From 54e3d2328aabe4bcde0ae8b26f33b9bd2c2f4ff1 Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 31 Dec 2025 15:05:20 +0000 Subject: [PATCH] Fix code injection vulnerability in template name handling Use .inspect for all template/partial names inserted into generated code strings to prevent code injection via maliciously crafted template names like: {% render "foo'); system('rm -rf /'); #" %} --- lib/liquid/compile/ruby_compiler.rb | 2 +- lib/liquid/compile/tags/include_compiler.rb | 4 ++-- lib/liquid/compile/tags/render_compiler.rb | 4 ++-- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/lib/liquid/compile/ruby_compiler.rb b/lib/liquid/compile/ruby_compiler.rb index 54bf2a77..5453537a 100644 --- a/lib/liquid/compile/ruby_compiler.rb +++ b/lib/liquid/compile/ruby_compiler.rb @@ -303,7 +303,7 @@ module Liquid compile_partial_source(source, code) rescue => e code.line "# Error compiling partial: #{e.message.inspect}" - code.line "__partial_output__ << '[PARTIAL ERROR: #{name}]'" + code.line "__partial_output__ << '[PARTIAL ERROR: ' + #{name.inspect} + ']'" end code.blank_line diff --git a/lib/liquid/compile/tags/include_compiler.rb b/lib/liquid/compile/tags/include_compiler.rb index 361bdc0a..22151591 100644 --- a/lib/liquid/compile/tags/include_compiler.rb +++ b/lib/liquid/compile/tags/include_compiler.rb @@ -37,8 +37,8 @@ module Liquid if partial_source if compiler.debug? - code.line "# Inlined partial '#{template_name}' at compile time" - code.line "$stderr.puts '* WARN: Liquid file system access - inlined partial \\\"#{template_name}\\\" at compile time' if $VERBOSE" + code.line "# Inlined partial #{template_name.inspect} at compile time" + code.line "$stderr.puts '* WARN: Liquid file system access - inlined partial ' + #{template_name.inspect} + ' at compile time' if $VERBOSE" end # Generate a unique method name for this partial method_name = compiler.register_partial(template_name, partial_source) diff --git a/lib/liquid/compile/tags/render_compiler.rb b/lib/liquid/compile/tags/render_compiler.rb index c30255a5..ac778d0f 100644 --- a/lib/liquid/compile/tags/render_compiler.rb +++ b/lib/liquid/compile/tags/render_compiler.rb @@ -39,8 +39,8 @@ module Liquid if partial_source if compiler.debug? - code.line "# Inlined partial '#{template_name}' at compile time" - code.line "$stderr.puts '* WARN: Liquid file system access - inlined partial \\\"#{template_name}\\\" at compile time' if $VERBOSE" + code.line "# Inlined partial #{template_name.inspect} at compile time" + code.line "$stderr.puts '* WARN: Liquid file system access - inlined partial ' + #{template_name.inspect} + ' at compile time' if $VERBOSE" end # Generate a unique method name for this partial method_name = compiler.register_partial(template_name, partial_source)