Remove support for taint checking

This commit is contained in:
Dylan Thacker-Smith
2020-07-23 16:22:46 -04:00
parent 1feaa63813
commit 065ccbc4aa
8 changed files with 3 additions and 122 deletions
+1 -22
View File
@@ -86,9 +86,7 @@ module Liquid
context.invoke(filter_name, output, *filter_args)
end
obj = context.apply_global_filter(obj)
taint_check(context, obj)
obj
context.apply_global_filter(obj)
end
def render_to_output_buffer(context, output)
@@ -142,25 +140,6 @@ module Liquid
parsed_args
end
def taint_check(context, obj)
return if Template.taint_mode == :lax
return unless obj.tainted?
@markup =~ QuotedFragment
name = Regexp.last_match(0)
error = TaintedError.new("variable '#{name}' is tainted and was not escaped")
error.line_number = line_number
error.template_name = context.template_name
case Template.taint_mode
when :warn
context.warnings << error
when :error
raise error
end
end
class ParseTreeVisitor < Liquid::ParseTreeVisitor
def children
[@node.name] + @node.filters.flatten