Labyricorn/liquidjs
1
0
Fork 0
mirror of https://github.com/harttle/liquidjs.git synced 2026-09-17 05:10:40 -07:00
Code Issues Packages Projects Releases Wiki Activity

fix: address scope-security review findings

Browse Source 
Restore null-prototype hardening for Jekyll include bindings, colocate blocked-key checks with readJSProperty, align ownPropertyOnly JSDoc with security docs, and drop integration tests duplicated in context.spec.

Co-authored-by: Cursor <[email protected]>
This commit is contained in:
Yang Jun
2026-07-21 20:38:46 +08:00
co-authored by Cursor
parent bc207a66b7
commit 12fa904ebd
5 changed files with 14 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/context/context.ts
+9 -1
View File
@@ -1,7 +1,7 @@
import { Drop } from '../drop/drop'
import { __assign } from 'tslib'
import { NormalizedFullOptions, defaultOptions, RenderOptions } from '../liquid-options'
import { createScope, Scope, shouldBlockScopeKeyRead } from './scope'
import { createScope, Scope } from './scope'
import { hasOwnProperty, isArray, isNil, isUndefined, isString, isFunction, isNumber, toLiquid, InternalUndefinedVariableError, toValueSync, isObject, Limiter, toValue, readArrayElement } from '../util'
type PropertyKey = string | number;
@@ -165,6 +165,14 @@ export class Context {
}
}
const BLOCKED_SCOPE_KEYS = new Set(['__proto__', 'constructor', 'prototype'])
function shouldBlockScopeKeyRead (obj: Scope, key: PropertyKey, ownPropertyOnly: boolean): boolean {
if (typeof key !== 'string' || !BLOCKED_SCOPE_KEYS.has(key)) return false
if (ownPropertyOnly) return true
return !hasOwnProperty.call(obj, key)
}
export function readJSProperty (obj: Scope, key: PropertyKey, ownPropertyOnly: boolean) {
if (shouldBlockScopeKeyRead(obj, key, ownPropertyOnly)) return undefined
if (ownPropertyOnly && !hasOwnProperty.call(obj, key) && !(obj instanceof Drop)) return undefined
src/context/scope.ts
-13
View File
@@ -1,5 +1,4 @@
import { Drop } from '../drop/drop'
import { hasOwnProperty } from '../util'
export interface ScopeObject extends Record<string | number | symbol, any> {
toLiquid?: () => any;
@@ -7,18 +6,6 @@ export interface ScopeObject extends Record<string | number | symbol, any> {
export type Scope = ScopeObject | Drop
const BLOCKED_SCOPE_KEYS = new Set(['__proto__', 'constructor', 'prototype'])
function isBlockedScopeKey (key: PropertyKey): boolean {
return typeof key === 'string' && BLOCKED_SCOPE_KEYS.has(key)
}
export function shouldBlockScopeKeyRead (obj: Scope, key: PropertyKey, ownPropertyOnly: boolean): boolean {
if (!isBlockedScopeKey(key)) return false
if (ownPropertyOnly) return true
return !hasOwnProperty.call(obj, key)
}
export function createScope (from?: ScopeObject): ScopeObject {
return Object.assign(Object.create(null), from)
}