Remove use of ruby taint API for ruby 3.2 compatibility

This commit is contained in:
Dylan Thacker-Smith
2023-01-10 13:11:18 -05:00
parent f2f467bdbc
commit 01d52d72d9
5 changed files with 5 additions and 64 deletions
+1 -1
View File
@@ -39,7 +39,7 @@ module Liquid
end
def escape(input)
CGI.escapeHTML(input.to_s).untaint unless input.nil?
CGI.escapeHTML(input.to_s) unless input.nil?
end
alias_method :h, :escape
+2 -4
View File
@@ -63,10 +63,7 @@ module Liquid
# :strict will enforce correct syntax.
attr_writer :error_mode
# Sets how strict the taint checker should be.
# :lax is the default, and ignores the taint flag completely
# :warn adds a warning, but does not interrupt the rendering
# :error raises an error when tainted output is used
# Deprecated. No longer used. Removed in version 5
attr_writer :taint_mode
attr_accessor :default_exception_renderer
@@ -94,6 +91,7 @@ module Liquid
@error_mode ||= :lax
end
# Deprecated. Removed in version 5
def taint_mode
@taint_mode ||= :lax
end
+1 -24
View File
@@ -84,11 +84,7 @@ module Liquid
context.invoke(filter_name, output, *filter_args)
end
obj = context.apply_global_filter(obj)
taint_check(context, obj)
obj
context.apply_global_filter(obj)
end
private
@@ -120,25 +116,6 @@ module Liquid
parsed_args
end
def taint_check(context, obj)
return unless obj.tainted?
return if Template.taint_mode == :lax
@markup =~ QuotedFragment
name = Regexp.last_match(0)
error = TaintedError.new("variable '#{name}' is tainted and was not escaped")
error.line_number = line_number
error.template_name = context.template_name
case Template.taint_mode
when :warn
context.warnings << error
when :error
raise error
end
end
class ParseTreeVisitor < Liquid::ParseTreeVisitor
def children
[@node.name] + @node.filters.flatten