Validate the character encoding in url_decode.

2026-09-15 08:50:45 -07:00 · 2019-03-07 14:01:10 -05:00
parent 23d669f5e6
commit e2d9907df2
2 changed files with 10 additions and 1 deletions
@@ -52,7 +52,12 @@ module Liquid
    end

    def url_decode(input)
-      CGI.unescape(input.to_s) unless input.nil?
+      return if input.nil?
+
+      result = CGI.unescape(input.to_s)
+      raise Liquid::ArgumentError, "invalid byte sequence in #{result.encoding}" unless result.valid_encoding?
+
+      result
    end

    def slice(input, offset, length = nil)