feat: ownPropertyOnly option to protect prototype, #454

2026-09-18 05:50:43 -07:00 · 2022-01-29 01:22:34 +08:00
parent 527858fc14
commit 7e99efc513
7 changed files with 93 additions and 9 deletions
@@ -194,4 +194,9 @@ describe('Issues', function () {
    const html = engine.parseAndRenderSync(template, { array: [1, 2, 3] })
    expect(html).to.equal('4#8#12#6')
  })
+  it('#454 leaking JS prototype getter functions in evaluation', async () => {
+    const engine = new Liquid({ ownPropertyOnly: true })
+    const html = engine.parseAndRenderSync('{{foo | size}}-{{bar.coo}}', { foo: 'foo', bar: Object.create({ coo: 'COO' }) })
+    expect(html).to.equal('3-')
+  })
 })