The Security API has received a number of security patches over the past years. The root of many of the fixed issues is that Security API was added as an afterthought after creating a very flexible and permissive language first.
For scenarios where Smarty is used in unsafe context, i.e. where the source for templates comes from non-trusted authors, we might want to be way less permissive in what gets compiled into what. That way, we can harden the Security API properly and stop plugging holes.
The Security API has received a number of security patches over the past years. The root of many of the fixed issues is that Security API was added as an afterthought after creating a very flexible and permissive language first.
For scenarios where Smarty is used in unsafe context, i.e. where the source for templates comes from non-trusted authors, we might want to be way less permissive in what gets compiled into what. That way, we can harden the Security API properly and stop plugging holes.