Twig sandbox policy restricts important filter

[vladko312]

Twig Sandbox policy does not include escape filter which is used internally for autoescaping. Because of that, payloads other than simple literals will not work.
For example:

• {{49}} - works
• {{7*7}} - error

[vladko312]

Also, maybe create two routes with different policies:

• One restrictive policy that blocks all but the most basic features
• One policy where only known exploitable features are blocked

Or alternatively make it possible to configure the policy somewhere using JSON, and add presets to quickly load common examples

[m10x]

When setting up the sandboxes, I went with the configurations shown in the documentation: https://twig.symfony.com/doc/3.x/sandbox.html#configuring-the-sandbox-policy

But yeah, I see that it is REALLY restrictive in the case of Twig.
I have nothing against the idea to add another endpoint for "One policy where only known exploitable features are blocked". If you have a policy that you would like to see, I can add it.