Labyricorn/liquidjs
1
0
Fork 0
mirror of https://github.com/harttle/liquidjs.git synced 2026-09-16 12:50:38 -07:00
Code Issues Packages Projects Releases Wiki Activity

fix: restore BLOCKED_SCOPE_KEYS gated by ownPropertyOnly

Browse Source 
Dangerous keys (__proto__, constructor, prototype) are blocked only when
ownPropertyOnly is true (default). With false, full prototype access is
allowed as an explicit opt-out; use bourne for untrusted input.

Co-authored-by: Cursor <[email protected]>
This commit is contained in:
Yang Jun
2026-07-23 23:14:15 +08:00
co-authored by Cursor
parent bba5c43c09
commit 047b110939
6 changed files with 16 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/integration/liquid/scope-security.spec.ts
+4 -3
View File
@@ -40,10 +40,11 @@ describe('scope security', function () {
)).resolves.toBe('ab')
})
it('should allow own blocked keys when ownPropertyOnly=true', async function () {
it('should block own blocked keys when ownPropertyOnly=true', async function () {
const scope = JSON.parse('{"__proto__": {"polluted": true}, "constructor": {"name": "Custom"}, "name": "Alice"}')
await expect(liquid.parseAndRender('{{ __proto__.polluted }}', scope)).resolves.toBe('true')
await expect(liquid.parseAndRender('{{ constructor.name }}', scope)).resolves.toBe('Custom')
await expect(liquid.parseAndRender('{{ __proto__.polluted }}', scope)).resolves.toBe('')
await expect(liquid.parseAndRender('{{ constructor.name }}', scope)).resolves.toBe('')
await expect(liquid.parseAndRender('{{ name }}', scope)).resolves.toBe('Alice')
})
it('should block inherited properties when ownPropertyOnly=true', async function () {