From 8a0c74a7fcb1671aa1dcb71ec82ba0602dc90d04 Mon Sep 17 00:00:00 2001 From: Yang Jun Date: Sun, 14 Jun 2026 15:50:50 +0800 Subject: [PATCH] fix(security): charge pop filter allocation to memoryLimit (#907) * fix(security): charge pop filter allocation to memoryLimit (CWE-770) The `pop` array filter cloned the input via `[...toArray(v)]` without charging `this.context.memoryLimit.use(...)`, bypassing the memoryLimit DoS guard that its sibling filters (shift, unshift, compact, etc.) apply. Mirror `shift` to account for the O(N) allocation. Co-authored-by: Cursor * fix(security): charge sample filter full clone allocation to memoryLimit (CWE-770) Co-authored-by: Cursor --------- Co-authored-by: Cursor --- src/filters/array.ts | 8 +++++--- test/integration/liquid/dos.spec.ts | 10 ++++++++++ 2 files changed, 15 insertions(+), 3 deletions(-) diff --git a/src/filters/array.ts b/src/filters/array.ts index f22fcce20..502af5355 100644 --- a/src/filters/array.ts +++ b/src/filters/array.ts @@ -88,8 +88,10 @@ export function unshift (this: FilterImpl, v: T[], arg: T): T[] { return clone } -export function pop (v: T[]): T[] { - const clone = [...toArray(v)] +export function pop (this: FilterImpl, v: T[]): T[] { + const array = toArray(v) + this.context.memoryLimit.use(array.length) + const clone = [...array] clone.pop() return clone } @@ -252,7 +254,7 @@ export function sample (this: FilterImpl, v: T[] | string, count = 1): T | st v = toValue(v) if (isNil(v)) return [] if (!isArray(v)) v = stringify(v) - this.context.memoryLimit.use(count) + this.context.memoryLimit.use(v.length) const shuffled = [...v].sort(() => Math.random() - 0.5) if (count === 1) return shuffled[0] return shuffled.slice(0, count) diff --git a/test/integration/liquid/dos.spec.ts b/test/integration/liquid/dos.spec.ts index 85783564e..2aea12c48 100644 --- a/test/integration/liquid/dos.spec.ts +++ b/test/integration/liquid/dos.spec.ts @@ -79,6 +79,16 @@ describe('DoS related', function () { await expect(liquid.parseAndRender(src, { array, count: 3 })).resolves.toBe('a a a a a a a a') await expect(liquid.parseAndRender(src, { array, count: 100 })).rejects.toThrow('memory alloc limit exceeded, line:1, col:26') }) + it('should charge pop allocation to memoryLimit', async () => { + const array = Array(1e3).fill(0) + const liquid = new Liquid({ memoryLimit: 100 }) + await expect(liquid.parseAndRender('{{ array | pop | size }}', { array })).rejects.toThrow('memory alloc limit exceeded') + }) + it('should charge sample allocation to memoryLimit', async () => { + const array = Array(1e3).fill(0) + const liquid = new Liquid({ memoryLimit: 100 }) + await expect(liquid.parseAndRender('{{ array | sample: 1 | size }}', { array })).rejects.toThrow('memory alloc limit exceeded') + }) it('should charge strip_html input length to memoryLimit', () => { const liquid = new Liquid({ memoryLimit: 100 }) expect(() => liquid.parseAndRenderSync('{{ s | strip_html }}', { s: 'a'.repeat(200) }))