CWE description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVSS v3 base score: 7.2
Published: 2023-06-14T22:15Z
Repository: https://github.com/getgrav/grav
Language: PHP
Files changed: CHANGELOG.md, system/src/Grav/Common/Twig/Extension/GravExtension.php
Commit date: 2023-06-13 17:07:39 -0600
Commit message: Fix for dangerous tags in |map filter

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index 62bfeb483c..ab837d5e00 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,10 +1,12 @@
 # v1.7.42
 ## mm/dd/2023
 
 1. [](#new)
    * Added a new `system.languages.debug` option that adds a `<span class="translate-debug"></span>` around strings translated with `|t`. This can be styled by the theme as needed.
+1. [](#bugfix)
+   * * Fixed Twig `|map()` allowing code execution
 
 # v1.7.41.2
 ## 06/01/2023
 
 1. [](#improved)
diff --git a/system/src/Grav/Common/Twig/Extension/GravExtension.php b/system/src/Grav/Common/Twig/Extension/GravExtension.php
index cfadb0417a..b4f5d70eaa 100644
--- a/system/src/Grav/Common/Twig/Extension/GravExtension.php
+++ b/system/src/Grav/Common/Twig/Extension/GravExtension.php
@@ -171,10 +171,11 @@ class GravExtension extends AbstractExtension implements GlobalsInterface
             new TwigFilter('count', 'count'),
             new TwigFilter('array_diff', 'array_diff'),
 
             // Security fix
             new TwigFilter('filter', [$this, 'filterFilter'], ['needs_environment' => true]),
+            new TwigFilter('map', [$this, 'mapFilter'], ['needs_environment' => true]),
         ];
     }
 
     /**
      * Return a list of all functions.
@@ -1711,6 +1712,22 @@ class GravExtension extends AbstractExtension implements GlobalsInterface
             throw new RuntimeError('Twig |filter("' . $arrow . '") is not allowed.');
         }
 
         return twig_array_filter($env, $array, $arrow);
     }
+
+    /**
+     * @param Environment $env
+     * @param array $array
+     * @param callable|string $arrow
+     * @return array|CallbackFilterIterator
+     * @throws RuntimeError
+     */
+    function mapFilter(Environment $env, $array, $arrow)
+    {
+        if (is_string($arrow) && Utils::isDangerousFunction($arrow)) {
+            throw new RuntimeError('Twig |map("' . $arrow . '") is not allowed.');
+        }
+
+        return twig_array_map($env, $array, $arrow);
+    }
 }

Fixed code: 1. [](#bugfix)
   * * Fixed Twig `|map()` allowing code execution
            new TwigFilter('map', [$this, 'mapFilter'], ['needs_environment' => true]),

    /**
     * @param Environment $env
     * @param array $array
     * @param callable|string $arrow
     * @return array|CallbackFilterIterator
     * @throws RuntimeError
     */
    function mapFilter(Environment $env, $array, $arrow)
    {
        if (is_string($arrow) && Utils::isDangerousFunction($arrow)) {
            throw new RuntimeError('Twig |map("' . $arrow . '") is not allowed.');
        }

        return twig_array_map($env, $array, $arrow);
    }