From 8928454e29b55ceb1592ce34383b10734faefb93 Mon Sep 17 00:00:00 2001
From: Dylan Thacker-Smith <dylan.smith@shopify.com>
Date: Wed, 10 May 2017 10:41:24 -0400
Subject: [PATCH] Use a loop to evaluate binary comparisions to avoid recursion
 (#891)

Using recursion allows a malicious template to cause a SystemStackError
---
 lib/liquid/condition.rb | 26 ++++++++++++++++++--------
 1 file changed, 18 insertions(+), 8 deletions(-)

diff --git a/lib/liquid/condition.rb b/lib/liquid/condition.rb
index 7db9cf35..3e798498 100644
--- a/lib/liquid/condition.rb
+++ b/lib/liquid/condition.rb
@@ -41,16 +41,22 @@ module Liquid
     end
 
     def evaluate(context = Context.new)
-      result = interpret_condition(left, right, operator, context)
+      condition = self
+      result = nil
+      loop do
+        result = interpret_condition(condition.left, condition.right, condition.operator, context)
 
-      case @child_relation
-      when :or
-        result || @child_condition.evaluate(context)
-      when :and
-        result && @child_condition.evaluate(context)
-      else
-        result
+        case condition.child_relation
+        when :or
+          break if result
+        when :and
+          break unless result
+        else
+          break
+        end
+        condition = condition.child_condition
       end
+      result
     end
 
     def or(condition)
@@ -75,6 +81,10 @@ module Liquid
       "#<Condition #{[@left, @operator, @right].compact.join(' '.freeze)}>"
     end
 
+    protected
+
+    attr_reader :child_relation, :child_condition
+
     private
 
     def equal_variables(left, right)