Labyricorn/liquidjs
1
0
Fork 0
mirror of https://github.com/harttle/liquidjs.git synced 2026-09-17 05:10:40 -07:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): charge json/inspect/jsonify output to memoryLimit (CWE-770)

Browse Source 
Co-authored-by: Cursor <[email protected]>
This commit is contained in:
Yang Jun
2026-06-14 15:53:33 +08:00
co-authored by Cursor
parent 8a0c74a7fc
commit 75321a9f04
2 changed files with 23 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/integration/liquid/dos.spec.ts
+15
View File
@@ -89,6 +89,21 @@ describe('DoS related', function () {
const liquid = new Liquid({ memoryLimit: 100 })
await expect(liquid.parseAndRender('{{ array | sample: 1 | size }}', { array })).rejects.toThrow('memory alloc limit exceeded')
})
it('should charge json allocation to memoryLimit', async () => {
const data = Array(1e3).fill({ k: 'value' })
const liquid = new Liquid({ memoryLimit: 100 })
await expect(liquid.parseAndRender('{{ data | json }}', { data })).rejects.toThrow('memory alloc limit exceeded')
})
it('should charge jsonify allocation to memoryLimit', async () => {
const data = Array(1e3).fill({ k: 'value' })
const liquid = new Liquid({ memoryLimit: 100 })
await expect(liquid.parseAndRender('{{ data | jsonify }}', { data })).rejects.toThrow('memory alloc limit exceeded')
})
it('should charge inspect allocation to memoryLimit', async () => {
const data = Array(1e3).fill({ k: 'value' })
const liquid = new Liquid({ memoryLimit: 100 })
await expect(liquid.parseAndRender('{{ data | inspect }}', { data })).rejects.toThrow('memory alloc limit exceeded')
})
it('should charge strip_html input length to memoryLimit', () => {
const liquid = new Liquid({ memoryLimit: 100 })
expect(() => liquid.parseAndRenderSync('{{ s | strip_html }}', { s: 'a'.repeat(200) }))