Thank you@nicolas-grekas.

Yes, this would not be needed if people were able to use a real kernel.secret. But apparently, many fail.

imho the issue is that it is not actually mandatory at all. Even theUriSigner allows an empty secret and in theConfiguration tree of theFrameworkBundle,framework.secret is allowed to be anything. Currently onlysymfony/flex will automatically generate anAPP_SECRET for you when you first set up the project. But that does not help if you either do not setup your project viasymfony/flex or when you deploy the website to the live environment.

In any case, will this change also be back ported to Symfony 5.4?

@fritzmg I can't find the relevant page in the doc but backports are not applied in the Symfony ecosystem. This new way to render is a feature, it can't land on a previous release.

But it's a security issue that arbitrary code can be executed via the_fragment controller.

Fair enough, does it require a CVE issue? 😬

There is no security issue when one sets the secret as documented.

Let's merge the fix in 5.4 and 6.2 as well.

See#50238