test: fold prototype-registry regressions into register + e2e

Co-authored-by: Cursor <[email protected]>

test/integration/liquid/register-filters.spec.ts

@@ -60,4 +60,30 @@ describe('liquid#registerFilter()', function () {
       return expect(html).toBe(dst)
     })
   })
+
+  describe('filter name must not inherit from Object.prototype', () => {
+    it('should treat valueOf as unregistered (no FilterImpl leak)', async () => {
+      const out = await liquid.parseAndRender(
+        '{% assign r = 1 | valueOf %}{{ r.liquid.options.fs.sep }}|{{ r }}'
+      )
+      expect(out).toBe('|1')
+    })
+    it('should not expose context, liquid, or token via valueOf', async () => {
+      const out = await liquid.parseAndRender(
+        '{% assign r = 1 | valueOf %}{{ r.context }}/{{ r.liquid }}/{{ r.token }}'
+      )
+      expect(out).toBe('//')
+    })
+    it.each(['toString', 'constructor', 'hasOwnProperty', 'isPrototypeOf', '__proto__', '__defineGetter__'])(
+      'should treat %s as unregistered filter',
+      async (name) => {
+        const out = await liquid.parseAndRender(`{{ "x" | ${name} }}`)
+        expect(out).toBe('x')
+      }
+    )
+    it('should throw under strictFilters for valueOf', async () => {
+      const strict = new Liquid({ strictFilters: true })
+      await expect(strict.parseAndRender('{{ 1 | valueOf }}')).rejects.toThrow('undefined filter: valueOf')
+    })
+  })
 })

test/integration/liquid/register-tags.spec.ts

@@ -38,4 +38,14 @@ describe('liquid#registerTag()', function () {
     })
     return expect(html).toBe('ABC')
   })
+
+  describe('tag name must not inherit from Object.prototype', () => {
+    it.each(['constructor', 'toString', 'valueOf', 'hasOwnProperty', '__proto__'])(
+      'should report %s as unknown tag',
+      (name) => {
+        const l = new Liquid()
+        expect(() => l.parse(`{% ${name} %}`)).toThrow(`tag "${name}" not found`)
+      }
+    )
+  })
 })

test/integration/liquid/security.spec.ts

@@ -1,42 +0,0 @@
-import { Liquid } from '../../../src/liquid'
-
-describe('security', () => {
-  describe('Object.prototype filter names', () => {
-    // Regression: `{{ 1 | valueOf }}` used to resolve to Object.prototype.valueOf
-    // and, when invoked as a filter handler, return the FilterImpl `this` — leaking
-    // `context`, `liquid`, options, the parser, the loader, etc., enabling RCE.
-    it('should treat valueOf as an unregistered filter (identity)', async () => {
-      const liquid = new Liquid()
-      const out = await liquid.parseAndRender('{% assign r = 1 | valueOf %}{{ r.liquid.options.fs.sep }}|{{ r }}')
-      expect(out).toBe('|1')
-    })
-    it('should not leak FilterImpl via valueOf', async () => {
-      const liquid = new Liquid()
-      const out = await liquid.parseAndRender('{% assign r = 1 | valueOf %}{{ r.context }}/{{ r.liquid }}/{{ r.token }}')
-      expect(out).toBe('//')
-    })
-    it.each(['toString', 'constructor', 'hasOwnProperty', 'isPrototypeOf', '__proto__', '__defineGetter__'])(
-      'should treat %s as an unregistered filter',
-      async (name) => {
-        const liquid = new Liquid()
-        const out = await liquid.parseAndRender(`{{ "x" | ${name} }}`)
-        expect(out).toBe('x')
-      }
-    )
-    it('should throw under strictFilters for inherited method names', async () => {
-      const liquid = new Liquid({ strictFilters: true })
-      await expect(liquid.parseAndRender('{{ 1 | valueOf }}')).rejects.toThrow('undefined filter: valueOf')
-    })
-  })
-  describe('Object.prototype tag names', () => {
-    // Regression: `{% constructor %}` used to resolve to Object via tags['constructor'],
-    // bypassing the "tag not found" assertion and crashing later with a confusing error.
-    it.each(['constructor', 'toString', 'valueOf', 'hasOwnProperty', '__proto__'])(
-      'should report %s as unknown tag',
-      (name) => {
-        const liquid = new Liquid()
-        expect(() => liquid.parse(`{% ${name} %}`)).toThrow(`tag "${name}" not found`)
-      }
-    )
-  })
-})