Labyricorn/liquid
1
0
Fork 0
mirror of https://github.com/Shopify/liquid.git synced 2026-09-16 17:30:43 -07:00
Code Issues Packages Projects Releases Wiki Activity

Restore the Liquid CI baseline (#2118)

Browse Source 
* Pin Liquid specs to the merged self-drop tests

Assisted-By: devx/b8d3b9bd-01a3-41b1-90f8-632318b798e4

* Align blank-body error tests with strict2 behavior

Assisted-By: devx/b8d3b9bd-01a3-41b1-90f8-632318b798e4

* Check Drop symbol safety without counting JIT metadata

Assisted-By: devx/b8d3b9bd-01a3-41b1-90f8-632318b798e4

* Update liquid-spec to the latest main revision

Assisted-By: devx/b8d3b9bd-01a3-41b1-90f8-632318b798e4
This commit is contained in:
Ian Ker-Seymer
2026-09-15 22:24:18 -04:00
committed by GitHub
parent 807d45a6b3
commit 3bdbd4ac2f
4 changed files with 30 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/integration/security_test.rb
+8 -5
View File
@@ -61,12 +61,15 @@ class SecurityTest < Minitest::Test
end
def test_does_not_add_drop_methods_to_symbol_table
assert_no_new_symbols do
assigns = { 'drop' => Drop.new }
assert_equal("", Template.parse("{{ drop.custom_method_1 }}", assigns).render!)
assert_equal("", Template.parse("{{ drop.custom_method_2 }}", assigns).render!)
assert_equal("", Template.parse("{{ drop.custom_method_3 }}", assigns).render!)
assigns = { 'drop' => Drop.new }
method_names = Array.new(3) { |index| "untrusted_drop_method_#{object_id}_#{index}" }
method_names.each do |method_name|
assert_equal("", Template.parse("{{ drop.#{method_name} }}").render!(assigns))
end
# JITs can intern internal metadata; untrusted Drop method names must not be interned.
assert_equal([], Symbol.all_symbols.map(&:to_s) & method_names)
end
def assert_no_new_symbols