Merge pull request #5727 from magento-tsg/2.4.0-develop-pr45

[TSG] Fixes for 2.4 (pr45) (2.4.0-develop)

Author: zakdma

dev/tests/integration/testsuite/Magento/Framework/Filter/VariableResolver/LegacyResolverTest.php

@@ -117,6 +117,7 @@ public function getThing()
                 ['foo' => $dataClassStub, 'g' => ['h' => ['i' => 'abc']]],
                 'abca=123,b=321,'
             ],
+            'disallow __callParent method' => ['foo.___callParent()',['foo' => $classStub], null],
         ];
     }
 }

lib/internal/Magento/Framework/Filter/VariableResolver/LegacyResolver.php

@@ -160,12 +160,31 @@ private function handleObjectMethod(Template $filter, array $templateVariables,
     {
         $object = $stackArgs[$i - 1]['variable'];
         $method = $stackArgs[$i]['name'];
-        if (method_exists($object, $method) && substr($method, 0, 3) !== 'set') {
+        if ($this->isMethodCallable($object, $method)) {
             $args = $this->getStackArgs($stackArgs[$i]['args'], $filter, $templateVariables);
             $stackArgs[$i]['variable'] = call_user_func_array([$object, $method], $args);
         }
     }
 
+    /**
+     * Check if object method can be called.
+     *
+     * @param mixed $object
+     * @param string $method
+     * @return bool
+     */
+    private function isMethodCallable($object, string $method): bool
+    {
+        if (method_exists($object, $method)
+            && substr($method, 0, 3) !== 'set'
+            && $method !== '___callParent'
+        ) {
+            return true;
+        }
+
+        return false;
+    }
+
     /**
      * Return if the given index should be processed for data access
      *