From 7274c8bd0ae9527c4ac77e645e9c0bd1a7411cb8 Mon Sep 17 00:00:00 2001 From: Yang Jun Date: Thu, 23 Jul 2026 23:50:00 +0800 Subject: [PATCH] docs: shorten ownPropertyOnly entry in options tutorial Details live in Security Model; keep options.md consistent with strictFilters/strictVariables tone. Co-authored-by: Cursor --- docs/source/tutorials/options.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/source/tutorials/options.md b/docs/source/tutorials/options.md index 3eacdc191..ecb039898 100644 --- a/docs/source/tutorials/options.md +++ b/docs/source/tutorials/options.md @@ -138,7 +138,7 @@ It defaults to `false`. For example, when set to `true`, a blank string would ev **lenientIf** modifies the behavior of `strictVariables` to allow handling optional variables. If set to `true`, an undefined variable will *not* cause an exception in the following two situations: a) it is the condition to an `if`, `elsif`, or `unless` tag; b) it occurs right before a `default` filter. Irrelevant if `strictVariables` is not set. Defaults to `false`. -**ownPropertyOnly** limits template property reads on plain scope objects to own properties (no inherited prototype keys). Defaults to `true`. When `true`, reads of `__proto__`, `constructor`, and `prototype` are blocked (own and inherited) as a prototype-pollution defense. With `ownPropertyOnly: false`, inherited properties and those keys are allowed—sanitize untrusted input (e.g. with [bourne](https://www.npmjs.com/package/bourne)) before passing it as scope. See [Security Model](./security-model.html). +**ownPropertyOnly** limits template property reads on plain scope objects to own properties. Defaults to `true`. See [Security Model](./security-model.html). {% note info Nonexistent Tags %} Nonexistent tags always throw errors during parsing and this behavior cannot be customized.