From 01d52d72d957ae47aebb3b6f3438800ed2d98241 Mon Sep 17 00:00:00 2001 From: Dylan Thacker-Smith Date: Tue, 10 Jan 2023 13:11:18 -0500 Subject: [PATCH 1/8] Remove use of ruby taint API for ruby 3.2 compatibility --- lib/liquid/standardfilters.rb | 2 +- lib/liquid/template.rb | 6 ++---- lib/liquid/variable.rb | 25 +------------------------ test/integration/drop_test.rb | 28 +--------------------------- test/test_helper.rb | 8 -------- 5 files changed, 5 insertions(+), 64 deletions(-) diff --git a/lib/liquid/standardfilters.rb b/lib/liquid/standardfilters.rb index 0bddfa97..fffee4de 100644 --- a/lib/liquid/standardfilters.rb +++ b/lib/liquid/standardfilters.rb @@ -39,7 +39,7 @@ module Liquid end def escape(input) - CGI.escapeHTML(input.to_s).untaint unless input.nil? + CGI.escapeHTML(input.to_s) unless input.nil? end alias_method :h, :escape diff --git a/lib/liquid/template.rb b/lib/liquid/template.rb index 31a67e49..ba429ec0 100644 --- a/lib/liquid/template.rb +++ b/lib/liquid/template.rb @@ -63,10 +63,7 @@ module Liquid # :strict will enforce correct syntax. attr_writer :error_mode - # Sets how strict the taint checker should be. - # :lax is the default, and ignores the taint flag completely - # :warn adds a warning, but does not interrupt the rendering - # :error raises an error when tainted output is used + # Deprecated. No longer used. Removed in version 5 attr_writer :taint_mode attr_accessor :default_exception_renderer @@ -94,6 +91,7 @@ module Liquid @error_mode ||= :lax end + # Deprecated. Removed in version 5 def taint_mode @taint_mode ||= :lax end diff --git a/lib/liquid/variable.rb b/lib/liquid/variable.rb index c31bffe5..8d63eb14 100644 --- a/lib/liquid/variable.rb +++ b/lib/liquid/variable.rb @@ -84,11 +84,7 @@ module Liquid context.invoke(filter_name, output, *filter_args) end - obj = context.apply_global_filter(obj) - - taint_check(context, obj) - - obj + context.apply_global_filter(obj) end private @@ -120,25 +116,6 @@ module Liquid parsed_args end - def taint_check(context, obj) - return unless obj.tainted? - return if Template.taint_mode == :lax - - @markup =~ QuotedFragment - name = Regexp.last_match(0) - - error = TaintedError.new("variable '#{name}' is tainted and was not escaped") - error.line_number = line_number - error.template_name = context.template_name - - case Template.taint_mode - when :warn - context.warnings << error - when :error - raise error - end - end - class ParseTreeVisitor < Liquid::ParseTreeVisitor def children [@node.name] + @node.filters.flatten diff --git a/test/integration/drop_test.rb b/test/integration/drop_test.rb index 2de4a5a1..723fe042 100644 --- a/test/integration/drop_test.rb +++ b/test/integration/drop_test.rb @@ -48,7 +48,7 @@ class ProductDrop < Liquid::Drop end def user_input - "foo".taint + "foo" end protected @@ -112,32 +112,6 @@ class DropsTest < Minitest::Test assert_equal ' ', tpl.render!('product' => ProductDrop.new) end - def test_rendering_raises_on_tainted_attr - with_taint_mode(:error) do - tpl = Liquid::Template.parse('{{ product.user_input }}') - assert_raises TaintedError do - tpl.render!('product' => ProductDrop.new) - end - end - end - - def test_rendering_warns_on_tainted_attr - with_taint_mode(:warn) do - tpl = Liquid::Template.parse('{{ product.user_input }}') - context = Context.new('product' => ProductDrop.new) - tpl.render!(context) - assert_equal [Liquid::TaintedError], context.warnings.map(&:class) - assert_equal "variable 'product.user_input' is tainted and was not escaped", context.warnings.first.to_s(false) - end - end - - def test_rendering_doesnt_raise_on_escaped_tainted_attr - with_taint_mode(:error) do - tpl = Liquid::Template.parse('{{ product.user_input | escape }}') - tpl.render!