From dbf0aa8cd58593ebc6942d47df42cfbc80f060d1 Mon Sep 17 00:00:00 2001
From: Michael Go <michael.go@shopify.com>
Date: Mon, 6 Nov 2023 17:56:11 -0400
Subject: [PATCH] don't parse nodes inside a comment tag

Co-authored-by: Alex Coco <alex.coco@shopify.com>
---
 lib/liquid/tags/comment.rb              | 53 ++++++++++++++++
 test/unit/tags/comment_tag_unit_test.rb | 82 +++++++++++++++++++++++++
 2 files changed, 135 insertions(+)
 create mode 100644 test/unit/tags/comment_tag_unit_test.rb

diff --git a/lib/liquid/tags/comment.rb b/lib/liquid/tags/comment.rb
index 9922ee0d..b60ef01b 100644
--- a/lib/liquid/tags/comment.rb
+++ b/lib/liquid/tags/comment.rb
@@ -25,6 +25,59 @@ module Liquid
     def blank?
       true
     end
+
+    private
+
+    def parse_body(body, tokens)
+      if parse_context.depth >= MAX_DEPTH
+        raise StackLevelError, "Nesting too deep"
+      end
+
+      parse_context.depth += 1
+      comment_tag_depth = 1
+
+      begin
+        # Consume tokens without creating child nodes.
+        # The children tag doesn't require to be a valid Liquid except the comment and raw tag.
+        # The child comment and raw tag must be closed.
+        while (token = tokens.send(:shift))
+          tag_name_match = BlockBody::FullToken.match(token)
+
+          next if tag_name_match.nil?
+
+          tag_name = tag_name_match[2]
+
+          if tag_name == "raw"
+            # raw tags are required to be closed
+            parse_raw_tag_body(tokens)
+            next
+          end
+
+          if tag_name_match[2] == "comment"
+            comment_tag_depth += 1
+            next
+          elsif tag_name_match[2] == "endcomment"
+            comment_tag_depth -= 1
+
+            return false if comment_tag_depth.zero?
+          end
+        end
+
+        raise_tag_never_closed(block_name)
+      ensure
+        parse_context.depth -= 1
+      end
+
+      false
+    end
+
+    def parse_raw_tag_body(tokens)
+      while (token = tokens.send(:shift))
+        return if token =~ Raw::FullTokenPossiblyInvalid && "endraw" == Regexp.last_match(2)
+      end
+
+      raise_tag_never_closed("raw")
+    end
   end
 
   Template.register_tag('comment', Comment)
diff --git a/test/unit/tags/comment_tag_unit_test.rb b/test/unit/tags/comment_tag_unit_test.rb
new file mode 100644
index 00000000..457d224a
--- /dev/null
+++ b/test/unit/tags/comment_tag_unit_test.rb
@@ -0,0 +1,82 @@
+# frozen_string_literal: true
+
+require 'test_helper'
+
+class CommentTagUnitTest < Minitest::Test
+  def test_does_not_parse_nodes_inside_a_comment
+    template = Liquid::Template.parse(<<~LIQUID.chomp, line_numbers: true)
+      {% comment %}
+        {% if true %}
+        {% if ... %}
+        {%- for ? -%}
+        {% while true %}
+        {%
+          unless if
+        %}
+        {% endcase %}
+      {% endcomment %}
+    LIQUID
+
+    assert_equal("", template.render)
+  end
+
+  def test_child_comment_tags_need_to_be_closed
+    template = Liquid::Template.parse(<<~LIQUID.chomp, line_numbers: true)
+      {% comment %}
+        {% comment %}
+          {% comment %}{%    endcomment     %}
+        {% endcomment %}
+      {% endcomment %}
+    LIQUID
+
+    assert_equal("", template.render)
+
+    assert_raises(Liquid::SyntaxError) do
+      Liquid::Template.parse(<<~LIQUID.chomp, line_numbers: true)
+        {% comment %}
+          {% comment %}
+            {% comment %}
+          {% endcomment %}
+        {% endcomment %}
+      LIQUID
+    end
+  end
+
+  def test_child_raw_tags_need_to_be_closed
+    template = Liquid::Template.parse(<<~LIQUID.chomp, line_numbers: true)
+      {% comment %}
+        {% raw %}
+          {% endcomment %}
+        {% endraw %}
+      {% endcomment %}
+    LIQUID
+
+    assert_equal("", template.render)
+
+    assert_raises(Liquid::SyntaxError) do
+      Liquid::Template.parse(<<~LIQUID.chomp, line_numbers: true)
+        {% comment %}
+          {% raw %}
+          {% endcomment %}
+        {% endcomment %}
+      LIQUID
+    end
+  end
+
+  def test_error_line_number_is_correct
+    template = Liquid::Template.parse(<<~LIQUID.chomp, line_numbers: true)
+      {% comment %}
+        {% if true %}
+      {% endcomment %}
+      {{ errors.standard_error }}
+    LIQUID
+
+    output = template.render('errors' => ErrorDrop.new)
+    expected = <<~TEXT.chomp
+
+      Liquid error (line 4): standard error
+    TEXT
+
+    assert_equal(expected, output)
+  end
+end