Labyricorn/liquidjs
1
0
Fork 0
mirror of https://github.com/harttle/liquidjs.git synced 2026-09-16 04:40:39 -07:00
Code Issues Packages Projects Releases Wiki Activity

fix: sort and sort_natural filters bypass ownPropertyOnly (#869)

Browse Source 
Use _getFromScope for property access in sort/sort_natural filters to respect the ownPropertyOnly security option, preventing prototype chain traversal that could leak sensitive inherited properties.

Also extract shared sortBy helper, add orderedCompare with nil handling consistent with caseInsensitiveCompare and Ruby Liquid.

Made-with: Cursor
This commit is contained in:
Yang Jun
2026-04-07 21:01:20 +08:00
committed by GitHub
parent 8f69a08399
commit e743da0020
4 changed files with 60 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/util/underscore.ts
+12 -3
View File
@@ -170,11 +170,20 @@ export function ellipsis (str: string, N: number): string {
return str.length > N ? str.slice(0, N - 3) + '...' : str
}
export function orderedCompare (a: any, b: any) {
if (isNil(a) && isNil(b)) return 0
if (isNil(a)) return 1
if (isNil(b)) return -1
if (a < b) return -1
if (a > b) return 1
return 0
}
// compare string in case-insensitive way, undefined values to the tail
export function caseInsensitiveCompare (a: any, b: any) {
if (a == null && b == null) return 0
if (a == null) return 1
if (b == null) return -1
if (isNil(a) && isNil(b)) return 0
if (isNil(a)) return 1
if (isNil(b)) return -1
a = toLowerCase.call(a)
b = toLowerCase.call(b)
if (a < b) return -1