Labyricorn/liquidjs
1
0
Fork 0
mirror of https://github.com/harttle/liquidjs.git synced 2026-09-19 06:20:38 -07:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): charge sample filter full clone allocation to memoryLimit (CWE-770)

Browse Source 
Co-authored-by: Cursor <[email protected]>
This commit is contained in:
Yang Jun
2026-06-14 15:45:45 +08:00
co-authored by Cursor
parent 8734b5fc6e
commit a4f29d056b
2 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/integration/liquid/dos.spec.ts
+5
View File
@@ -84,6 +84,11 @@ describe('DoS related', function () {
const liquid = new Liquid({ memoryLimit: 100 })
await expect(liquid.parseAndRender('{{ array | pop | size }}', { array })).rejects.toThrow('memory alloc limit exceeded')
})
it('should charge sample allocation to memoryLimit', async () => {
const array = Array(1e3).fill(0)
const liquid = new Liquid({ memoryLimit: 100 })
await expect(liquid.parseAndRender('{{ array | sample: 1 | size }}', { array })).rejects.toThrow('memory alloc limit exceeded')
})
it('should charge strip_html input length to memoryLimit', () => {
const liquid = new Liquid({ memoryLimit: 100 })
expect(() => liquid.parseAndRenderSync('{{ s | strip_html }}', { s: 'a'.repeat(200) }))