From bd9c3802c88473a227afeb3e2ff8a0ad6518e5a0 Mon Sep 17 00:00:00 2001
From: Michael Go <michael.go@shopify.com>
Date: Wed, 1 Feb 2023 21:15:35 -0400
Subject: [PATCH] add variable parser timeout unit tests

---
 test/integration/variable_test.rb | 26 +++++++++++++++++---------
 test/unit/regexp_unit_test.rb     | 13 +++++++++++++
 2 files changed, 30 insertions(+), 9 deletions(-)

diff --git a/test/integration/variable_test.rb b/test/integration/variable_test.rb
index 0667adb9..a66f1a0b 100644
--- a/test/integration/variable_test.rb
+++ b/test/integration/variable_test.rb
@@ -185,15 +185,23 @@ class VariableTest < Minitest::Test
 
     very_long_key = "1234567890" * 100
 
-    Timeout.timeout(1) do
-      assert_template_result(
-        'bar',
-        "{{['#{very_long_key}'}}",
-        {
-          very_long_key => 'bar',
-        },
-        error_mode: :lax,
-      )
+    template_list = [
+      "{{['#{very_long_key}']}}", # valid
+      "{{['#{very_long_key}'}}", # missing closing bracket
+      "{{[['#{very_long_key}']}}", # extra open bracket
+    ]
+
+    template_list.each do |template|
+      Timeout.timeout(1) do
+        assert_template_result(
+          'bar',
+          template,
+          {
+            very_long_key => 'bar',
+          },
+          error_mode: :lax,
+        )
+      end
     end
   end
 end
diff --git a/test/unit/regexp_unit_test.rb b/test/unit/regexp_unit_test.rb
index aad663c1..877c95e4 100644
--- a/test/unit/regexp_unit_test.rb
+++ b/test/unit/regexp_unit_test.rb
@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require 'test_helper'
+require 'timeout'
 
 class RegexpUnitTest < Minitest::Test
   include Liquid
@@ -37,10 +38,22 @@ class RegexpUnitTest < Minitest::Test
 
   def test_variable_parser
     assert_equal(['var'],                               'var'.scan(VariableParser))
+    assert_equal(['[var]'],                             '[var]'.scan(VariableParser))
     assert_equal(['var', 'method'],                     'var.method'.scan(VariableParser))
     assert_equal(['var', '[method]'],                   'var[method]'.scan(VariableParser))
     assert_equal(['var', '[method]', '[0]'],            'var[method][0]'.scan(VariableParser))
     assert_equal(['var', '["method"]', '[0]'],          'var["method"][0]'.scan(VariableParser))
     assert_equal(['var', '[method]', '[0]', 'method'],  'var[method][0].method'.scan(VariableParser))
   end
+
+  def test_variable_parser_with_large_input
+    Timeout.timeout(1) { assert_equal(['[var]'], '[var]'.scan(VariableParser)) }
+
+    very_long_string = "foo" * 1000
+
+    # valid dynamic lookup
+    Timeout.timeout(1) { assert_equal(["[#{very_long_string}]"], "[#{very_long_string}]".scan(VariableParser)) }
+    # invalid dynamic lookup with missing closing bracket
+    Timeout.timeout(1) { assert_equal([very_long_string], "[#{very_long_string}".scan(VariableParser)) }
+  end
 end # RegexpTest