Labyricorn/liquid
1
0
Fork 0
mirror of https://github.com/Shopify/liquid.git synced 2026-09-20 03:10:39 -07:00
Code Issues Packages Projects Releases Wiki Activity

add security constraint to autoresearch.md, fix strict mode gate

Browse Source
This commit is contained in:
Tobi Lutke
2026-03-11 08:26:40 -04:00
parent 9fd7cec564
commit ad98d1f329
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
auto/autoresearch.md
+4
View File
@@ -34,6 +34,10 @@ then the performance benchmark, outputting metrics in parseable format.
- liquid-spec failures must not increase beyond 2 (pre-existing UTF-8 edge cases) - liquid-spec failures must not increase beyond 2 (pre-existing UTF-8 edge cases)
- No new gem dependencies - No new gem dependencies
- Semantic correctness must be preserved — templates must render identical output - Semantic correctness must be preserved — templates must render identical output
- **Security**: Liquid runs untrusted user code. Never use eval, send on user input,
dynamic method dispatch, const_get, or any pattern that could let template authors
escape the sandbox. All optimizations must use safe byte-level scanning with explicit
character checks only.
## Baseline ## Baseline
- **Commit**: 4ea835a (original, before any optimizations) - **Commit**: 4ea835a (original, before any optimizations)