From 511ee7fbe16bdfba3368357101773872404818f6 Mon Sep 17 00:00:00 2001 From: Bouke van der Bijl Date: Mon, 28 Oct 2013 13:56:11 +0100 Subject: [PATCH] Remove to_sym from condition creation This prevents a DoS http://www.tricksonrails.com/2010/06/avoid-memory-leaks-in-ruby-rails-code-and-protect-against-denial-of-service/ --- lib/liquid/tags/if.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/liquid/tags/if.rb b/lib/liquid/tags/if.rb index c376f6c3..1b46b2c9 100644 --- a/lib/liquid/tags/if.rb +++ b/lib/liquid/tags/if.rb @@ -63,7 +63,7 @@ module Liquid raise(SyntaxError.new(options[:locale].t("errors.syntax.if"))) unless expressions.shift.to_s =~ Syntax new_condition = Condition.new($1, $2, $3) - new_condition.send(operator.to_sym, condition) + new_condition.send(operator, condition) condition = new_condition end