From fa412245f70e1a10d780b62f4c94641a5d55baa9 Mon Sep 17 00:00:00 2001
From: Tobi Lutke <tobi@shopify.com>
Date: Wed, 11 Mar 2026 07:23:41 -0400
Subject: [PATCH] short-circuit parse_number with first-byte check before regex

---
 lib/liquid/expression.rb | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/liquid/expression.rb b/lib/liquid/expression.rb
index b5178d38..9a48952a 100644
--- a/lib/liquid/expression.rb
+++ b/lib/liquid/expression.rb
@@ -79,6 +79,10 @@ module Liquid
       end
 
       def parse_number(markup, ss)
+        # Quick reject: first byte must be digit or dash
+        first = markup.getbyte(0)
+        return false if first != DASH && (first < ZERO || first > NINE)
+
         # check if the markup is simple integer or float
         case markup
         when INTEGER_REGEX