diff --git a/Gemfile b/Gemfile index 17463e74..953ae8ba 100644 --- a/Gemfile +++ b/Gemfile @@ -32,7 +32,7 @@ group :test do end group :spec do - # Using feature branch until https://github.com/Shopify/liquid-spec/pull/144 is merged - gem 'liquid-spec', github: 'Shopify/liquid-spec', branch: 'self-drop-env-lookup-specs' + # Includes the merged specs from https://github.com/Shopify/liquid-spec/pull/144. + gem 'liquid-spec', github: 'Shopify/liquid-spec', ref: '8a308cb199a7d4e635ae399797560875732c8839' gem 'activesupport', require: false end diff --git a/test/integration/blank_body_error_handling_test.rb b/test/integration/blank_body_error_handling_test.rb index c428891e..c395f867 100644 --- a/test/integration/blank_body_error_handling_test.rb +++ b/test/integration/blank_body_error_handling_test.rb @@ -14,60 +14,60 @@ class BlankBodyErrorHandlingTest < Minitest::Test error = assert_raises(Liquid::ArgumentError) do Liquid::Template.parse(source, line_numbers: true, error_mode: error_mode).render!(assigns) end - assert_includes error.message, message if message + assert_includes(error.message, message) if message end def test_blank_if_body_suppresses_inline_error_text_in_lax_and_strict [:lax, :strict].each do |mode| - assert_equal '', render_inline('{% if 5 > "x" %}{% endif %}', error_mode: mode) + assert_equal('', render_inline('{% if 5 > "x" %}{% endif %}', error_mode: mode)) end end def test_blank_unless_body_suppresses_inline_error_text_in_lax_and_strict [:lax, :strict].each do |mode| - assert_equal '', render_inline('{% unless 5 > "x" %} {% endunless %}', error_mode: mode) + assert_equal('', render_inline('{% unless 5 > "x" %} {% endunless %}', error_mode: mode)) end end def test_blank_for_body_suppresses_inline_error_text_in_lax_and_strict [:lax, :strict].each do |mode| - assert_equal '', render_inline('{% for i in (1..3) offset: xs %}{% endfor %}', error_mode: mode, assigns: { 'xs' => 'bad' }) + assert_equal('', render_inline('{% for i in (1..3) offset: xs %}{% endfor %}', error_mode: mode, assigns: { 'xs' => 'bad' })) end end def test_strict2_blank_if_body_shows_inline_error_text - assert_equal COMPARISON_ERROR, render_inline('{% if 5 > "x" %}{% endif %}', error_mode: :strict2) + assert_equal(COMPARISON_ERROR, render_inline('{% if 5 > "x" %}{% endif %}', error_mode: :strict2)) end def test_strict2_whitespace_if_body_shows_inline_error_text - assert_equal COMPARISON_ERROR, render_inline('{% if 5 > "x" %} {% endif %}', error_mode: :strict2) + assert_equal(COMPARISON_ERROR, render_inline('{% if 5 > "x" %} {% endif %}', error_mode: :strict2)) end def test_strict2_assign_if_body_shows_inline_error_text - assert_equal COMPARISON_ERROR, render_inline('{% if 5 > "x" %}{% assign a = 1 %}{% endif %}', error_mode: :strict2) + assert_equal(COMPARISON_ERROR, render_inline('{% if 5 > "x" %}{% assign a = 1 %}{% endif %}', error_mode: :strict2)) end def test_strict2_comment_if_body_shows_inline_error_text - assert_equal COMPARISON_ERROR, render_inline('{% if 5 > "x" %}{% comment %}c{% endcomment %}{% endif %}', error_mode: :strict2) + assert_equal(COMPARISON_ERROR, render_inline('{% if 5 > "x" %}{% comment %}c{% endcomment %}{% endif %}', error_mode: :strict2)) end def test_strict2_capture_if_body_shows_inline_error_text - assert_equal COMPARISON_ERROR, render_inline('{% if 5 > "x" %}{% capture c %}text{% endcapture %}{% endif %}', error_mode: :strict2) + assert_equal(COMPARISON_ERROR, render_inline('{% if 5 > "x" %}{% capture c %}text{% endcapture %}{% endif %}', error_mode: :strict2)) end def