Convert Strainer to white-list method protection

After moving the method existence check from Context into Strainer,
updated Strainer to only accept invokation methods that were added via
filter Modules, and done in a way that respond_to? is never called,
preventing unconstrained Symbol table growth.
This commit is contained in:
Jason Roelofs
2013-01-16 11:14:01 -05:00
parent a48e162237
commit 1300210f05
4 changed files with 70 additions and 42 deletions
+1 -5
View File
@@ -71,11 +71,7 @@ module Liquid
end
def invoke(method, *args)
if strainer.respond_to?(method)
strainer.__send__(method, *args)
else
args.first
end
strainer.invoke(method, *args)
end
# Push new local scope on the stack. use <tt>Context#stack</tt> instead