fix(security): charge sample filter full clone allocation to memoryLimit (CWE-770)

Co-authored-by: Cursor <[email protected]>

src/filters/array.ts

@@ -254,7 +254,7 @@ export function sample<T> (this: FilterImpl, v: T[] | string, count = 1): T | st
   v = toValue(v)
   if (isNil(v)) return []
   if (!isArray(v)) v = stringify(v)
-  this.context.memoryLimit.use(count)
+  this.context.memoryLimit.use(v.length)
   const shuffled = [...v].sort(() => Math.random() - 0.5)
   if (count === 1) return shuffled[0]
   return shuffled.slice(0, count)

test/integration/liquid/dos.spec.ts

@@ -84,6 +84,11 @@ describe('DoS related', function () {
       const liquid = new Liquid({ memoryLimit: 100 })
       await expect(liquid.parseAndRender('{{ array | pop | size }}', { array })).rejects.toThrow('memory alloc limit exceeded')
     })
+    it('should charge sample allocation to memoryLimit', async () => {
+      const array = Array(1e3).fill(0)
+      const liquid = new Liquid({ memoryLimit: 100 })
+      await expect(liquid.parseAndRender('{{ array | sample: 1 | size }}', { array })).rejects.toThrow('memory alloc limit exceeded')
+    })
     it('should charge strip_html input length to memoryLimit', () => {
       const liquid = new Liquid({ memoryLimit: 100 })
       expect(() => liquid.parseAndRenderSync('{{ s | strip_html }}', { s: 'a'.repeat(200) }))