test_strict2_blank_unless_body_shows_inline_error_text - assert_equal COMPARISON_ERROR, render_inline('{% unless 5 > "x" %} {% endunless %}', error_mode: :strict2) + assert_equal(COMPARISON_ERROR, render_inline('{% unless 5 > "x" %} {% endunless %}', error_mode: :strict2)) end def test_strict2_blank_for_body_shows_inline_error_text - assert_equal INVALID_INTEGER_ERROR, render_inline('{% for i in (1..3) offset: xs %}{% endfor %}', error_mode: :strict2, assigns: { 'xs' => 'bad' }) + assert_equal(INVALID_INTEGER_ERROR, render_inline('{% for i in (1..3) offset: xs %}{% endfor %}', error_mode: :strict2, assigns: { 'xs' => 'bad' })) end def test_nonblank_bodies_show_inline_error_text_in_all_modes [:lax, :strict, :strict2].each do |mode| - assert_equal COMPARISON_ERROR, render_inline('{% if 5 > "x" %}{% echo 1 %}{% endif %}', error_mode: mode) - assert_equal COMPARISON_ERROR, render_inline('{% if 5 > "x" %}{{ "" }}{% endif %}', error_mode: mode) - assert_equal COMPARISON_ERROR, render_inline('{% if 5 > "x" %}{% else %}E{% endif %}', error_mode: mode) + assert_equal(COMPARISON_ERROR, render_inline('{% if 5 > "x" %}{% echo 1 %}{% endif %}', error_mode: mode)) + assert_equal(COMPARISON_ERROR, render_inline('{% if 5 > "x" %}{{ "" }}{% endif %}', error_mode: mode)) + assert_equal(COMPARISON_ERROR, render_inline('{% if 5 > "x" %}{% else %}E{% endif %}', error_mode: mode)) end end diff --git a/test/integration/error_handling_test.rb b/test/integration/error_handling_test.rb index 0fda83ca..e2e3ed11 100644 --- a/test/integration/error_handling_test.rb +++ b/test/integration/error_handling_test.rb @@ -265,11 +265,13 @@ class ErrorHandlingTest < Minitest::Test end def test_bug_compatible_silencing_of_errors_in_blank_nodes - output = Liquid::Template.parse("{% assign x = 0 %}{% if 1 < '2' %}not blank{% assign x = 3 %}{% endif %}{{ x }}").render - assert_equal("Liquid error: comparison of Integer with String failed0", output) + with_error_modes(:lax, :strict) do + output = Liquid::Template.parse("{% assign x = 0 %}{% if 1 < '2' %}not blank{% assign x = 3 %}{% endif %}{{ x }}").render + assert_equal("Liquid error: comparison of Integer with String failed0", output) - output = Liquid::Template.parse("{% assign x = 0 %}{% if 1 < '2' %}{% assign x = 3 %}{% endif %}{{ x }}").render - assert_equal("0", output) + output = Liquid::Template.parse("{% assign x = 0 %}{% if 1 < '2' %}{% assign x = 3 %}{% endif %}{{ x }}").render + assert_equal("0", output) + end end def test_syntax_error_is_raised_with_template_name diff --git a/test/integration/security_test.rb b/test/integration/security_test.rb index 3a35d47c..09a21521 100644 --- a/test/integration/security_test.rb +++ b/test/integration/security_test.rb @@ -61,12 +61,15 @@ class SecurityTest < Minitest::Test end def test_does_not_add_drop_methods_to_symbol_table - assert_no_new_symbols do - assigns = { 'drop' => Drop.new } - assert_equal("", Template.parse("{{ drop.custom_method_1 }}", assigns).render!) - assert_equal("", Template.parse("{{ drop.custom_method_2 }}", assigns).render!) - assert_equal("", Template.parse("{{ drop.custom_method_3 }}", assigns).render!) + assigns = { 'drop' => Drop.new } + method_names = Array.new(3) { |index| "untrusted_drop_method_#{object_id}_#{index}" } + + method_names.each do |method_name| + assert_equal("", Template.parse("{{ drop.#{method_name} }}").render!(assigns)) end + + # JITs can intern internal metadata; untrusted Drop method names must not be interned. + assert_equal([], Symbol.all_symbols.map(&:to_s) & method_names) end def assert_no_new_symbols