Remove deprecated code

Author: fabpot

CHANGELOG

@@ -4,6 +4,9 @@
  * Always allow printing a `Markup` object in a sandbox, whatever the security policy is
  * Remove the `Twig\Sandbox\SourcePolicyInterface` interface and the corresponding argument of `Twig\Extension\SandboxExtension::__construct()`
  * Enforce the `parent`, `block`, and `attribute` functions against the sandbox `allowedFunctions` allow-list
+ * Enforce tests against the sandbox `allowedTests` allow-list and add the `$allowedTests` argument to `Twig\Sandbox\SecurityPolicy::__construct()`
+ * Add a fourth `array $tests` argument to `Twig\Sandbox\SecurityPolicyInterface::checkSecurity()`
+ * Throw a `SyntaxError` when an `extends`, `use`, or `macro` tag is not at the root of a template
 
 # 4.0.0 alpha 1 (2026-05-17)
 

doc/sandbox.rst

@@ -42,11 +42,10 @@ Everything else won't be allowed and will generate a
 
 .. note::
 
-    The ``allowedTests`` argument is available since Twig 3.28 (in earlier
-    versions all tests were always allowed). Most built-in tests (``empty``,
-    ``defined``, ``even``, ``same as``, ``iterable``, etc.) are always allowed
-    and do not need to be listed. Only custom tests and the built-in
-    ``constant`` test must be allow-listed like filters and functions.
+    Most built-in tests (``empty``, ``defined``, ``even``, ``same as``,
+    ``iterable``, etc.) are always allowed and do not need to be listed. Only
+    custom tests and the built-in ``constant`` test must be allow-listed like
+    filters and functions.
 
 .. note::
 
@@ -149,12 +148,11 @@ iterated items). That transitive behavior is documented separately under
 the sandbox model. The criteria above are about what the item itself
 exposes, not about how its arguments behave.
 
-Built-ins That Will Be Always Allowed in 4.0
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+Built-ins That Are Always Allowed
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-The following Twig built-ins meet the criteria above and will have the
-``always_allowed_in_sandbox`` flag set in Twig 4.0. They still need to be
-explicitly allow-listed in 3.x.
+The following Twig built-ins meet the criteria above and have the
+``always_allowed_in_sandbox`` flag set, so they never need to be allow-listed.
 
 * Tags: ``apply``, ``block``, ``do``, ``for``, ``guard``, ``if``, ``macro``,
   ``set``, ``types``, ``with``.
@@ -165,18 +163,14 @@ explicitly allow-listed in 3.x.
   ``title``, ``trim``, ``upper``, ``url_encode``.
 * Functions: ``cycle``, ``max``, ``min``.
 
-When upgrading to 4.0, you can drop these names from your ``SecurityPolicy``
-allow-lists. Leaving them in is harmless: listing a name that is always
-allowed has no effect.
+Listing one of these names in your ``SecurityPolicy`` is harmless: it has no
+effect.
 
 The corresponding built-in tests (``defined``, ``divisible by``, ``empty``,
 ``even``, ``iterable``, ``mapping``, ``none``, ``null``, ``odd``, ``same as``,
-``sequence``, ``true``) are **already** flagged as always allowed since Twig
-3.28, so they never need to be allow-listed. This is safe because tests were
-never enforced by the sandbox before 3.28: flagging them keeps existing
-templates working unchanged. The ``constant`` test is the exception: it reaches
-into the PHP runtime, so it is not always allowed and must be allow-listed (it
-is still implicitly allowed in 3.x with a deprecation, and rejected in 4.0).
+``sequence``, ``true``) are also always allowed, so they never need to be
+allow-listed. The ``constant`` test is the exception: it reaches into the PHP
+runtime, so it is not always allowed and must be allow-listed.
 
 Enabling the Sandbox
 --------------------

phpstan-baseline.neon

@@ -1,12 +1,5 @@
 parameters:
 	ignoreErrors:
-		- # The "$tests" parameter is documented now and will be part of the signature in 4.0
-			message: '#^PHPDoc tag @param references unknown parameter\: \$tests$#'
-			identifier: parameter.notFound
-			count: 1
-			path: src/Sandbox/SecurityPolicyInterface.php
-
-
 		- # 2 parameters will be required
 			message: '#^Method Twig\\Node\\IncludeNode\:\:addGetTemplate\(\) invoked with 2 parameters, 1 required\.$#'
 			identifier: arguments.count

src/Extension/SandboxExtension.php

@@ -65,29 +65,11 @@ public function getSecurityPolicy(): SecurityPolicyInterface
         return $this->policy;
     }
 
