mirror of
https://github.com/Shopify/liquid.git
synced 2026-09-17 01:40:42 -07:00
Use a loop to evaluate binary comparisions to avoid recursion (#891)
Using recursion allows a malicious template to cause a SystemStackError
This commit is contained in:
committed by
GitHub
parent
1370a102c9
commit
8928454e29
+18
-8
@@ -41,16 +41,22 @@ module Liquid
|
||||
end
|
||||
|
||||
def evaluate(context = Context.new)
|
||||
result = interpret_condition(left, right, operator, context)
|
||||
condition = self
|
||||
result = nil
|
||||
loop do
|
||||
result = interpret_condition(condition.left, condition.right, condition.operator, context)
|
||||
|
||||
case @child_relation
|
||||
when :or
|
||||
result || @child_condition.evaluate(context)
|
||||
when :and
|
||||
result && @child_condition.evaluate(context)
|
||||
else
|
||||
result
|
||||
case condition.child_relation
|
||||
when :or
|
||||
break if result
|
||||
when :and
|
||||
break unless result
|
||||
else
|
||||
break
|
||||
end
|
||||
condition = condition.child_condition
|
||||
end
|
||||
result
|
||||
end
|
||||
|
||||
def or(condition)
|
||||
@@ -75,6 +81,10 @@ module Liquid
|
||||
"#<Condition #{[@left, @operator, @right].compact.join(' '.freeze)}>"
|
||||
end
|
||||
|
||||
protected
|
||||
|
||||
attr_reader :child_relation, :child_condition
|
||||
|
||||
private
|
||||
|
||||
def equal_variables(left, right)
|
||||
|
||||
Reference in New Issue
Block a user