Labyricorn/liquidjs
1
0
Fork 0
mirror of https://github.com/harttle/liquidjs.git synced 2026-09-15 04:10:40 -07:00
Code Issues Packages Projects Releases Wiki Activity
1,291 Commits 84 Branches 260 Tags
dbbf6288030591bf6da28d8c1cce5a17bca97bb6
Commit Graph
1291 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Yang JunGitHubCursor
 		dbbf628803 fix: propagate ownPropertyOnly into Context.spawn() for {% render %} (#893) 
Child contexts from spawn() re-derived ownPropertyOnly from Liquid opts
only, dropping per-render RenderOptions overrides. That broke the contract
that parseAndRender(..., { ownPropertyOnly: true }) locks down a single
render, including partials loaded via {% render %}.

Add regression test matching prototype-chain leak PoC.

Co-authored-by: Cursor <[email protected]>
 2026-05-03 22:35:31 +08:00
Yang JunGitHubCursor
 		26ea2856c7 fix: strip html newline tags (#892) 
* docs: add @talboren as financial contributor

* fix(strip_html): match tags that span newlines inside angle brackets

Co-authored-by: Cursor <[email protected]>

---------

Co-authored-by: Cursor <[email protected]>
 2026-05-03 21:36:09 +08:00
MattAltermattGitHubMattAltermatt
 		a55f543f49 docs(readme): add Freshet to Who's Using LiquidJS (#888) 
Co-authored-by: MattAltermatt <[email protected]>
 2026-05-03 12:05:12 +08:00
allcontributors[bot]GitHuballcontributors[bot] <46447321+allcontributors[bot]@users.noreply.github.com>
 		d1d517d1ec docs: add VladimirFilonov as a contributor for code (#891) 
* docs: update README.md [skip ci]

* docs: update .all-contributorsrc [skip ci]

---------

Co-authored-by: allcontributors[bot] <46447321+allcontributors[bot]@users.noreply.github.com>
 2026-05-03 12:03:52 +08:00
Vladimir FilonovandGitHub 1c816d4fc3 feat: add sha256 and hmac_sha256 filters for cryptographic operations (#889) 2026-05-03 12:03:26 +08:00
semantic-release-bot 34877950bf chore(release): 10.25.7 [skip ci] 
## [10.25.7](https://github.com/harttle/liquidjs/compare/v10.25.6...v10.25.7) (2026-04-23)

### Bug Fixes

* **filters:** support Buffer input in base64_encode to prevent binary data corruption ([#881](https://github.com/harttle/liquidjs/issues/881)) ([0ee6dbb](https://github.com/harttle/liquidjs/commit/0ee6dbb511aa926f6d490293282060abf3bab37f))
v10.25.7 		2026-04-23 13:41:11 +00:00
Yang JunandGitHub 75c815a4d7 docs: add @talboren as financial contributor (#886) 2026-04-23 21:39:50 +08:00
allcontributors[bot]GitHuballcontributors[bot] <46447321+allcontributors[bot]@users.noreply.github.com>
 		f1f896c29d docs: add talboren as a contributor for code (#885) 
* docs: update README.md [skip ci]

* docs: update .all-contributorsrc [skip ci]

---------

Co-authored-by: allcontributors[bot] <46447321+allcontributors[bot]@users.noreply.github.com>
 2026-04-23 21:31:50 +08:00
TalandGitHub 0ee6dbb511 fix(filters): support Buffer input in base64_encode to prevent binary data corruption (#881) 
* fix: support Buffer input in base64_encode filter

When binary data (e.g. images, PDFs) is passed through the template
context as a Node.js Buffer, the base64_encode filter would call
stringify() on it first, which internally does String(value). This
triggers Buffer.toString() with the default 'utf-8' encoding, which
is a lossy conversion for non-UTF-8 byte sequences — invalid bytes
get replaced with U+FFFD, permanently destroying the original data.

The fix checks for Buffer.isBuffer() before stringify, and calls
buffer.toString('base64') directly, bypassing the lossy UTF-8
intermediate step. String inputs continue through the existing path
unchanged.

Made-with: Cursor

* fix: handle Buffer in filter layer to fix browser build

Move Buffer handling from base64-impl.ts (which gets swapped for the
browser impl at build time) into base64.ts (the filter layer). This
avoids a type error during the browser rollup build where the browser
impl only accepts string.

Also guard Buffer.isBuffer() with typeof Buffer !== 'undefined' for
safety in browser environments.

