Blocklist rather than allowlist for create()

GHSA-94rc-cqvm-m4pw isn’t really a concern anymore thanks to Twig sandboxing.

Fully resolves #18376

Author: brandonkelly

CHANGELOG.md

@@ -2,6 +2,7 @@
 
 ## Unreleased
 
+- Most classes can now be instantiated via the `create()` Twig function. ([#18376](https://github.com/craftcms/cms/discussions/18376))
 - Fixed a bug where element search query caches weren’t getting invalidated when elements’ search keywords were indexed. ([#18275](https://github.com/craftcms/cms/issues/18275))
 
 ## 4.17.12 - 2026-03-26

src/web/twig/Extension.php

@@ -64,9 +64,13 @@
 use DateTime;
 use DateTimeInterface;
 use DateTimeZone;
+use DirectoryIterator;
+use GuzzleHttp\Psr7\FnStream;
 use Illuminate\Support\Collection;
 use IteratorAggregate;
 use Money\Money;
+use SimpleXMLElement;
+use Symfony\Component\Process\Process;
 use Throwable;
 use Traversable;
 use Twig\DeprecatedCallableInfo;
@@ -82,6 +86,7 @@
 use yii\base\BaseObject;
 use yii\base\InvalidArgumentException;
 use yii\base\InvalidConfigException;
+use yii\behaviors\AttributeTypecastBehavior;
 use yii\db\Exception;
 use yii\db\Expression;
 use yii\db\QueryInterface;
@@ -1495,11 +1500,22 @@ public function collectFunction(mixed $var): Collection
     public function createFunction(string|array $type, array $params = []): object
     {
         $class = is_string($type) ? $type : ($type['__class'] ?? $type['class'] ?? null);
-        if (
-            !is_subclass_of($class, BaseObject::class) &&
-            !str_starts_with($class, 'craft\\helpers\\')
-        ) {
-            throw new InvalidArgumentException(sprintf('create() can only be used to create instances of %s.', BaseObject::class));
+        if (!$class) {
+            throw new InvalidArgumentException('No class specified for create().');
+        }
+
+        $blocklist = [
+            AttributeTypecastBehavior::class,
+            DirectoryIterator::class,
+            FnStream::class,
+            Process::class,
+            SimpleXMLElement::class,
+        ];
+
+        foreach ($blocklist as $c) {
+            if (is_a($class, $c, true)) {
+                throw new InvalidArgumentException(sprintf('create() cannot be used to create instances of %s.', $class));
+            }
         }
 
         /** @var BaseObject */