Labyricorn/liquid
1
0
Fork 0
mirror of https://github.com/Shopify/liquid.git synced 2026-09-12 23:40:45 -07:00
Code Issues Packages Projects Releases Wiki Activity

Fix code injection vulnerability in template name handling

Browse Source 
Use .inspect for all template/partial names inserted into generated
code strings to prevent code injection via maliciously crafted
template names like: {% render "foo'); system('rm -rf /'); #" %}
This commit is contained in:
Claude
2025-12-31 15:05:20 +00:00
parent 7be2922f91
commit 54e3d2328a
3 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/liquid/compile/ruby_compiler.rb
+1 -1
View File
@@ -303,7 +303,7 @@ module Liquid
compile_partial_source(source, code)
rescue => e
code.line "# Error compiling partial: #{e.message.inspect}"
code.line "__partial_output__ << '[PARTIAL ERROR: #{name}]'"
code.line "__partial_output__ << '[PARTIAL ERROR: ' + #{name.inspect} + ']'"
end
code.blank_line
lib/liquid/compile/tags/include_compiler.rb
+2 -2
View File
@@ -37,8 +37,8 @@ module Liquid
if partial_source
if compiler.debug?
code.line "# Inlined partial '#{template_name}' at compile time"
code.line "$stderr.puts '* WARN: Liquid file system access - inlined partial \\\"#{template_name}\\\" at compile time' if $VERBOSE"
code.line "# Inlined partial #{template_name.inspect} at compile time"
code.line "$stderr.puts '* WARN: Liquid file system access - inlined partial ' + #{template_name.inspect} + ' at compile time' if $VERBOSE"
end
# Generate a unique method name for this partial
method_name = compiler.register_partial(template_name, partial_source)
lib/liquid/compile/tags/render_compiler.rb
+2 -2
View File
@@ -39,8 +39,8 @@ module Liquid
if partial_source
if compiler.debug?
code.line "# Inlined partial '#{template_name}' at compile time"
code.line "$stderr.puts '* WARN: Liquid file system access - inlined partial \\\"#{template_name}\\\" at compile time' if $VERBOSE"
code.line "# Inlined partial #{template_name.inspect} at compile time"
code.line "$stderr.puts '* WARN: Liquid file system access - inlined partial ' + #{template_name.inspect} + ' at compile time' if $VERBOSE"
end
# Generate a unique method name for this partial
method_name = compiler.register_partial(template_name, partial_source)