From 1850511334c555b74232166006a19e987ae7a41d Mon Sep 17 00:00:00 2001
From: Dylan Thacker-Smith <dylan.smith@shopify.com>
Date: Mon, 16 Nov 2020 10:29:36 -0500
Subject: [PATCH] Use an atomic subgroup in range regex to avoid pathological
 backtracking (#1360)

---
 lib/liquid/expression.rb | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/lib/liquid/expression.rb b/lib/liquid/expression.rb
index 69c74721..c2c27909 100644
--- a/lib/liquid/expression.rb
+++ b/lib/liquid/expression.rb
@@ -14,7 +14,10 @@ module Liquid
     DOUBLE_QUOTED_STRING = /\A\s*"(.*)"\s*\z/m
     INTEGERS_REGEX       = /\A\s*(-?\d+)\s*\z/
     FLOATS_REGEX         = /\A\s*(-?\d[\d\.]+)\s*\z/
-    RANGES_REGEX         = /\A\s*\(\s*(\S+)\s*\.\.\s*(\S+)\s*\)\s*\z/
+
+    # Use an atomic group (?>...) to avoid pathological backtracing from
+    # malicious input as described in https://github.com/Shopify/liquid/issues/1357
+    RANGES_REGEX         = /\A\s*\(\s*(?>(\S+)\s*\.\.)\s*(\S+)\s*\)\s*\z/
 
     def self.parse(markup)
       case markup