-    public function checkSecurity($tags, $filters, $functions, $tests = [], $source = null): void
+    public function checkSecurity($tags, $filters, $functions, $tests = [], ?Source $source = null): void
     {
-        // BC: previous signature was checkSecurity($tags, $filters, $functions, ?Source $source = null);
-        // detect a legacy call where the 4th positional argument was the Source.
-        if ($tests instanceof Source || (null === $tests && \func_num_args() < 5)) {
-            trigger_deprecation('twig/twig', '3.28', 'Passing a "Twig\Source" as the 4th argument of "%s()" is deprecated; pass an array of tests instead.', __METHOD__);
-            $source = $tests;
-            $tests = [];
-        }
-
-        if (!$this->isSandboxed($source)) {
-            return;
-        }
-
-        if ((new \ReflectionMethod($this->policy, 'checkSecurity'))->getNumberOfParameters() >= 4) {
+        if ($this->isSandboxed($source)) {
             $this->policy->checkSecurity($tags, $filters, $functions, $tests);
-
-            return;
         }
-
-        trigger_deprecation('twig/twig', '3.28', 'The "%s::checkSecurity()" method will take a 4th "array $tests" argument in 4.0; not declaring it is deprecated.', $this->policy::class);
-
-        $this->policy->checkSecurity($tags, $filters, $functions);
     }
 
     public function checkMethodAllowed($obj, $method, int $lineno = -1, ?Source $source = null): void

src/Node/CheckSecurityNode.php

@@ -31,12 +31,8 @@ class CheckSecurityNode extends Node
      * @param array<string, int> $usedFunctions
      * @param array<string, int> $usedTests
      */
-    public function __construct(array $usedFilters, array $usedTags, array $usedFunctions, array $usedTests = [])
+    public function __construct(array $usedFilters, array $usedTags, array $usedFunctions, array $usedTests)
     {
-        if (\func_num_args() < 4) {
-            trigger_deprecation('twig/twig', '3.28', 'Not passing the "$usedTests" argument to "%s::__construct()" is deprecated; it will be required in 4.0.', static::class);
-        }
-
         $this->usedFilters = $usedFilters;
         $this->usedTags = $usedTags;
         $this->usedFunctions = $usedFunctions;

src/NodeVisitor/CorrectnessNodeVisitor.php

@@ -159,7 +159,7 @@ private function checkConfigTag(ConfigNode $node): void
         }
 
         if (!isset($this->rootNodes[$node])) {
-            trigger_deprecation('twig/twig', '3.27', 'Using the "%s" tag outside the root of a template is deprecated in %s at line %d.', $node->getNodeTag(), $node->getSourceContext()->getName(), $node->getTemplateLine());
+            throw new SyntaxError(\sprintf('The "%s" tag can only be used at the root of a template.', $node->getNodeTag()), $node->getTemplateLine(), $node->getSourceContext());
         }
     }
 

src/Sandbox/SecurityPolicy.php

@@ -42,7 +42,6 @@ final class SecurityPolicy implements SecurityPolicyInterface
      * @var string[]
      */
     private array $allowedTests;
-    private bool $strict = false;
 
     public function __construct(array $allowedTags = [], array $allowedFilters = [], array $allowedMethods = [], array $allowedProperties = [], array $allowedFunctions = [], array $allowedTests = [])
     {
@@ -100,12 +99,8 @@ public function setStrict(bool $strict): void
     {
     }
 
-    public function checkSecurity($tags, $filters, $functions, array $tests = []): void
+    public function checkSecurity($tags, $filters, $functions, array $tests): void
     {
-        if (\func_num_args() < 4) {
-            trigger_deprecation('twig/twig', '3.28', 'Not passing the "$tests" argument to "%s::checkSecurity()" is deprecated; it will be required in 4.0.', static::class);
-        }
-
         foreach ($tags as $tag) {
             if (!\in_array($tag, $this->allowedTags, true)) {
                 throw new SecurityNotAllowedTagError(\sprintf('Tag "%s" is not allowed.', $tag), $tag);
@@ -126,11 +121,7 @@ public function checkSecurity($tags, $filters, $functions, array $tests = []): v
 
         foreach ($tests as $test) {
             if (!\in_array($test, $this->allowedTests, true)) {
-                if (!$this->strict) {
-                    trigger_deprecation('twig/twig', '3.28', 'The "%s" test is always allowed in sandboxes, but won\'t be in 4.0, please enable it explicitly in your sandbox policy if needed (or enable strict mode on the security policy to opt-in to the 4.0 behavior now).', $test);
-                } else {
-                    throw new SecurityNotAllowedTestError(\sprintf('Test "%s" is not allowed.', $test), $test);
-                }
+                throw new SecurityNotAllowedTestError(\sprintf('Test "%s" is not allowed.', $test), $test);
             }
         }
     }

src/Sandbox/SecurityPolicyInterface.php

@@ -26,7 +26,7 @@ interface SecurityPolicyInterface
      *
      * @throws SecurityError
      */
-    public function checkSecurity($tags, $filters, $functions/* , array $tests */): void;
+    public function checkSecurity($tags, $filters, $functions, array $tests): void;
 
     /**
      * @param object $obj