{"action":"opened","issue":{"url":"https://api.github.com/repos/cakephp/cakephp/issues/8554","repository_url":"https://api.github.com/repos/cakephp/cakephp","labels_url":"https://api.github.com/repos/cakephp/cakephp/issues/8554/labels{/name}","comments_url":"https://api.github.com/repos/cakephp/cakephp/issues/8554/comments","events_url":"https://api.github.com/repos/cakephp/cakephp/issues/8554/events","html_url":"https://github.com/cakephp/cakephp/issues/8554","id":143861366,"number":8554,"title":"StringTemplateTrait does not fail for missing templates.","user":{"login":"thinkingmedia","id":551022,"avatar_url":"https://avatars.githubusercontent.com/u/551022?v=3","gravatar_id":"","url":"https://api.github.com/users/thinkingmedia","html_url":"https://github.com/thinkingmedia","followers_url":"https://api.github.com/users/thinkingmedia/followers","following_url":"https://api.github.com/users/thinkingmedia/following{/other_user}","gists_url":"https://api.github.com/users/thinkingmedia/gists{/gist_id}","starred_url":"https://api.github.com/users/thinkingmedia/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thinkingmedia/subscriptions","organizations_url":"https://api.github.com/users/thinkingmedia/orgs","repos_url":"https://api.github.com/users/thinkingmedia/repos","events_url":"https://api.github.com/users/thinkingmedia/events{/privacy}","received_events_url":"https://api.github.com/users/thinkingmedia/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2016-03-27T23:49:33Z","updated_at":"2016-03-27T23:49:33Z","closed_at":null,"body":"This is a (multiple allowed):\r\n* [x] bug\r\n* [ ] enhancement\r\n* [x] feature-discussion (RFC)\r\n\r\n* CakePHP Version: 3.2.1\r\n* Platform and Target: Apache, MySQL, Windows 10, PHP 7\r\n\r\n### What you did\r\n\r\nCreated a helper that uses the `StringTemplateTrait`.\r\n\r\n```\r\nclass MyHelper extends Helper {\r\n    use StringTemplateTrait;\r\n\r\n    protected $_defaultConfig = [\r\n       'templates' => [\r\n             'Bar' => 'hello'\r\n        ]\r\n   ];\r\n\r\n   public function Foo() {\r\n       return $this->formatTemplate('Oops',[]);\r\n   }\r\n}\r\n```\r\n\r\nThe template `Oops` does not exist.\r\n\r\nSome where else like a view\r\n\r\n```\r\n     <?= $this->My->Foo().\" world\" ?>\r\n```\r\n\r\nThe view still renders without error. No warning is given to the developer that the output is not as expected.\r\n\r\n### Expected Behavior\r\n\r\nShould trigger an error that the template `Oops` does not exist.\r\n\r\n### Actual Behavior\r\n\r\nThe `Foo()` method returns `null` which mutates into an empty string. The rendered output for the view is ` world`, but the expected output `hello world` is not generated.\r\n\r\nI experienced this as a security bug in my app. The JavaScript code that was suppose to be injected into the view was from a template, but the name has a spelling mistake. The output for the view mutated the `null` into an empty string. This resulted in valid JavaScript code that was missing an important chunk from the template.\r\n"}}