Files
liquidjs/src/context/context.spec.ts
T
552819a84b fix: enforce ownPropertyOnly for inherited array indices (#924)
* fix: enforce ownPropertyOnly for inherited array indices

Route array index access (including negative indices, first/last, and the
first/last filters) through a shared readArrayElement helper so that
ownPropertyOnly hides prototype-inherited array indices, closing the
GHSA-fwxr-j5w2-587m bypass. The option's scope (property/index access
only, not filter transforms or iteration) is documented on the option.

Co-authored-by: Cursor <[email protected]>

* fix(filters): invoke Array.prototype methods on unsanitized array values

Call built-ins via Array.prototype.<m>.call(...) for values that come
from scope (join, compact, concat, slice, where/reject) so an overridden
instance method on unsanitized data cannot hijack filter behavior.
Methods on freshly-created arrays are left as-is.

Co-authored-by: Cursor <[email protected]>

* fix(filters): use String.prototype.slice for the string branch of slice

Route the non-array branch through String.prototype.slice.call so the
slice filter never dispatches through a possibly-overridden instance
method, matching the Array.prototype guard.

Co-authored-by: Cursor <[email protected]>

---------

Co-authored-by: Cursor <[email protected]>
2026-07-06 20:12:09 +08:00

235 lines
8.4 KiB
TypeScript

import { Context } from './context'
import { Scope } from './scope'
describe('Context', function () {
let ctx: any, scope: Scope
beforeEach(function () {
scope = {
foo: 'zoo',
one: 1,
zoo: { size: 4 },
map: new Map([['foo', 'FOO']]),
obj: {
first: 'f',
last: 'l'
},
func: () => 'FUNC',
objFunc: () => ({ prop: 'PROP' }),
bar: {
zoo: 'coo',
'Mr.Smith': 'John',
arr: ['a', 'b']
},
arr: ['a', 'b', 'c', 'd']
}
ctx = new Context(scope)
})
describe('#get()', function () {
it('should get direct property', async function () {
expect(ctx.get(['foo'])).toEqual('zoo')
})
it('should read nested property', async function () {
expect(ctx.get(['obj', 'first'])).toEqual('f')
expect(ctx.get(['obj', 'last'])).toEqual('l')
expect(ctx.get(['obj', 'size'])).toEqual(2)
})
it('undefined property should yield undefined', async function () {
expect(ctx.get(['notdefined'])).toEqual(undefined)
expect(ctx.get([false as any])).toEqual(undefined)
})
it('should respect to toLiquid', async function () {
const scope = new Context({ foo: {
toLiquid: () => ({ bar: 'BAR' }),
bar: 'bar'
} })
// eslint-disable-next-line deprecation/deprecation
expect(scope.get(['foo', 'bar'])).toEqual('BAR')
})
it('should return undefined when not exist', async function () {
expect(ctx.get(['foo', 'foo', 'foo'])).toBeUndefined()
})
it('should return string length as size', async function () {
expect(ctx.get(['foo', 'size'])).toEqual(3)
})
it('should return array length as size', async function () {
expect(ctx.get(['bar', 'arr', 'size'])).toEqual(2)
})
it('should return map size as size', async function () {
expect(ctx.get(['map', 'size'])).toEqual(1)
})
it('should return undefined if not have a size', async function () {
expect(ctx.get(['one', 'size'])).toBeUndefined()
expect(ctx.get(['non-exist', 'size'])).toBeUndefined()
})
it('should read .first of array', async function () {
expect(ctx.get(['bar', 'arr', 'first'])).toEqual('a')
})
it('should read .last of array', async function () {
expect(ctx.get(['bar', 'arr', 'last'])).toEqual('b')
})
it('should read element of array', async function () {
expect(ctx.get(['arr', 1])).toEqual('b')
})
it('should read element of array from end', async function () {
expect(ctx.get(['arr', -2])).toEqual('c')
})