Made-with: Cursor
 2026-04-23 21:30:58 +08:00
semantic-release-bot 30e04ba16d chore(release): 10.25.6 [skip ci] 
## [10.25.6](https://github.com/harttle/liquidjs/compare/v10.25.5...v10.25.6) (2026-04-19)

### Bug Fixes

* nested block for layout ([#883](https://github.com/harttle/liquidjs/issues/883)) ([e2311df](https://github.com/harttle/liquidjs/commit/e2311dfd6e82f73509308aa8a3a1fafc92e226f0))
v10.25.6 		2026-04-19 15:42:53 +00:00
Yang JunandGitHub e2311dfd6e fix: nested block for layout (#883) 2026-04-19 23:41:35 +08:00
Yang JunandGitHub 2def22c85e docs(readme): add Kibana to README.md (#882) 
* docs(readme): add Kibana and Sentry to Who's Using LiquidJS

Made-with: Cursor

* docs(readme): drop Semgrep and Sentry from Who's Using; keep Kibana

Made-with: Cursor

* docs(readme): restore Sentry in financial sponsors block

Made-with: Cursor

* docs(readme): restore Timmy Braun in all-contributors table

Made-with: Cursor
 2026-04-19 21:38:15 +08:00
semantic-release-bot 4af7be695c chore(release): 10.25.5 [skip ci] 
## [10.25.5](https://github.com/harttle/liquidjs/compare/v10.25.4...v10.25.5) (2026-04-07)

### Bug Fixes

* enforce root containment for renderFile/parseFile lookups ([#870](https://github.com/harttle/liquidjs/issues/870)) ([f41c1fc](https://github.com/harttle/liquidjs/commit/f41c1fc02fe901598f3328118b42b13bc6bc9b04))
* null date should return empty ([#868](https://github.com/harttle/liquidjs/issues/868)) ([#872](https://github.com/harttle/liquidjs/issues/872)) ([4f9a499](https://github.com/harttle/liquidjs/commit/4f9a49988a93c156524981e189a4fec238e682b8))
* rounding negative away from zero when half ([#873](https://github.com/harttle/liquidjs/issues/873)) ([1cdf10b](https://github.com/harttle/liquidjs/commit/1cdf10b57d82f0592414efbfca19e204b37aea9f))
v10.25.5 		2026-04-07 17:18:16 +00:00
Yang JunandGitHub 05c47da46d refactor: replace shell scripts with JS for cross-platform support (#875) 
Convert bin/ shell scripts to Node.js and npm scripts using shx and npm-run-all2. Remove unused build-icons.sh. Inlined simple scripts (build-docs-liquid, build-apidoc) as npm scripts.

Made-with: Cursor
 2026-04-08 01:16:49 +08:00
allcontributors[bot]GitHuballcontributors[bot] <46447321+allcontributors[bot]@users.noreply.github.com>
 		66011d14b0 docs: add timbze as a contributor for code (#874) 
* docs: update README.md [skip ci]

* docs: update .all-contributorsrc [skip ci]

---------

Co-authored-by: allcontributors[bot] <46447321+allcontributors[bot]@users.noreply.github.com>
 2026-04-08 00:53:27 +08:00
Timmy BraunandGitHub 1cdf10b57d fix: rounding negative away from zero when half (#873) 2026-04-08 00:52:35 +08:00
Timmy BraunandGitHub 4f9a49988a fix: null date should return empty (#868) (#872) 2026-04-08 00:10:33 +08:00
Yang JunandGitHub f41c1fc02f fix: enforce root containment for renderFile/parseFile lookups (#870) 
Made-with: Cursor
 2026-04-07 23:18:53 +08:00
semantic-release-bot db4348507e chore(release): 10.25.4 [skip ci] 
## [10.25.4](https://github.com/harttle/liquidjs/compare/v10.25.3...v10.25.4) (2026-04-07)

### Bug Fixes

* sort and sort_natural filters bypass ownPropertyOnly ([#869](https://github.com/harttle/liquidjs/issues/869)) ([e743da0](https://github.com/harttle/liquidjs/commit/e743da0020d34e2ee547e1cc1a86b58377ebe1ce))
v10.25.4 		2026-04-07 13:02:49 +00:00
Yang JunandGitHub e743da0020 fix: sort and sort_natural filters bypass ownPropertyOnly (#869) 
Use _getFromScope for property access in sort/sort_natural filters to respect the ownPropertyOnly security option, preventing prototype chain traversal that could leak sensitive inherited properties.

Also extract shared sortBy helper, add orderedCompare with nil handling consistent with caseInsensitiveCompare and Ruby Liquid.

