Merge pull request #2064 from Shopify/strict2-include-tablerow

Add for_loop? to Include tag for AST-based keyword detection

lib/liquid.rb

@@ -65,6 +65,7 @@ require 'liquid/lexer'
 require 'liquid/parser'
 require 'liquid/i18n'
 require 'liquid/drop'
+require 'liquid/self_drop'
 require 'liquid/tablerowloop_drop'
 require 'liquid/forloop_drop'
 require 'liquid/extensions'

lib/liquid/context.rb

@@ -187,6 +187,15 @@ module Liquid
       find_variable(key, raise_on_not_found: false) != nil
     end
 
+    # Checks whether a variable is defined in any scope, including nil-valued keys.
+    # Unlike #key?, this uses Hash#key? so that variables explicitly set to nil
+    # are still considered defined.
+    def variable_defined?(key)
+      @scopes.any? { |s| s.key?(key) } ||
+        @environments.any? { |e| e.key?(key) } ||
+        @static_environments.any? { |e| e.key?(key) }
+    end
+
     def evaluate(object)
       object.respond_to?(:evaluate) ? object.evaluate(self) : object
     end
@@ -197,6 +206,10 @@ module Liquid
       # path and find_index() is optimized in MRI to reduce object allocation
       index = @scopes.find_index { |s| s.key?(key) }
 
+      # `self` resolves to a SelfDrop (enabling `self['var']` lookups),
+      # but only when it hasn't been explicitly assigned as a local variable.
+      return SelfDrop.new(self) if key == Expression::SELF && !index
+
       variable = if index
         lookup_and_evaluate(@scopes[index], key, raise_on_not_found: raise_on_not_found)
       else

lib/liquid/expression.rb

@@ -2,6 +2,8 @@
 
 module Liquid
   class Expression
+    SELF = 'self'
+
     LITERALS = {
       nil => nil,
       'nil' => nil,

lib/liquid/parse_context.rb

@@ -38,7 +38,7 @@ module Liquid
 
     def new_parser(input)
       @string_scanner.string = input
-      Parser.new(@string_scanner)
+      Parser.new(@string_scanner, reject_bare_brackets: @error_mode == :strict2 || @error_mode == :rigid)
     end
 
     def new_tokenizer(source, start_line_number: nil, for_liquid_tag: false)

lib/liquid/parser.rb

@@ -2,10 +2,11 @@
 
 module Liquid
   class Parser
-    def initialize(input)
+    def initialize(input, reject_bare_brackets: false)
       ss = input.is_a?(StringScanner) ? input : StringScanner.new(input)
       @tokens = Lexer.tokenize(ss)
       @p      = 0 # pointer to current location
+      @reject_bare_brackets = reject_bare_brackets
     end
 
     def jump(point)
@@ -53,6 +54,9 @@ module Liquid
         str = consume
         str << variable_lookups
       when :open_square
+        if @reject_bare_brackets
+          raise SyntaxError, "Bare bracket access is not allowed in strict2 mode. Use #{Expression::SELF}['...'] instead"
+        end
         str = consume.dup
         str << expression
         str << consume(:close_square)

lib/liquid/self_drop.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+module Liquid
+  # @liquid_public_docs
+  # @liquid_type object
+  # @liquid_name self
+  # @liquid_summary
+  #   Provides access to variables through the current scope chain.
+  # @liquid_description
+  #   The `self` object resolves variables through the normal lookup hierarchy
+  #   (local > file > global) without exposing filters, interrupts, errors,
+  #   or other context internals. It's used when bare bracket notation
+  #   (`['variable']`) needs to be replaced with an explicit variable lookup.
+  #
+  #   If `self` is explicitly assigned as a local variable (e.g. `{% assign self = 'value' %}`),
+  #   then the local value takes precedence over the `self` object.
+  # @liquid_access global
+  class SelfDrop < Drop
+    def initialize(context)
+      super()
+      @context = context
+    end
+
+    def [](key)
+      @context.find_variable(key)
+    rescue UndefinedVariable
+      nil
+    end
+
+    def key?(key)
+      @context.variable_defined?(key)
+    end
+
+    def to_liquid
+      self
+    end
+  end
+end

lib/liquid/tags/include.rb

@@ -20,7 +20,8 @@ module Liquid
   class Include < Tag
     prepend Tag::Disableable
 
-    SYNTAX = /(#{QuotedFragment}+)(\s+(?:with|for)\s+(#{QuotedFragment}+))?(\s+(?:as)\s+(#{VariableSegment}+))?/o
+    FOR = 'for'
+    SYNTAX = /(#{QuotedFragment}+)(\s+(with|#{FOR})\s+(#{QuotedFragment}+))?(\s+(?:as)\s+(#{VariableSegment}+))?/o
     Syntax = SYNTAX
 
     attr_reader :template_name_expr, :variable_name_expr, :attributes
@@ -84,12 +85,18 @@ module Liquid
     alias_method :parse_context, :options
     private :parse_context
 
+    def for_loop?
+      @is_for_loop
+    end
+
     def strict2_parse(markup)
       p = @parse_context.new_parser(markup)
 
       @template_name_expr = safe_parse_expression(p)
-      @variable_name_expr = safe_parse_expression(p) if p.id?("for") || p.id?("with")
+      with_or_for         = p.id?("for") || p.id?("with")
+      @variable_name_expr = safe_parse_expression(p) if with_or_for
       @alias_name         = p.consume(:id) if p.id?("as")
+      @is_for_loop        = (with_or_for == FOR)
 
       p.consume?(:comma)
 
