fix(strip_html): infinite loop for strip_html

2026-09-16 21:00:40 -07:00 · 2026-06-22 02:28:07 +08:00
parent 6d00257e15
commit 5c3522f339
4 changed files with 14 additions and 1 deletions
@@ -85,5 +85,9 @@ describe('filters/html', function () {
      expect(liquid.parseAndRenderSync('{{"<img\rsrc=x\ronerror=alert(1)>" | strip_html}}')).toBe('')
      expect(liquid.parseAndRenderSync('{{"<svg\nonload=alert(1)>" | strip_html}}')).toBe('')
    })
+    it('should not loop on unclosed openers (GHSA-m7fp-h3p4-hr49)', function () {
+      expect(liquid.parseAndRenderSync('{{ "a<" | strip_html }}')).toBe('a<')
+      expect(liquid.parseAndRenderSync('{{ "hello<world<again" | strip_html }}')).toBe('hello<world<again')
+    })
  })
 })