Labyricorn/liquidjs
1
0
Fork 0
mirror of https://github.com/harttle/liquidjs.git synced 2026-09-18 22:10:41 -07:00
Code Issues Packages Projects Releases Wiki Activity

fix(strip_html): avoid infinite loop on unclosed openers

Browse Source 
Change the stall guard from i === lt to i <= lt (GHSA-m7fp-h3p4-hr49).
Document that strip_html output is not safe for HTML without escape.

Co-authored-by: Cursor <[email protected]>
This commit is contained in:
Yang Jun
2026-06-22 01:43:34 +08:00
co-authored by Cursor
parent 03a30e6dc4
commit f64f04c562
4 changed files with 14 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/source/filters/strip_html.md
+8
View File
@@ -6,6 +6,10 @@ title: strip_html
Removes any HTML tags from a string.
{% note warn Not safe for HTML output %}
This filter is **not** a sanitizer. Output may still contain `<` sequences (for example malformed tags without a closing `>`, same as [Shopify Liquid](https://shopify.dev/docs/api/liquid/filters/strip_html)). Do not write the result into HTML without also using [escape][escape], [escape_once][escape_once], or [`outputEscape: "escape"`][outputEscape].
{% endnote %}
Input
```liquid
{{ "Have <em>you</em> read <strong>Ulysses</strong>?" | strip_html }}
@@ -15,3 +19,7 @@ Output
```text
Have you read Ulysses?
```
[escape]: ./escape.html
[escape_once]: ./escape.html
[outputEscape]: ../tutorials/options.html#outputEscape