diff --git a/src/liquid-options.ts b/src/liquid-options.ts index 843e9de1e..cbc8b9489 100644 --- a/src/liquid-options.ts +++ b/src/liquid-options.ts @@ -38,7 +38,7 @@ export interface LiquidOptions { strictVariables?: boolean; /** Catch all errors instead of exit upon one. Please note that render errors won't be reached when parse fails. */ catchAllErrors?: boolean; - /** Limit template property reads on plain scope objects to own properties (no inherited prototype keys). Defaults to `true`. When `true`, reads of `__proto__`, `constructor`, and `prototype` are blocked. With `false`, inherited properties and those keys are allowed—sanitize untrusted scope data (e.g. with [bourne](https://www.npmjs.com/package/bourne)) before passing it as scope. */ + /** Limit template property reads on plain scope objects to own properties. Defaults to `true`. See https://liquidjs.com/tutorials/security-model.html */ ownPropertyOnly?: boolean; /** Modifies the behavior of `strictVariables`. If set, a single undefined variable will *not* cause an exception in the context of the `if`/`elsif`/`unless` tag and the `default` filter. Instead, it will evaluate to `false` and `null`, respectively. Irrelevant if `strictVariables` is not set. Defaults to `false`. **/ lenientIf?: boolean;