Use a loop to evaluate binary comparisions to avoid recursion (#891)

Using recursion allows a malicious template to cause a SystemStackError
This commit is contained in:
Dylan Thacker-Smith
2017-05-10 10:41:24 -04:00
committed by GitHub
parent 1370a102c9
commit 8928454e29
+18 -8
View File
@@ -41,16 +41,22 @@ module Liquid
end
def evaluate(context = Context.new)
result = interpret_condition(left, right, operator, context)
condition = self
result = nil
loop do
result = interpret_condition(condition.left, condition.right, condition.operator, context)
case @child_relation
when :or
result || @child_condition.evaluate(context)
when :and
result && @child_condition.evaluate(context)
else
result
case condition.child_relation
when :or
break if result
when :and
break unless result
else
break
end
condition = condition.child_condition
end
result
end
def or(condition)
@@ -75,6 +81,10 @@ module Liquid
"#<Condition #{[@left, @operator, @right].compact.join(' '.freeze)}>"
end
protected
attr_reader :child_relation, :child_condition
private
def equal_variables(left, right)