('product' => ProductDrop.new) - end - end - def test_drop_does_only_respond_to_whitelisted_methods assert_equal "", Liquid::Template.parse("{{ product.inspect }}").render!('product' => ProductDrop.new) assert_equal "", Liquid::Template.parse("{{ product.pretty_inspect }}").render!('product' => ProductDrop.new) diff --git a/test/test_helper.rb b/test/test_helper.rb index ac5ab53d..3cee6766 100755 --- a/test/test_helper.rb +++ b/test/test_helper.rb @@ -69,14 +69,6 @@ module Minitest Liquid::Strainer.class_variable_set(:@@global_strainer, original_global_strainer) end - def with_taint_mode(mode) - old_mode = Liquid::Template.taint_mode - Liquid::Template.taint_mode = mode - yield - ensure - Liquid::Template.taint_mode = old_mode - end - def with_error_mode(mode) old_mode = Liquid::Template.error_mode Liquid::Template.error_mode = mode From 0487badd0316486ec69ae66045eb3732f54f5051 Mon Sep 17 00:00:00 2001 From: Dylan Thacker-Smith Date: Tue, 10 Jan 2023 13:30:55 -0500 Subject: [PATCH 2/8] Use liquid-c 4.0.0 --- Gemfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Gemfile b/Gemfile index bdeefac7..13865b18 100644 --- a/Gemfile +++ b/Gemfile @@ -15,6 +15,6 @@ group :test do gem 'rubocop', '~> 0.49.0' platform :mri do - gem 'liquid-c', github: 'Shopify/liquid-c', ref: '9168659de45d6d576fce30c735f857e597fa26f6' + gem 'liquid-c', '~> 4.0.0' end end From abfcec9a57543d9e1bdda7dab195607f8574d8b4 Mon Sep 17 00:00:00 2001 From: Dylan Thacker-Smith Date: Tue, 31 Mar 2020 10:19:25 -0400 Subject: [PATCH 3/8] Fix ParseTreeVisitorTest for ruby 3 compatibility (cherry picked from commit 81149344a5ba53b30e8ab7d77d605dc484a0a3ff) --- test/integration/parse_tree_visitor_test.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/integration/parse_tree_visitor_test.rb b/test/integration/parse_tree_visitor_test.rb index 6ad6a2d0..933dbc3b 100644 --- a/test/integration/parse_tree_visitor_test.rb +++ b/test/integration/parse_tree_visitor_test.rb @@ -238,7 +238,7 @@ class ParseTreeVisitorTest < Minitest::Test def traversal(template) ParseTreeVisitor .for(Template.parse(template).root) - .add_callback_for(VariableLookup, &:name) + .add_callback_for(VariableLookup) { |node| node.name } # rubocop:disable Style/SymbolProc end def visit(template) From dd70fcfec8abf9cc29be78ca1ce51c8315a6117d Mon Sep 17 00:00:00 2001 From: Dylan Thacker-Smith Date: Tue, 10 Jan 2023 14:00:38 -0500 Subject: [PATCH 4/8] Bump rake for ruby 3.2 compatibility --- liquid.gemspec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/liquid.gemspec b/liquid.gemspec index e0e4ddbf..5dacaf3f 100644 --- a/liquid.gemspec +++ b/liquid.gemspec @@ -26,6 +26,6 @@ Gem::Specification.new do |s| s.require_path = "lib" - s.add_development_dependency 'rake', '~> 11.3' + s.add_development_dependency 'rake', '~> 13.0' s.add_development_dependency 'minitest' end From f199ba07152802d75e1873b98b419b6abbe16b13 Mon Sep 17 00:00:00 2001 From: Dylan Thacker-Smith Date: Tue, 10 Jan 2023 14:39:06 -0500 Subject: [PATCH 5/8] Backport CI migration --- .github/probots.yml | 2 -- .github/workflows/cla.yml | 22 ++++++++++++++++++++++ .github/workflows/liquid.yml | 27 +++++++++++++++++++++++++++ .travis.yml | 32 -------------------------------- 4 files changed, 49 insertions(+), 34 deletions(-) delete mode 100644 .github/probots.yml create mode 100644 .github/workflows/cla.yml create mode 100644 .github/workflows/liquid.yml delete mode 100644 .travis.yml diff --git a/.github/probots.yml b/.github/probots.yml deleted file mode 100644 index 1491d275..00000000 --- a/.github/probots.yml +++ /dev/null @@ -1,2 +0,0 @@ -enabled: - - cla diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml new file mode 100644 index 00000000..2c3a4042 --- /dev/null +++ b/.github/workflows/cla.yml @@ -0,0 +1,22 @@ +name: Contributor License Agreement (CLA) + +on: + pull_request_target: + types: [opened, synchronize] + issue_comment: + types: [created] + +jobs: + cla: + runs-on: ubuntu-latest + if: | + (github.event.issue.pull_request + && !github.event.issue.pull_request.merged_at + && contains(github.event.comment.body, 'signed') + ) + || (github.event.pull_request && !github.event.pull_request.merged) + steps: + - uses: Shopify/shopify-cla-action@v1 + with: + github-token: ${{ secrets.GITHUB_TOKEN }} + cla-token: ${{ secrets.CLA_TOKEN }} diff --git a/.github/workflows/liquid.yml b/.github/workflows/liquid.yml new file mode 100644 index 00000000..899ba6bc --- /dev/null +++ b/.github/workflows/liquid.yml @@ -0,0 +1,27 @@ +name: Liquid +on: [push, pull_request] +jobs: + test: + runs-on: ubuntu-latest + strategy: + matrix: + entry: + - { ruby: "2.7" } # minimum supported + - { ruby: "3.0", rubocop: true } # latest working with rubocop + - { ruby: "3.2" } # latest + name: test (${{ matrix.entry.ruby }}) + steps: + - uses: actions/checkout@v3 + - uses: ruby/setup-ruby@v1 + with: + ruby-version: ${{ matrix.entry.ruby }} + - uses: actions/cache@v1 + with: + path: vendor/bundle + key: ${{ runner.os }}-gems-${{ hashFiles('Gemfile') }} + restore-keys: ${{ runner.os }}-gems- + - run: bundle install --jobs=3 --retry=3 --path=vendor/bundle + - run: bundle exec rake test + - name: Run rubocop + if: matrix.entry.rubocop + run: bundle exec rubocop diff --git a/.travis.yml b/.travis.yml deleted file mode 100644 index 0e3e476d..00000000 --- a/.travis.yml +++ /dev/null @@ -1,32 +0,0 @@ -language: ruby - -rvm: - - 2.1 - - 2.2 - - 2.3 - - 2.4 - - 2.5 - - ruby-head - - jruby-head -# - rbx-2 - -sudo: false - -addons: - apt: - packages: - - libgmp3-dev - -matrix: - allow_failures: - - rvm: ruby-head - - rvm: jruby-head - -install: - - gem install rainbow -v 2.2.1 - - bundle install - -script: bundle exec rake - -notifications: - disable: true From c1c9157e759c08e2fead73f7c11d6ee86f93b4db Mon Sep 17 00:00:00 2001 From: Dylan Thacker-Smith Date: Tue, 10 Jan 2023 15:22:13 -0500 Subject: [PATCH 6/8] Use 4-0-stable liquid-c branch to fix extension compilation in CI --- Gemfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Gemfile b/Gemfile index 13865b18..2a76a7c5 100644 --- a/Gemfile +++ b/Gemfile @@ -15,6 +15,6 @@ group :test do gem 'rubocop', '~> 0.49.0' platform :mri do - gem 'liquid-c', '~> 4.0.0' + gem 'liquid-c', github: 'Shopify/liquid-c', branch: '4-0-stable' end end From 8983fcb47e8568766b18e1873c96ecf06ed7e42c Mon Sep 17 00:00:00 2001 From: Dylan Thacker-Smith Date: Tue, 10 Jan 2023 15:26:12 -0500 Subject: [PATCH 7/8] Update History.md --- History.md | 5 +++++ lib/liquid/version.rb | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/History.md b/History.md index 9a82faab..6887d18d 100644 --- a/History.md +++ b/History.md @@ -1,5 +1,10 @@ # Liquid Change Log +## 4.0.4 / (unreleased) + +### Fixed +* Fix ruby 3.2 compatibility by avoiding use of the removed taint API + ## 4.0.3 / 2019-03-12 ### Fixed diff --git a/lib/liquid/version.rb b/lib/liquid/version.rb index da01c476..9799863d 100644 --- a/lib/liquid/version.rb +++ b/lib/liquid/version.rb @@ -1,5 +1,5 @@ # encoding: utf-8 module Liquid - VERSION = "4.0.3".freeze + VERSION = "4.0.4".freeze end From a19320f8f87492dc2d319f4a8ac6afb808c8f4f1 Mon Sep 17 00:00:00 2001 From: Dylan Thacker-Smith Date: Tue, 10 Jan 2023 15:34:56 -0500 Subject: [PATCH 8/8] rubocop: Exclude vendored dependencies in CI --- .rubocop.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.rubocop.yml b/.rubocop.yml index a622ef16..937fb877 100644 --- a/.rubocop.yml +++ b/.rubocop.yml @@ -4,6 +4,7 @@ AllCops: Exclude: - 'performance/shopify/*' - 'pkg/**' + - 'vendor/bundle/**/*' Metrics/BlockNesting: Max: 3