Made-with: Cursor
 2026-04-07 21:01:20 +08:00
semantic-release-bot 8f69a08399 chore(release): 10.25.3 [skip ci] 
## [10.25.3](https://github.com/harttle/liquidjs/compare/v10.25.2...v10.25.3) (2026-04-06)

### Bug Fixes

* precise memoryLimit for string replace ([abc058b](https://github.com/harttle/liquidjs/commit/abc058be0f33d6372cd2216f4945183167abeb25))
* use realpath for fs.contains ([#867](https://github.com/harttle/liquidjs/issues/867)) ([529dd67](https://github.com/harttle/liquidjs/commit/529dd67eeb6b125637623d6a723601f0938d3613))
v10.25.3 		2026-04-06 06:45:50 +00:00
Yang JunandGitHub 529dd67eeb fix: use realpath for fs.contains (#867) 
* fix: use realpath for fs.contains

* chore: reset file mode changes

Made-with: Cursor

* fix: Windows compat for contains/containsSync and toLiquidAsync arg order

Made-with: Cursor
 2026-04-06 14:40:35 +08:00
Harttle abc058be0f fix: precise memoryLimit for string replace 2026-03-26 19:36:31 +08:00
semantic-release-bot 521177e3f6 chore(release): 10.25.2 [skip ci] 
## [10.25.2](https://github.com/harttle/liquidjs/compare/v10.25.1...v10.25.2) (2026-03-25)

### Bug Fixes

* handle undefined replacement argument in replace filter ([#864](https://github.com/harttle/liquidjs/issues/864)) ([0ad2b11](https://github.com/harttle/liquidjs/commit/0ad2b11ab15e7da608a9ef936b2a00a6a6517038))
v10.25.2 		2026-03-25 17:20:39 +00:00
allcontributors[bot]GitHuballcontributors[bot] <46447321+allcontributors[bot]@users.noreply.github.com>
 		75e06eff92 docs: add joecottam as a contributor for code (#865) 
* docs: update README.md [skip ci]

* docs: update .all-contributorsrc [skip ci]

---------

Co-authored-by: allcontributors[bot] <46447321+allcontributors[bot]@users.noreply.github.com>
 2026-03-26 01:19:19 +08:00
Joe CottamandGitHub 0ad2b11ab1 fix: handle undefined replacement argument in replace filter (#864) 2026-03-26 01:18:40 +08:00
semantic-release-bot 97d829116c chore(release): 10.25.1 [skip ci] 
## [10.25.1](https://github.com/harttle/liquidjs/compare/v10.25.0...v10.25.1) (2026-03-22)

### Bug Fixes

* mem limiter for invalid ranges ([95ddefc](https://github.com/harttle/liquidjs/commit/95ddefc056a11a44d9e753fd47a39db2c241e578))
* treat args for replace_first as literal ([35d5230](https://github.com/harttle/liquidjs/commit/35d523026345d80458df24c72e653db78b5d061d))
v10.25.1 		2026-03-22 14:18:52 +00:00
Harttle 35d5230263 fix: treat args for replace_first as literal 2026-03-22 22:16:45 +08:00
Harttle 94440a0653 chore: more strict mem limit for string filters 2026-03-22 22:10:39 +08:00
Yang JunandHarttle 95ddefc056 fix: mem limiter for invalid ranges 2026-03-22 10:24:03 +08:00
Yang JunandGitHub 1b85fdaa9c docs: update contact in security.md (#862) 2026-03-08 15:41:45 +08:00
semantic-release-bot 93c38c7c6d chore(release): 10.25.0 [skip ci] 
# [10.25.0](https://github.com/harttle/liquidjs/compare/v10.24.0...v10.25.0) (2026-03-07)

### Bug Fixes

* path traversal vulnerability, [#851](https://github.com/harttle/liquidjs/issues/851) ([#855](https://github.com/harttle/liquidjs/issues/855)) ([3cd024d](https://github.com/harttle/liquidjs/commit/3cd024d652dc883c46307581e979fe32302adbac))

### Features

* export error types, resolving [#837](https://github.com/harttle/liquidjs/issues/837) ([#840](https://github.com/harttle/liquidjs/issues/840)) ([71aa1b1](https://github.com/harttle/liquidjs/commit/71aa1b1998a3a66e536af67c6ea8947a28616eaf))
v10.25.0 		2026-03-07 20:01:42 +00:00
Yang JunandGitHub c7a291b46b chore: update semantic-release dependencies (#861) 2026-03-08 04:00:26 +08:00
Yang JunandGitHub eb4683ee3f chore: update to NPM Trusted Release (#860) 2026-03-08 03:35:49 +08:00
Yang JunandGitHub f1fc573a65 docs: state differences regarding inspect array/hash, #852, #853 (#858) 2026-03-08 03:14:13 +08:00
allcontributors[bot]GitHuballcontributors[bot] <46447321+allcontributors[bot]@users.noreply.github.com>
 		524cd92cfe docs: add peaktwilight as a contributor for code (#857) 
* docs: update README.md [skip ci]

