change: Render an opaque internal error by default for non-Liquid::Error (#835)

These errors may contain sensitive information, so is safer to
render a more vague message by default.

This is done by replacing non-Liquid::Error exceptions with a
Liquid::InternalError exception with the non-Liquid::Error accessible on
through the cause method. This also allows the template name and line
number to be attached to the template errors.

The exception_handler render option has been changed to exception_renderer
since now it should raise an exception to re-raise on a liquid rendering
error or return a string to be rendered where the error occurred.
This commit is contained in:
Dylan Thacker-Smith
2016-12-07 17:34:29 -05:00
committed by GitHub
parent a9b84b7806
commit f27bd619b9
6 changed files with 45 additions and 55 deletions
+2 -2
View File
@@ -167,7 +167,7 @@ module Liquid
c = args.shift
if @rethrow_errors
c.exception_handler = ->(e) { raise }
c.exception_renderer = ->(e) { raise }
end
c
@@ -241,7 +241,7 @@ module Liquid
def apply_options_to_context(context, options)
context.add_filters(options[:filters]) if options[:filters]
context.global_filter = options[:global_filter] if options[:global_filter]
context.exception_handler = options[:exception_handler] if options[:exception_handler]
context.exception_renderer = options[:exception_renderer] if options[:exception_renderer]
context.strict_variables = options[:strict_variables] if options[:strict_variables]
context.strict_filters = options[:strict_filters] if options[:strict_filters]
end