Labyricorn/liquidjs
1
0
Fork 0
mirror of https://github.com/harttle/liquidjs.git synced 2026-09-16 04:40:39 -07:00
Code Issues Packages Projects Releases Wiki Activity

refactor(strftime): rely on memoryLimit for width control

Browse Source 
Remove MAX_STRFTIME_PAD hard capping and rely on memoryLimit enforcement before padding allocation. Update strftime/date tests and security-model docs to match the new boundary and renderLimit caveats.

Co-authored-by: Cursor <[email protected]>
This commit is contained in:
Yang Jun
2026-05-10 13:34:37 +08:00
co-authored by Cursor
parent b2d68fba5f
commit b405733cdb
5 changed files with 9 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/source/zh-cn/tutorials/security-model.md
+1 -1
View File
@@ -38,7 +38,7 @@ LiquidJS 提供了面向 DoS 的限制选项（`parseLimit`、`renderLimit`、`m
渲染时间是在渲染每个模板之前检查的。在上面的例子中，循环中有两个模板：`order: ` 和 `{{i}}`，因此会检查 2x10000000 次。
单个模板内的标签和过滤器仍然可能把进程挂起。
`renderLimit` 不是硬性的 CPU 限制器。它是在模板渲染边界做检查，因此检查点之间的高计算开销过滤器/标签/用户自定义函数，或深层模板嵌套，仍可能导致 DoS。
### memoryLimit