Labyricorn/liquidjs
1
0
Fork 0
mirror of https://github.com/harttle/liquidjs.git synced 2026-09-17 05:10:40 -07:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): charge json/inspect indentation and keys to memoryLimit

Browse Source 
The incremental per-node charge ignored two output contributors that can
greatly exceed the charged amount: the `space` indentation (which scales
with nesting depth) and object property keys. Both let `{{ data | json: 10 }}`
or key-heavy objects produce far larger strings than memoryLimit accounts
for. Charge a depth-scaled indentation cost and the key length per node,
keeping the total a strict lower bound of the output length.

Also trims the redundant narrating comments added with the original fix.

Co-authored-by: Cursor <[email protected]>
This commit is contained in:
Yang Jun
2026-06-14 16:25:31 +08:00
co-authored by Cursor
parent efdfe5c911
commit 706cb02d30
2 changed files with 40 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/integration/liquid/dos.spec.ts
+12
View File
@@ -104,6 +104,18 @@ describe('DoS related', function () {
const liquid = new Liquid({ memoryLimit: 100 })
await expect(liquid.parseAndRender('{{ data | inspect }}', { data })).rejects.toThrow('memory alloc limit exceeded')
})
it('should charge json indentation (space) to memoryLimit', async () => {
const data = Array(50).fill(0)
const liquid = new Liquid({ memoryLimit: 200 })
await expect(liquid.parseAndRender('{{ data | json }}', { data })).resolves.toBe('[' + Array(50).fill(0).join(',') + ']')
await expect(liquid.parseAndRender('{{ data | json: 10 }}', { data })).rejects.toThrow('memory alloc limit exceeded')
})
it('should charge json object keys to memoryLimit', async () => {
const data: Record<string, number> = {}
for (let i = 0; i < 20; i++) data['k' + i + 'x'.repeat(50)] = 0
const liquid = new Liquid({ memoryLimit: 100 })
await expect(liquid.parseAndRender('{{ data | json }}', { data })).rejects.toThrow('memory alloc limit exceeded')
})
it('should charge strip_html input length to memoryLimit', () => {
const liquid = new Liquid({ memoryLimit: 100 })
expect(() => liquid.parseAndRenderSync('{{ s | strip_html }}', { s: 'a'.repeat(200) }))