* docs: update .all-contributorsrc [skip ci]

---------

Co-authored-by: allcontributors[bot] <46447321+allcontributors[bot]@users.noreply.github.com>
 2026-03-08 02:40:16 +08:00
allcontributors[bot]GitHuballcontributors[bot] <46447321+allcontributors[bot]@users.noreply.github.com>
 		0d9e797889 docs: add MorielHarush as a contributor for code (#856) 
* docs: update README.md [skip ci]

* docs: update .all-contributorsrc [skip ci]

---------

Co-authored-by: allcontributors[bot] <46447321+allcontributors[bot]@users.noreply.github.com>
 2026-03-08 02:39:45 +08:00
Yang JunGitHubMorielHarush
 		3cd024d652 fix: path traversal vulnerability, #851 (#855) 
* Fix Path Traversal fallback

* Update loader.ts

Fixed nested

* Update loader.ts

padding fix

* refactor: reuse root enforcing

* docs: update test case and docs

---------

Co-authored-by: MorielHarush <[email protected]>
 2026-03-08 02:36:09 +08:00
Yang JunandGitHub 85233e0568 docs: update testmu sponsor link (#850) 2026-02-14 13:54:03 +08:00
Yang JunandGitHub 02403a1879 docs: Change LambdaTest to TestMu AI (#848) 2026-01-19 23:26:49 +08:00
Yang JunandGitHub 1c6316111d docs: update docs for operators (#847) 2026-01-10 22:09:10 +08:00
Yang JunandGitHub 71aa1b1998 feat: export error types, resolving #837 (#840) 2025-11-22 00:27:44 +08:00
allcontributors[bot]GitHuballcontributors[bot] <46447321+allcontributors[bot]@users.noreply.github.com>
 		350f95c8f7 docs: add rongjiecomputer as a contributor for code (#835) 
* docs: update README.md [skip ci]

* docs: update .all-contributorsrc [skip ci]

---------

Co-authored-by: allcontributors[bot] <46447321+allcontributors[bot]@users.noreply.github.com>
 2025-11-11 13:59:45 +08:00
Loo Rong JieandGitHub 955b7971c0 Support having new line and other whitespace after include filename (#834) 2025-11-11 13:58:12 +08:00
allcontributors[bot]GitHuballcontributors[bot] <46447321+allcontributors[bot]@users.noreply.github.com>
 		8686876067 docs: add immerrr as a contributor for doc (#831) 
* docs: update README.md [skip ci]

* docs: update .all-contributorsrc [skip ci]

---------

Co-authored-by: allcontributors[bot] <46447321+allcontributors[bot]@users.noreply.github.com>
 2025-10-31 09:35:15 +08:00
immerrr againandGitHub 3a02eb12bf docs: update tutorial on operators and precedence (#830) 2025-10-31 09:34:05 +08:00
semantic-release-bot 906707833e chore(release): 10.24.0 [skip ci] 
# [10.24.0](https://github.com/harttle/liquidjs/compare/v10.23.0...v10.24.0) (2025-10-27)

### Features

* **filters:** Add base64_encode and base64_decode filters for Shopify compatibility ([#828](https://github.com/harttle/liquidjs/issues/828)) ([86fc135](https://github.com/harttle/liquidjs/commit/86fc135d9ec0137689faf150535b9315e75ecc30))
v10.24.0 		2025-10-27 14:53:37 +00:00
allcontributors[bot]GitHuballcontributors[bot] <46447321+allcontributors[bot]@users.noreply.github.com>
 		a2da822cb8 docs: add rosomri as a contributor for code (#829) 
* docs: update README.md [skip ci]

* docs: update .all-contributorsrc [skip ci]

---------

Co-authored-by: allcontributors[bot] <46447321+allcontributors[bot]@users.noreply.github.com>
 2025-10-27 22:42:15 +08:00
Omri RosnerandGitHub 86fc135d9e feat(filters): Add base64_encode and base64_decode filters for Shopify compatibility (#828) 
* feat(filters): add base64 encode and decode

* fix: use Object.defineProperty for cross-platform btoa/atob mocking

* docs(filters): update docs

* docs(filters): update version
 2025-10-27 22:40:31 +08:00
Yang JunandGitHub 5d953132e8 docs: add lambdatest to sponsors (#826) 2025-10-26 15:00:27 +08:00