Labyricorn/liquidjs
1
0
Fork 0
mirror of https://github.com/harttle/liquidjs.git synced 2026-09-20 15:00:42 -07:00
Code Issues Packages Projects Releases Wiki Activity

fix(strip_html): avoid infinite loop on unclosed openers

Browse Source 
Change the stall guard from i === lt to i <= lt (GHSA-m7fp-h3p4-hr49).
Document that strip_html output is not safe for HTML without escape.

Co-authored-by: Cursor <[email protected]>
This commit is contained in:
Yang Jun
2026-06-22 01:43:34 +08:00
co-authored by Cursor
parent 03a30e6dc4
commit f64f04c562
4 changed files with 14 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/integration/filters/html.spec.ts
+4
View File
@@ -85,5 +85,9 @@ describe('filters/html', function () {
expect(liquid.parseAndRenderSync('{{"<img\rsrc=x\ronerror=alert(1)>" | strip_html}}')).toBe('')
expect(liquid.parseAndRenderSync('{{"<svg\nonload=alert(1)>" | strip_html}}')).toBe('')
})
it('should not loop on unclosed openers (GHSA-m7fp-h3p4-hr49)', function () {
expect(liquid.parseAndRenderSync('{{ "a<" | strip_html }}')).toBe('a<')
expect(liquid.parseAndRenderSync('{{ "hello<world<again" | strip_html }}')).toBe('hello<world<again')
})
})
})