[5.4] Fix Blade @parent issue

[themsaid]

This is an attempt to fix #10068, currently if a variable was passed to the view that contains the string @parent, Blade tries to compile this string as a @parent directive causing appending the parent content into the view if a parent section exists, or if not the @parent string will be stripped from the response.

This PR attempts to fix this by replacing the actual @parent directive with a different placeholder, the change is breaking because any @parent that exists in the blade file will be replaced, so for example this echo {{ '@parent' }} won't work.

[GrahamCampbell]

But the new placeholder can still be abused though, right?

[themsaid]

Yeah if you have a ##parent-placeholder## string it'll be a problem, but I don't think this string is common, unlike @parent.

[GrahamCampbell]

It doesn't fix the potential security problem we have here were users can inject this string.

[taylorotwell]

We've never actually found that this is a "security" problem, tbh. I do agree however that it would be nice if we could just totally eliminate the issue instead of changing to a different string. I've forgotten why that is somewhat difficult.

[themsaid]

@taylorotwell well the point is that the replacement of @parent has to happen after the sections actually render, so if any of the dynamic content contains the string @parent it'll be replaced.

This PR #10122 was trying to fix using ob_get_length() but was reverted for some reason, I assume this approach won't work if you use @include inside a section thus the length of the content changes causing the replacement to break.

This PR replaces a common string @parent with a less common one ##parent-placeholder## and thus decreases the possibility of encountering the issue.

[vlakoff]

Maybe you could add some random suffix, e.g. '##parent-placeholder-'.Str::random(16).'##', this shouldn't be too hard to implement and we would be sure to be on the safe side.

[taylorotwell]

The random token may work to further make it tougher to run into the issue and prevent people from easily guessing the token. Though I'm not sure there is really even a security issue.

[themsaid]

I don't think it should be considered as a security issue, I consider it a limitation on using the string @parent which will be replaced with '' or the value of the parent section content if any.

[taylorotwell]

This function doesn't seem to be used anywhere?

[themsaid]

It's called from here: https://github.com/laravel/framework/blob/5.3/src/Illuminate/View/Compilers/BladeCompiler.php#L327

[vlakoff]

Refs subsequent 16f72a5 :)

[halaei]

To fit the issue, can you consider somehow putting @parent related placeholder outside the string so no one can dynamically inject it?