Labyricorn/liquidjs
1
0
Fork 0
mirror of https://github.com/harttle/liquidjs.git synced 2026-09-15 04:10:40 -07:00
Code Issues Packages Projects Releases Wiki Activity

fix: unify blocked-key checks in findScope

Browse Source 
Use shouldBlockScopeKeyRead in findScope hasKey so inherited
constructor/__proto__/prototype do not falsely match environments.
Remove redundant globals hasKey check; globals remains the fallback scope.

Co-authored-by: Cursor <[email protected]>
This commit is contained in:
Yang Jun
2026-07-19 14:09:46 +08:00
co-authored by Cursor
parent e01d30f33b
commit cbc317508b
2 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/context/context.ts
+2 -3
View File
@@ -1,7 +1,7 @@
import { Drop } from '../drop/drop'
import { __assign } from 'tslib'
import { NormalizedFullOptions, defaultOptions, RenderOptions } from '../liquid-options'
import { createScope, isBlockedScopeKey, Scope, shouldBlockScopeKeyRead } from './scope'
import { createScope, Scope, shouldBlockScopeKeyRead } from './scope'
import { hasOwnProperty, isArray, isNil, isUndefined, isString, isFunction, isNumber, toLiquid, InternalUndefinedVariableError, toValueSync, isObject, Limiter, toValue, readArrayElement } from '../util'
type PropertyKey = string | number;
@@ -116,9 +116,9 @@ export class Context {
})
}
private findScope (key: string | number) {
if (isBlockedScopeKey(key) && this.ownPropertyOnly) return createScope()
const hasKey = (obj: Scope) => {
if (obj == null) return false
if (shouldBlockScopeKeyRead(obj, key, this.ownPropertyOnly)) return false
return this.ownPropertyOnly
? hasOwnProperty.call(obj, key)
: key in obj
@@ -128,7 +128,6 @@ export class Context {
if (hasKey(candidate)) return candidate
}
if (hasKey(this.environments)) return this.environments
if (hasKey(this.globals)) return this.globals
return this.globals
}
readProperty (obj: Scope, key: (PropertyKey | Drop)) {
test/integration/liquid/scope-security.spec.ts
+4
View File
@@ -72,6 +72,10 @@ describe('scope security', function () {
await expect(liquid.parseAndRender('{{ foo.constructor.name }}', scope, { ownPropertyOnly: false })).resolves.toBe('')
})
it('should not resolve top-level inherited constructor when ownPropertyOnly=false', async function () {
await expect(liquid.parseAndRender('{{ constructor.name }}', { name: 'Alice' }, { ownPropertyOnly: false })).resolves.toBe('')
})
it('should not write increment to __proto__ on user scope', async function () {
const scope = Object.create(null) as Record<string, unknown>
await expect(liquid.parseAndRender('{% increment __proto__ %}', scope)).resolves.toBe('')