Labyricorn/liquidjs
1
0
Fork 0
mirror of https://github.com/harttle/liquidjs.git synced 2026-09-17 21:40:39 -07:00
Code Issues Packages Projects Releases Wiki Activity

fix: tie proto key blocking to ownPropertyOnly policy

Browse Source 
Block __proto__, constructor, and prototype only when ownPropertyOnly
is true or when access would traverse the prototype chain. Allow own
properties with those names when ownPropertyOnly is false.

Co-authored-by: Cursor <[email protected]>
This commit is contained in:
Yang Jun
2026-07-19 13:54:43 +08:00
co-authored by Cursor
parent 3c385f74ec
commit 072f63c2c0
9 changed files with 54 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/context/context.ts
+3 -3
View File
@@ -1,7 +1,7 @@
import { Drop } from '../drop/drop'
import { __assign } from 'tslib'
import { NormalizedFullOptions, defaultOptions, RenderOptions } from '../liquid-options'
import { createScope, isBlockedScopeKey, Scope } from './scope'
import { createScope, isBlockedScopeKey, Scope, shouldBlockScopeKeyRead } from './scope'
import { hasOwnProperty, isArray, isNil, isUndefined, isString, isFunction, isNumber, toLiquid, InternalUndefinedVariableError, toValueSync, isObject, Limiter, toValue, readArrayElement } from '../util'
type PropertyKey = string | number;
@@ -116,7 +116,7 @@ export class Context {
})
}
private findScope (key: string | number) {
if (isBlockedScopeKey(key)) return createScope()
if (isBlockedScopeKey(key) && this.ownPropertyOnly) return createScope()
const hasKey = (obj: Scope) => {
if (obj == null) return false
return this.ownPropertyOnly
@@ -147,7 +147,7 @@ export class Context {
}
export function readJSProperty (obj: Scope, key: PropertyKey, ownPropertyOnly: boolean) {
if (isBlockedScopeKey(key)) return undefined
if (shouldBlockScopeKeyRead(obj, key, ownPropertyOnly)) return undefined
if (ownPropertyOnly && !hasOwnProperty.call(obj, key) && !(obj instanceof Drop)) return undefined
return obj[key]
}