Labyricorn/liquid
1
0
Fork 0
mirror of https://github.com/Shopify/liquid.git synced 2026-10-03 00:55:11 -07:00
Code Issues Packages Projects Releases Wiki Activity

Use an atomic subgroup in range regex to avoid pathological backtracking (#1360)

Browse Source
This commit is contained in:
Dylan Thacker-Smith
2020-11-16 10:29:36 -05:00
committed by GitHub
parent 300adfd7ae
commit 1850511334
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/liquid/expression.rb
+4 -1
View File
@@ -14,7 +14,10 @@ module Liquid
DOUBLE_QUOTED_STRING = /\A\s*"(.*)"\s*\z/m DOUBLE_QUOTED_STRING = /\A\s*"(.*)"\s*\z/m
INTEGERS_REGEX = /\A\s*(-?\d+)\s*\z/ INTEGERS_REGEX = /\A\s*(-?\d+)\s*\z/
FLOATS_REGEX = /\A\s*(-?\d[\d\.]+)\s*\z/ FLOATS_REGEX = /\A\s*(-?\d[\d\.]+)\s*\z/
RANGES_REGEX = /\A\s*\(\s*(\S+)\s*\.\.\s*(\S+)\s*\)\s*\z/
# Use an atomic group (?>...) to avoid pathological backtracing from
# malicious input as described in https://github.com/Shopify/liquid/issues/1357
RANGES_REGEX = /\A\s*\(\s*(?>(\S+)\s*\.\.)\s*(\S+)\s*\)\s*\z/
def self.parse(markup) def self.parse(markup)
case markup case markup