mirror of
https://github.com/harttle/liquidjs.git
synced 2026-09-15 04:10:40 -07:00
3616a744b9
* fix(strip_html): rewrite as linear single-pass scan to avoid ReDoS The previous strip_html regex /<script[\s\S]*?<\/script>|<style[\s\S]*?<\/style>|<[\s\S]*?>|<!--[\s\S]*?-->/g contains lazy alternatives that backtrack O(n^2) on inputs with many unclosed `<script` / `<style` openers. A 350KB payload of `'<script'.repeat(50000)` blocked the Node.js event loop for ~10s, and cost grew quadratically with input size. memoryLimit only charged str.length, which does not bound regex CPU. Replace the regex with an indexOf-based single-pass scan. For each `<` we: - if `<script` opener: find next `</script>` and skip the whole block; cache "no closer after pos k" so subsequent unclosed `<script` openers do not re-scan the tail. - same for `<style` / `</style>`. - otherwise treat as a generic `<...>` tag (matches the original behavior, where the `<[\s\S]*?>` alternative also caught comments). - if no closing `>` exists, emit the tail as literal text and stop. Total work is O(n). All existing strip_html test cases pass unchanged. Add regression tests covering the PoCs (`<script` / `<style` repeats, and `<script>foo` repeats with `>` but no `</script>`) plus a memoryLimit assertion. Co-authored-by: Cursor <[email protected]> * refactor(strip_html): factor block kinds into a small table Same algorithm and complexity, fewer lines. Document why a regex-only solution can't be O(n) in V8 (no atomic groups / possessive quantifiers / memoization, so unrolled-loop patterns are still O(n^2) on unclosed openers — empirically confirmed: original 280KB ~4s, Friedl unrolled ~14s, atomic lookahead ~7s; tokenizer ~1ms). Co-authored-by: Cursor <[email protected]> * refactor(strip_html): inline block kinds to match file style Drop the module-level STRIP_BLOCKS table; the rest of the file keeps each filter self-contained (only escapeMap/unescapeMap are top-level maps shared across filters). Two openers don't justify a table. Co-authored-by: Cursor <[email protected]> * refactor(strip_html): unify raw-text blocks; treat <!--...--> as opaque In HTML5, <script>, <style>, and <!-- --> are all raw-text blocks: their content is opaque until the matching closer, so a `>` inside CSS, JS, or a comment must not be treated as a tag end. The previous code only had this special handling for <script> and <style>; comments containing `>` fell through to the generic `<...>` branch and were partially stripped (e.g. `<!-- a > b -->` left `b -->` in the output). Match Shopify Liquid's STRIP_HTML_BLOCKS set (script + style + comment), and consolidate the three near-identical branches into a small opener/closer table inside the function. Algorithm and complexity unchanged (O(n) via indexOf + cached closer positions). Add a regression test for `>` inside a comment. Co-authored-by: Cursor <[email protected]> * refactor(strip_html): drop position cache, delete dead blocks from Set Once `indexOf(closer, X)` returns -1, all subsequent searches (with monotonically increasing start) also return -1. So tracking absence is enough; storing positions is unnecessary. Make `blocks` a Set and delete a kind once its closer is known absent — no parallel `dead` bookkeeping. Use Jest's per-test timeout for the ReDoS regressions instead of manual Date.now() bookkeeping. Co-authored-by: Cursor <[email protected]> * refactor(strip_html): treat '<...>' as a catch-all block kind Adding ['<', '>'] as the lowest-priority entry of `blocks` lets the inner loop subsume the generic-tag fallback: the `end` sentinel and its `< 0` / `<= 0` follow-up checks disappear, the "no terminator" exit becomes a single `i === lt` test, and Set<[string, string]> collapses to Map<string, string>. Co-authored-by: Cursor <[email protected]> --------- Co-authored-by: Cursor <[email protected]>
liquidjs
A simple, expressive and safe Shopify / GitHub Pages compatible template engine in pure JavaScript. The purpose of this repo is to provide a standard Liquid implementation for the JavaScript community so that Jekyll sites, GitHub Pages and Shopify templates can be ported to Node.js without pain.
- Documentation
- Please star LiquidJS on GitHub!
- Financial support via GitHub Sponsors.
What's it like?
Basically there're two types of Liquid syntax: tags enclosed by {% %} and outputs enclosed by {{ }}. A Liquid template looks like:
{% if username %}
{{ username | append: ", welcome to LiquidJS!" | capitalize }}
{% endif %}
A live demo is also available and here's a quick tutorial for Liquid syntax.
Installation
Install from npm in Node.js:
npm install liquidjs
Or use the UMD bundle from jsDelivr:
<script src="https://cdn.jsdelivr.net/npm/liquidjs/dist/liquid.browser.min.js"></script>
Or render directly from CLI using npx:
npx liquidjs --template 'Hello, {{ name }}!' --context '{"name": "Snake"}'
For more details, refer to the Setup Guide.
Who's Using LiquidJS?
- Eleventy: Eleventy, a simpler static site generator.
- Github Docs: The open-source repo for docs.github.com.
- Kibana: Elastic's analytics and visualization platform for Elasticsearch; workflow features use LiquidJS for Liquid templates.
- Opensense: The smarter way to send email.
- Directus: an instant REST+GraphQL API and intuitive no-code data collaboration app for any SQL database.
- Rock: An open source CMS, Relationship Management System (RMS) and Church Management System (ChMS) all rolled into one.
- Mitosis: Write components once, run everywhere. Compiles to React, Vue, Qwik, Solid, Angular, Svelte, and more.
- Pattern Lab: a frontend workshop environment that helps you build, view, test, and showcase your design system's UI components.
- Builder.io: the first and only headless CMS with a visual editor that lets you drag and drop with your components, directly within your current site or app. Completely API-driven, for cleaner code and simpler workflows.
- Microsoft Power Pages: a secure, enterprise-grade, low-code software as a service (SaaS) platform for creating, hosting, and administering modern external-facing business websites.
- Azure API Management developer portal: an automatically generated, fully customizable website with the documentation of your APIs.
- WISMOlabs: Post Purchase Experience platform for eCommerce retailers enhancing customer satisfaction by using LiquidJS to provide customizable post-purchase experiences through programmable email, SMS, order tracking pages, and webhooks.
- Freshet: JSON in, page out — a Chrome extension that uses LiquidJS templates per URL pattern, so the JSON becomes a rendered, useful page.
Feel free to create a PR or contact me to add your use case into this list!
Financial Support
If you personally love LiquidJS or it's benefiting your business, please consider financially support us via GitHub Sponsors. Special thanks to our sponsors!
Contributors ✨
Want to contribute? see Contribution Guidelines. Thanks goes to these wonderful people:
