fix: enforce renderLimit for empty renderTemplates calls

renderLimit was only checked inside the per-template loop, so renderTemplates([], ...) skipped it entirely. Empty {% for %} / {% tablerow %} bodies invoke that path once per iteration, bypassing the documented time budget. Check the limiter at renderTemplates entry before the loop. Add regression test for empty for-body with a strict renderLimit. Co-authored-by: Cursor <[email protected]>
2026-09-20 06:50:47 -07:00 · 2026-05-05 00:01:45 +08:00
parent dbbf628803
commit 5561768586
2 changed files with 6 additions and 0 deletions
@@ -48,6 +48,11 @@ describe('DoS related', function () {
      await expect(liquid.parseAndRender('{% render "large" %}')).rejects.toThrow('template render limit exceeded')
      await expect(liquid.parseAndRender('{% render "small" %}')).resolves.toBe('12345')
    })
+    it('should enforce renderLimit when for body has no template nodes', () => {
+      const liquid = new Liquid({ memoryLimit: 1e9, renderLimit: 1 })
+      expect(() => liquid.parseAndRenderSync('{%- for i in (1..5000000) -%}{%- endfor -%}', {}))
+        .toThrow('template render limit exceeded')
+    })
  })
  describe('#memoryLimit', () => {
    it('should throw for too many array creation in filters', async () => {