From 01d52d72d957ae47aebb3b6f3438800ed2d98241 Mon Sep 17 00:00:00 2001
From: Dylan Thacker-Smith <Dylan.Smith@shopify.com>
Date: Tue, 10 Jan 2023 13:11:18 -0500
Subject: [PATCH] Remove use of ruby taint API for ruby 3.2 compatibility

---
 lib/liquid/standardfilters.rb |  2 +-
 lib/liquid/template.rb        |  6 ++----
 lib/liquid/variable.rb        | 25 +------------------------
 test/integration/drop_test.rb | 28 +---------------------------
 test/test_helper.rb           |  8 --------
 5 files changed, 5 insertions(+), 64 deletions(-)

diff --git a/lib/liquid/standardfilters.rb b/lib/liquid/standardfilters.rb
index 0bddfa97..fffee4de 100644
--- a/lib/liquid/standardfilters.rb
+++ b/lib/liquid/standardfilters.rb
@@ -39,7 +39,7 @@ module Liquid
     end
 
     def escape(input)
-      CGI.escapeHTML(input.to_s).untaint unless input.nil?
+      CGI.escapeHTML(input.to_s) unless input.nil?
     end
     alias_method :h, :escape
 
diff --git a/lib/liquid/template.rb b/lib/liquid/template.rb
index 31a67e49..ba429ec0 100644
--- a/lib/liquid/template.rb
+++ b/lib/liquid/template.rb
@@ -63,10 +63,7 @@ module Liquid
       # :strict will enforce correct syntax.
       attr_writer :error_mode
 
-      # Sets how strict the taint checker should be.
-      # :lax is the default, and ignores the taint flag completely
-      # :warn adds a warning, but does not interrupt the rendering
-      # :error raises an error when tainted output is used
+      # Deprecated. No longer used. Removed in version 5
       attr_writer :taint_mode
 
       attr_accessor :default_exception_renderer
@@ -94,6 +91,7 @@ module Liquid
         @error_mode ||= :lax
       end
 
+      # Deprecated. Removed in version 5
       def taint_mode
         @taint_mode ||= :lax
       end
diff --git a/lib/liquid/variable.rb b/lib/liquid/variable.rb
index c31bffe5..8d63eb14 100644
--- a/lib/liquid/variable.rb
+++ b/lib/liquid/variable.rb
@@ -84,11 +84,7 @@ module Liquid
         context.invoke(filter_name, output, *filter_args)
       end
 
-      obj = context.apply_global_filter(obj)
-
-      taint_check(context, obj)
-
-      obj
+      context.apply_global_filter(obj)
     end
 
     private
@@ -120,25 +116,6 @@ module Liquid
       parsed_args
     end
 
-    def taint_check(context, obj)
-      return unless obj.tainted?
-      return if Template.taint_mode == :lax
-
-      @markup =~ QuotedFragment
-      name = Regexp.last_match(0)
-
-      error = TaintedError.new("variable '#{name}' is tainted and was not escaped")
-      error.line_number = line_number
-      error.template_name = context.template_name
-
-      case Template.taint_mode
-      when :warn
-        context.warnings << error
-      when :error
-        raise error
-      end
-    end
-
     class ParseTreeVisitor < Liquid::ParseTreeVisitor
       def children
         [@node.name] + @node.filters.flatten
diff --git a/test/integration/drop_test.rb b/test/integration/drop_test.rb
index 2de4a5a1..723fe042 100644
--- a/test/integration/drop_test.rb
+++ b/test/integration/drop_test.rb
@@ -48,7 +48,7 @@ class ProductDrop < Liquid::Drop
   end
 
   def user_input
-    "foo".taint
+    "foo"
   end
 
   protected
@@ -112,32 +112,6 @@ class DropsTest < Minitest::Test
     assert_equal '  ', tpl.render!('product' => ProductDrop.new)
   end
 
-  def test_rendering_raises_on_tainted_attr
-    with_taint_mode(:error) do
-      tpl = Liquid::Template.parse('{{ product.user_input }}')
-      assert_raises TaintedError do
-        tpl.render!('product' => ProductDrop.new)
-      end
-    end
-  end
-
-  def test_rendering_warns_on_tainted_attr
-    with_taint_mode(:warn) do
-      tpl = Liquid::Template.parse('{{ product.user_input }}')
-      context = Context.new('product' => ProductDrop.new)
-      tpl.render!(context)
-      assert_equal [Liquid::TaintedError], context.warnings.map(&:class)
-      assert_equal "variable 'product.user_input' is tainted and was not escaped", context.warnings.first.to_s(false)
-    end
-  end
-
-  def test_rendering_doesnt_raise_on_escaped_tainted_attr
-    with_taint_mode(:error) do
-      tpl = Liquid::Template.parse('{{ product.user_input | escape }}')
-      tpl.render!('product' => ProductDrop.new)
-    end
-  end
-
   def test_drop_does_only_respond_to_whitelisted_methods
     assert_equal "", Liquid::Template.parse("{{ product.inspect }}").render!('product' => ProductDrop.new)
     assert_equal "", Liquid::Template.parse("{{ product.pretty_inspect }}").render!('product' => ProductDrop.new)
diff --git a/test/test_helper.rb b/test/test_helper.rb
index ac5ab53d..3cee6766 100755
--- a/test/test_helper.rb
+++ b/test/test_helper.rb
@@ -69,14 +69,6 @@ module Minitest
       Liquid::Strainer.class_variable_set(:@@global_strainer, original_global_strainer)
     end
 
-    def with_taint_mode(mode)
-      old_mode = Liquid::Template.taint_mode
-      Liquid::Template.taint_mode = mode
-      yield
-    ensure
-      Liquid::Template.taint_mode = old_mode
-    end
-
     def with_error_mode(mode)
       old_mode = Liquid::Template.error_mode
       Liquid::Template.error_mode = mode