change: Render an opaque internal error by default for non-Liquid::Error (#835)

These errors may contain sensitive information, so is safer to
render a more vague message by default.

This is done by replacing non-Liquid::Error exceptions with a
Liquid::InternalError exception with the non-Liquid::Error accessible on
through the cause method. This also allows the template name and line
number to be attached to the template errors.

The exception_handler render option has been changed to exception_renderer
since now it should raise an exception to re-raise on a liquid rendering
error or return a string to be rendered where the error occurred.
This commit is contained in:
Dylan Thacker-Smith
2016-12-07 17:34:29 -05:00
committed by GitHub
parent a9b84b7806
commit f27bd619b9
6 changed files with 45 additions and 55 deletions
+8 -4
View File
@@ -215,16 +215,20 @@ class TemplateTest < Minitest::Test
assert_equal 'ruby error in drop', e.message
end
def test_exception_handler_doesnt_reraise_if_it_returns_false
def test_exception_renderer_that_returns_string
exception = nil
Template.parse("{{ 1 | divided_by: 0 }}").render({}, exception_handler: ->(e) { exception = e; false })
handler = ->(e) { exception = e; '<!-- error -->' }
output = Template.parse("{{ 1 | divided_by: 0 }}").render({}, exception_renderer: handler)
assert exception.is_a?(Liquid::ZeroDivisionError)
assert_equal '<!-- error -->', output
end
def test_exception_handler_does_reraise_if_it_returns_true
def test_exception_renderer_that_raises
exception = nil
assert_raises(Liquid::ZeroDivisionError) do
Template.parse("{{ 1 | divided_by: 0 }}").render({}, exception_handler: ->(e) { exception = e; true })
Template.parse("{{ 1 | divided_by: 0 }}").render({}, exception_renderer: ->(e) { exception = e; raise })
end
assert exception.is_a?(Liquid::ZeroDivisionError)
end