Package Instance

Twig has a possible sandbox bypass
Under some circumstances, the sandbox security checks are not run which allows user-contributed templates to bypass the sandbox restrictions.

The security issue happens when all these conditions are met:

* The sandbox is disabled globally;
* The sandbox is enabled via a sandboxed `include()` function which references a template name (like `included.twig`) and not a `Template` or `TemplateWrapper` instance;
* The included template has been loaded before the `include()` call but in a non-sandbox context (possible as the sandbox has been globally disabled).

Twig has unguarded calls to `__toString()` when nesting an object into an array
In a sandbox, an attacker can call `__toString()` on an object even if the `__toString()` method is not allowed by the security policy when the object is part of an array or an argument list (arguments to a function or a filter for instance).

Twig has unguarded calls to `__isset()` and to array-accesses when the sandbox is enabled
In a sandbox, and attacker can access attributes of Array-like objects as they were not checked by the security policy.
They are now checked via the property policy and the `__isset()` method is now called after the security check.
**This is a BC break.**