Labyricorn/liquidjs
1
0
Fork 0
mirror of https://github.com/harttle/liquidjs.git synced 2026-09-16 21:00:40 -07:00
Code Issues Packages Projects Releases Wiki Activity

fix: tie proto key blocking to ownPropertyOnly policy

Browse Source 
Block __proto__, constructor, and prototype only when ownPropertyOnly
is true or when access would traverse the prototype chain. Allow own
properties with those names when ownPropertyOnly is false.

Co-authored-by: Cursor <[email protected]>
This commit is contained in:
Yang Jun
2026-07-19 13:54:43 +08:00
co-authored by Cursor
parent 3c385f74ec
commit 072f63c2c0
9 changed files with 54 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/integration/liquid/scope-security.spec.ts
+17 -2
View File
@@ -52,11 +52,26 @@ describe('scope security', function () {
await expect(liquid.parseAndRender('{{ foo.bar }}', scope, { ownPropertyOnly: false })).resolves.toBe('BAR')
})
it('should still block __proto__ when ownPropertyOnly=false', async function () {
const scope = { foo: { __proto__: { bar: 'BAR' } } }
it('should still block inherited __proto__ when ownPropertyOnly=false', async function () {
const scope = { foo: Object.create({ __proto__: { bar: 'BAR' } }) }
await expect(liquid.parseAndRender('{{ foo.__proto__.bar }}', scope, { ownPropertyOnly: false })).resolves.toBe('')
})
it('should allow own __proto__ when ownPropertyOnly=false', async function () {
const scope = { foo: JSON.parse('{"__proto__": {"bar": "BAR"}}') }
await expect(liquid.parseAndRender('{{ foo.__proto__.bar }}', scope, { ownPropertyOnly: false })).resolves.toBe('BAR')
})
it('should allow own constructor when ownPropertyOnly=false', async function () {
const scope = { name: 'Alice', constructor: { name: 'Custom' } }
await expect(liquid.parseAndRender('{{ constructor.name }}', scope, { ownPropertyOnly: false })).resolves.toBe('Custom')
})
it('should still block inherited constructor when ownPropertyOnly=false', async function () {
const scope = { foo: {} }
await expect(liquid.parseAndRender('{{ foo.constructor.name }}', scope, { ownPropertyOnly: false })).resolves.toBe('')
})
it('should not write increment to __proto__ on user scope', async function () {
const scope = Object.create(null) as Record<string, unknown>
await expect(liquid.parseAndRender('{% increment __proto__ %}', scope)).resolves.toBe('')