Labyricorn/liquidjs
1
0
Fork 0
mirror of https://github.com/harttle/liquidjs.git synced 2026-09-16 21:00:40 -07:00
Code Issues Packages Projects Releases Wiki Activity

fix: remove BLOCKED_SCOPE_KEYS; ownPropertyOnly is the sole read policy

Browse Source 
Proto keys were incorrectly blocked even when ownPropertyOnly=false.
Inherited access is now gated only by ownPropertyOnly; docs updated.

Co-authored-by: Cursor <[email protected]>
This commit is contained in:
Yang Jun
2026-07-23 23:05:16 +08:00
co-authored by Cursor
parent 85321c6d64
commit bba5c43c09
6 changed files with 10 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/integration/liquid/scope-security.spec.ts
+3 -3
View File
@@ -46,9 +46,9 @@ describe('scope security', function () {
await expect(liquid.parseAndRender('{{ constructor.name }}', scope)).resolves.toBe('Custom')
})
it('should still block inherited blocked keys when ownPropertyOnly=true', async function () {
it('should block inherited properties when ownPropertyOnly=true', async function () {
const scope = { foo: Object.create({ __proto__: { bar: 'BAR' }, constructor: { name: 'Evil' } }) }
await expect(liquid.parseAndRender('{{ foo.__proto__.bar }}', scope)).resolves.toBe('')
await expect(liquid.parseAndRender('{{ foo.constructor.name }}', scope)).resolves.toBe('')
await expect(liquid.parseAndRender('{{ foo.__proto__ }}', scope)).resolves.toBe('')
await expect(liquid.parseAndRender('{{ foo.constructor }}', scope)).resolves.toBe('')
})
})