Check and handle when a tainted variable is used

2026-09-17 01:40:42 -07:00 · 2014-09-16 17:23:26 +00:00
parent 638455ed92
commit e836024dd9
3 changed files with 21 additions and 0 deletions
@@ -94,6 +94,16 @@ module Liquid
        end
        filterargs << keyword_args unless keyword_args.empty?
        output = context.invoke(filter[0], output, *filterargs)
+      end.tap do |obj|
+        if obj.tainted?
+          case Template.taint_mode
+          when :warn
+            @warnings ||= []
+            @warnings << "variable '#{@name}' is tainted and was not escaped"
+          when :error
+            raise TaintedError, "Error - variable '#{@name}' is tainted and was not escaped"
+          end
+        end
      end
    end
  end