@@ -111,11 +118,13 @@ module Liquid
     def lax_parse(markup)
       if markup =~ SYNTAX
         template_name = Regexp.last_match(1)
-        variable_name = Regexp.last_match(3)
+        with_or_for   = Regexp.last_match(3)
+        variable_name = Regexp.last_match(4)
 
-        @alias_name         = Regexp.last_match(5)
+        @alias_name         = Regexp.last_match(6)
         @variable_name_expr = variable_name ? parse_expression(variable_name) : nil
         @template_name_expr = parse_expression(template_name)
+        @is_for_loop        = (with_or_for == FOR)
         @attributes         = {}
 
         markup.scan(TagAttributes) do |key, value|

lib/liquid/variable.rb

@@ -37,6 +37,10 @@ module Liquid
       @markup
     end
 
+    def ==(other)
+      self.class == other.class && name == other.name && filters == other.filters
+    end
+
     def markup_context(markup)
       "in \"{{#{markup}}}\""
     end

test/integration/context_test.rb

@@ -296,8 +296,8 @@ class ContextTest < Minitest::Test
   end
 
   def test_access_variable_with_hash_notation
-    assert_template_result('baz', '{{ ["foo"] }}', { "foo" => "baz" })
-    assert_template_result('baz', '{{ [bar] }}', { 'foo' => 'baz', 'bar' => 'foo' })
+    assert_template_result('baz', '{{ foo }}', { "foo" => "baz" })
+    assert_template_result('baz', '{{ self[bar] }}', { 'foo' => 'baz', 'bar' => 'foo' })
   end
 
   def test_access_hashes_with_hash_access_variables

test/integration/tags/include_tag_test.rb

@@ -439,4 +439,49 @@ class IncludeTagTest < Minitest::Test
       assert_match(/Unexpected character =/, error.message)
     end
   end
+
+  def test_include_for_loop_true_with_for_keyword
+    with_error_modes(:lax, :strict, :strict2) do
+      template = Template.parse("{% include 'product' for products %}")
+      include_node = template.root.nodelist.first
+
+      assert(include_node.for_loop?, "Expected for_loop? to be true for 'for' keyword")
+    end
+  end
+
+  def test_include_for_loop_false_with_with_keyword
+    with_error_modes(:lax, :strict, :strict2) do
+      template = Template.parse("{% include 'product' with product %}")
+      include_node = template.root.nodelist.first
+
+      refute(include_node.for_loop?, "Expected for_loop? to be false for 'with' keyword")
+    end
+  end
+
+  def test_include_for_loop_false_without_keyword
+    with_error_modes(:lax, :strict, :strict2) do
+      template = Template.parse("{% include 'header' %}")
+      include_node = template.root.nodelist.first
+
+      refute(include_node.for_loop?, "Expected for_loop? to be false when no keyword")
+    end
+  end
+
+  def test_include_for_loop_with_alias
+    with_error_modes(:lax, :strict, :strict2) do
+      template = Template.parse("{% include 'product' for products as item %}")
+      include_node = template.root.nodelist.first
+
+      assert(include_node.for_loop?, "Expected for_loop? to be true for 'for' with alias")
+    end
+  end
+
+  def test_include_with_keyword_and_alias
+    with_error_modes(:lax, :strict, :strict2) do
+      template = Template.parse("{% include 'product' with products[0] as item %}")
+      include_node = template.root.nodelist.first
+
+      refute(include_node.for_loop?, "Expected for_loop? to be false for 'with' with alias")
+    end
+  end
 end # IncludeTagTest

test/integration/variable_test.rb

@@ -55,7 +55,7 @@ class VariableTest < Minitest::Test
 
   def test_expression_with_whitespace_in_square_brackets
     assert_template_result('result', "{{ a[ 'b' ] }}", { 'a' => { 'b' => 'result' } })
-    assert_template_result('result', "{{ a[ [ 'b' ] ] }}", { 'b' => 'c', 'a' => { 'c' => 'result' } })
+    assert_template_result('result', "{{ a[ self[ 'b' ] ] }}", { 'b' => 'c', 'a' => { 'c' => 'result' } })
   end
 
   def test_ignore_unknown
@@ -135,17 +135,17 @@ class VariableTest < Minitest::Test
   end
 
   def test_dynamic_find_var
-    assert_template_result('bar', '{{ [key] }}', { 'key' => 'foo', 'foo' => 'bar' })
+    assert_template_result('bar', '{{ self[key] }}', { 'key' => 'foo', 'foo' => 'bar' })
   end
 
   def test_raw_value_variable
-    assert_template_result('bar', '{{ [key] }}', { 'key' => 'foo', 'foo' => 'bar' })
+    assert_template_result('bar', '{{ self[key] }}', { 'key' => 'foo', 'foo' => 'bar' })
   end
 
   def test_dynamic_find_var_with_drop
     assert_template_result(
       'bar',
-      '{{ [list[settings.zero]] }}',
+      '{{ self[list[settings.zero]] }}',
       {
         'list' => ['foo'],
         'settings' => SettingsDrop.new("zero" => 0),
@@ -155,7 +155,7 @@ class VariableTest < Minitest::Test
 
     assert_template_result(
       'foo',
-      '{{ [list[settings.zero]["foo"]] }}',
+      '{{ self[list[settings.zero]["foo"]] }}',
       {
         'list' => [{ 'foo' => 'bar' }],
         'settings' => SettingsDrop.new("zero" => 0),