fix: enforce ownPropertyOnly for inherited array indices (#924)

* fix: enforce ownPropertyOnly for inherited array indices Route array index access (including negative indices, first/last, and the first/last filters) through a shared readArrayElement helper so that ownPropertyOnly hides prototype-inherited array indices, closing the GHSA-fwxr-j5w2-587m bypass. The option's scope (property/index access only, not filter transforms or iteration) is documented on the option. Co-authored-by: Cursor <[email protected]> * fix(filters): invoke Array.prototype methods on unsanitized array values Call built-ins via Array.prototype.<m>.call(...) for values that come from scope (join, compact, concat, slice, where/reject) so an overridden instance method on unsanitized data cannot hijack filter behavior. Methods on freshly-created arrays are left as-is. Co-authored-by: Cursor <[email protected]> * fix(filters): use String.prototype.slice for the string branch of slice Route the non-array branch through String.prototype.slice.call so the slice filter never dispatches through a possibly-overridden instance method, matching the Array.prototype guard. Co-authored-by: Cursor <[email protected]> --------- Co-authored-by: Cursor <[email protected]>
2026-09-19 14:30:38 -07:00 · 2026-07-06 20:12:09 +08:00
parent 8bfb6428ae
commit 552819a84b
6 changed files with 103 additions and 19 deletions
@@ -0,0 +1,54 @@
+import { Liquid } from '../../../src/liquid'
+
+describe('ownPropertyOnly / inherited array indices', function () {
+  const engine = new Liquid({ ownPropertyOnly: true })
+
+  function pollutedArrays () {
+    // eslint-disable-next-line no-extend-native
+    Array.prototype[0] = 'ARRAY_PROTO_POLLUTED'
+    ;(Object.prototype as any).secret = 'OBJECT_PROTO_POLLUTED'
+    const a: any[] = []
+    a.length = 1
+    const o = {}
+    return {
+      a,
+      o,
+      cleanup () {
+        delete (Array.prototype as any)[0]
+        delete (Object.prototype as any).secret
+      }
+    }
+  }
+
+  const cases: [string, (ctx: ReturnType<typeof pollutedArrays>) => object, string][] = [
+    ['{{ a[0] }}', ({ a }) => ({ a }), ''],
+    ['{{ a[-1] }}', ({ a }) => ({ a }), ''],
+    ['{{ o.secret }}', ({ o }) => ({ o }), ''],
+    ['{{ a.first }}', ({ a }) => ({ a }), ''],
+    ['{{ a.last }}', ({ a }) => ({ a }), ''],
+    ['{{ a | first }}', ({ a }) => ({ a }), ''],
+    ['{{ a | last }}', ({ a }) => ({ a }), ''],
+    ['{% assign x = a | first %}{{ x }}', ({ a }) => ({ a }), '']
+  ]
+
+  it.each(cases)('%s', function (src, scopeFn, expected) {
+    const ctx = pollutedArrays()
+    try {
+      expect(engine.parseAndRenderSync(src, scopeFn(ctx))).toBe(expected)
+    } finally {
+      ctx.cleanup()
+    }
+  })
+
+  it('still allows array length and size', function () {
+    const { a, cleanup } = pollutedArrays()
+    try {
+      expect(engine.parseAndRenderSync('{{ a.size }}', { a })).toBe('1')
+      const arr = [1, 2]
+      expect(engine.parseAndRenderSync('{{ arr | first }}', { arr })).toBe('1')
+      expect(engine.parseAndRenderSync('{{ arr[-1] }}', { arr })).toBe('2')
+    } finally {
+      cleanup()
+    }
+  })
+})