Labyricorn/liquidjs
1
0
Fork 0
mirror of https://github.com/harttle/liquidjs.git synced 2026-09-16 04:40:39 -07:00
Code Issues Packages Projects Releases Wiki Activity

fix: address scope-security review findings

Browse Source 
Restore null-prototype hardening for Jekyll include bindings, colocate blocked-key checks with readJSProperty, align ownPropertyOnly JSDoc with security docs, and drop integration tests duplicated in context.spec.

Co-authored-by: Cursor <[email protected]>
This commit is contained in:
Yang Jun
2026-07-21 20:38:46 +08:00
co-authored by Cursor
parent bc207a66b7
commit 12fa904ebd
5 changed files with 14 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/context/scope.ts
-13
View File
@@ -1,5 +1,4 @@
import { Drop } from '../drop/drop'
import { hasOwnProperty } from '../util'
export interface ScopeObject extends Record<string | number | symbol, any> {
toLiquid?: () => any;
@@ -7,18 +6,6 @@ export interface ScopeObject extends Record<string | number | symbol, any> {
export type Scope = ScopeObject | Drop
const BLOCKED_SCOPE_KEYS = new Set(['__proto__', 'constructor', 'prototype'])
function isBlockedScopeKey (key: PropertyKey): boolean {
return typeof key === 'string' && BLOCKED_SCOPE_KEYS.has(key)
}
export function shouldBlockScopeKeyRead (obj: Scope, key: PropertyKey, ownPropertyOnly: boolean): boolean {
if (!isBlockedScopeKey(key)) return false
if (ownPropertyOnly) return true
return !hasOwnProperty.call(obj, key)
}
export function createScope (from?: ScopeObject): ScopeObject {
return Object.assign(Object.create(null), from)
}