Labyricorn/liquidjs
1
0
Fork 0
mirror of https://github.com/harttle/liquidjs.git synced 2026-09-16 12:50:38 -07:00
Code Issues Packages Projects Releases Wiki Activity

fix: unify blocked-key checks in findScope

Browse Source 
Use shouldBlockScopeKeyRead in findScope hasKey so inherited
constructor/__proto__/prototype do not falsely match environments.
Remove redundant globals hasKey check; globals remains the fallback scope.

Co-authored-by: Cursor <[email protected]>
This commit is contained in:
Yang Jun
2026-07-19 14:09:46 +08:00
co-authored by Cursor
parent e01d30f33b
commit cbc317508b
2 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/integration/liquid/scope-security.spec.ts
+4
View File
@@ -72,6 +72,10 @@ describe('scope security', function () {
await expect(liquid.parseAndRender('{{ foo.constructor.name }}', scope, { ownPropertyOnly: false })).resolves.toBe('')
})
it('should not resolve top-level inherited constructor when ownPropertyOnly=false', async function () {
await expect(liquid.parseAndRender('{{ constructor.name }}', { name: 'Alice' }, { ownPropertyOnly: false })).resolves.toBe('')
})
it('should not write increment to __proto__ on user scope', async function () {
const scope = Object.create(null) as Record<string, unknown>
await expect(liquid.parseAndRender('{% increment __proto__ %}', scope)).resolves.toBe('')