[Form][Validator] All index items after children are to be considered grand-children when resolving ViolationPath (fixes #11458)
[Form] FormBuilder::getIterator() now deals with resolved children
[DI] Added safeguards against invalid config in the YamlFileLoader

Exceptions explaining the mistake are better than fatal errors or weird
notices appearing when trying to deal with such invalid data.
Closes #11333
improve error when detecting unquoted asterisks

Asterisks in unquoted strings are used in YAML to reference
variables. Before Symfony 2.3.19, Symfony 2.4.9 and Symfony 2.5.4,
unquoted asterisks in inlined YAML code were treated as regular
strings. This was fixed for the inline parser in #11677. However, an
unquoted * character now led to an error message like this:

```
PHP Warning:  array_key_exists(): The first argument should be either a string or an integer in vendor/symfony/symfony/src/Symfony/Component/Yaml/Inline.php on line 409

  [Symfony\Component\Yaml\Exception\ParseException]
  Reference "" does not exist at line 171 (near "- { foo: * }").
```
improve handling router script paths

The `server:run` command switches the working directory before
starting the built-in web server. Therefore, the path to a custom
router script had to be specified based on the document root path
and not based on the user's working directory.
Escape parameter on generated response
bug #11843 [Yaml] improve error message when detecting unquoted asterisks (xabbuh)

This PR was merged into the 2.3 branch.

Discussion
----------

[Yaml] improve error message when detecting unquoted asterisks

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | #11835
| License       | MIT
| Doc PR        |

Asterisks in unquoted strings are used in YAML to reference variables. Before Symfony 2.3.19, Symfony 2.4.9 and Symfony 2.5.4, unquoted asterisks in inlined YAML code were treated as regular strings. This was fixed for the inline parser in #11677. However, an unquoted * character now led to an error message like this:

```
PHP Warning:  array_key_exists(): The first argument should be either a string or an integer in vendor/symfony/symfony/src/Symfony/Component/Yaml/Inline.php on line 409

  [Symfony\Component\Yaml\Exception\ParseException]
  Reference "" does not exist at line 171 (near "- { foo: * }").
```

Commits
-------

854e07b improve error when detecting unquoted asterisks
properly mask escape sequences in quoted strings
[Security] Use hash_equals for constant-time string comparison
[Security] Add more tests for StringUtils::equals
minor #11845 [HttpKernel] Escape ESI url in generated response (Jérémy Derussé)

This PR was merged into the 2.3 branch.

Discussion
----------

[HttpKernel] Escape ESI url in generated response

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets |
| License       | MIT
| Doc PR        | NA

If a template with an `<esi>` tag  is configured with an URL containing a `'` (in  `src` or `alt`) ; the HttpCache will generate invalide php code.

It's not a security issue, given the template and the `<esi>` tag is written by the developper, but, as the character quote is allowed in URL (https://tools.ietf.org/html/rfc3986) it coud be a potential bug.

Commits
-------

b044c45 Escape parameter on generated response
backport more error information from 2.6 to 2.3

The commit on master was:

server:run command: provide more error information

The server:run command didn't provide many information when the executed
command exited unexpectedly. Now, the process' exit code is passed through
and an error message is displayed.
bug #11856 [FrameworkBundle] backport more error information from 2.6 to 2.3 (xabbuh)

This PR was merged into the 2.3 branch.

Discussion
----------

[FrameworkBundle] backport more error information from 2.6 to 2.3

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | #11724
| License       | MIT
| Doc PR        |

Commits
-------

87449e0 backport more error information from 2.6 to 2.3
bug #11850 [YAML] properly mask escape sequences in quoted strings (xabbuh)

This PR was merged into the 2.3 branch.

Discussion
----------

[YAML] properly mask escape sequences in quoted strings

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | #11789
| License       | MIT
| Doc PR        |

Commits
-------

a7d0cf2 properly mask escape sequences in quoted strings
[Security] Fix usage of unexistent method in DoctrineAclCache.
bug #11860 [Security] Fix usage of unexistent method in DoctrineAclCache. (mauchede)

This PR was submitted for the master branch but it was merged into the 2.3 branch instead (closes #11860).

Discussion
----------

[Security] Fix usage of unexistent method in DoctrineAclCache.

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | #10328
| License       | MIT
| Doc PR        |

The method `deleteByPrefix` does not exist. I replaced it by `deleteAll`: as @guilhermeblanco said, this method is not available in the interface `Cache` but it is present in the abstract class `CacheProvider`.

Commits
-------

131abd8 [Security] Fix usage of unexistent method in DoctrineAclCache.
Remove routes for removed WebProfiler actions

The import/export functionality was moved to commands in f38536ab79058f6a934426c41170256ba9623a02, but the routes were not removed.
minor #11868 Remove routes for removed WebProfiler actions (Briareos)

This PR was submitted for the master branch but it was merged into the 2.3 branch instead (closes #11868).

Discussion
----------

Remove routes for removed WebProfiler actions

The import/export functionality was moved to commands in f38536ab79058f6a934426c41170256ba9623a02, but the routes were not removed.

Commits
-------

1421449 Remove routes for removed WebProfiler actions
minor #11844 [FrameworkBundle] improve handling router script paths (xabbuh)

This PR was merged into the 2.3 branch.

Discussion
----------

[FrameworkBundle] improve handling router script paths

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets |
| License       | MIT
| Doc PR        |

The `server:run` command switches the working directory before starting the built-in web server. Therefore, the path to a custom router script had to be specified based on the document root path and not based on the user's working directory.

Another option is to update the documentation (as started in symfony/symfony-docs#4194). Though I think the current behaviour is a bug. The intended behaviour can be derived from the command's help message:

> ```
If you have custom docroot directory layout, you can specify your own
 router script using --router option:

>   ./app/console server:run --router=app/config/router.php
```

As you can see, the path is specified based on the current working directory.

Commits
-------

0a16cf2 improve handling router script paths
[Intl] Added "internal" tag to all classes under Symfony\Component\Intl\ResourceBundle

We didn't have this tag yet when this component was first written. The code in that
namespace is only used for resource bundle generation and was never meant for public
use.