it('should call function', async function () {
expect(ctx.get(['func'])).toEqual('FUNC')
})
it('should call function before read nested property', async function () {
expect(ctx.get(['objFunc', 'prop'])).toEqual('PROP')
})
})
describe('#getFromScope()', function () {
it('should support string', () => {
expect(ctx.getFromScope({ obj: { foo: 'FOO' } }, 'obj.foo')).toEqual('FOO')
})
})
describe('strictVariables', function () {
let ctx: Context
beforeEach(function () {
ctx = new Context(ctx, {
strictVariables: true
} as any)
})
it('should throw when variable not defined', function () {
return expect(() => ctx.getSync(['notdefined'])).toThrow(/undefined variable: notdefined/)
})
it('should throw when deep variable not exist', async function () {
ctx.push({ foo: 'FOO' })
return expect(() => ctx.getSync(['foo', 'bar', 'not', 'defined'])).toThrow(/undefined variable: foo.bar/)
})
it('should throw when itself not defined', async function () {
ctx.push({ foo: 'FOO' })
return expect(() => ctx.getSync(['foo', 'BAR'])).toThrow(/undefined variable: foo.BAR/)
})
it('should find variable in parent scope', async function () {
ctx.push({ 'foo': 'foo' })
ctx.push({
'bar': 'bar'
})
expect(ctx.getSync(['foo'])).toEqual('foo')
})
})
describe('ownPropertyOnly', function () {
let ctx: Context
beforeEach(function () {
ctx = new Context(ctx, {
ownPropertyOnly: true
} as any)
})
it('should return undefined for prototype object property', function () {
ctx.push({ foo: Object.create({ bar: 'BAR' }) })
return expect(ctx.getSync(['foo', 'bar'])).toEqual(undefined)
})
it('should use prototype when ownPropertyOnly=false', function () {
ctx = new Context({ foo: Object.create({ bar: 'BAR' }) }, { ownPropertyOnly: false } as any)
return expect(ctx.getSync(['foo', 'bar'])).toEqual('BAR')
})
it('renderOptions.ownPropertyOnly should override options.ownPropertyOnly', function () {
ctx = new Context({ foo: Object.create({ bar: 'BAR' }) }, { ownPropertyOnly: false } as any, { ownPropertyOnly: true })
return expect(ctx.getSync(['foo', 'bar'])).toEqual(undefined)
})
it('should return undefined for Array.prototype.reduce', function () {
ctx.push({ foo: [] })
return expect(ctx.getSync(['foo', 'reduce'])).toEqual(undefined)
})
it('should return undefined for function prototype property', function () {
function Foo () {}
Foo.prototype.bar = 'BAR'
ctx.push({ foo: new (Foo as any)() })
return expect(ctx.getSync(['foo', 'bar'])).toEqual(undefined)
})
it('should allow function constructor properties', function () {
function Foo (this: any) { this.bar = 'BAR' }
ctx.push({ foo: new (Foo as any)() })
return expect(ctx.getSync(['foo', 'bar'])).toEqual('BAR')
})
it('should return undefined for class method', function () {
class Foo { bar () {} }
ctx.push({ foo: new Foo() })
return expect(ctx.getSync(['foo', 'bar'])).toEqual(undefined)
})
it('should allow class property', function () {
class Foo { bar = 'BAR' }
ctx.push({ foo: new Foo() })
return expect(ctx.getSync(['foo', 'bar'])).toEqual('BAR')
})
it('should allow Array.prototype.length', function () {
ctx.push({ foo: [1, 2] })
return expect(ctx.getSync(['foo', 'length'])).toEqual(2)
})
it('should allow size to access Array.prototype.length', function () {
ctx.push({ foo: [1, 2] })
return expect(ctx.getSync(['foo', 'size'])).toEqual(2)
})
it('should allow size to access Set.prototype.size', function () {
ctx.push({ foo: new Set([1, 2]) })
return expect(ctx.getSync(['foo', 'size'])).toEqual(2)
})
it('should allow size to access Object key count', function () {
ctx.push({ foo: { bar: 'BAR', coo: 'COO' } })
return expect(ctx.getSync(['foo', 'size'])).toEqual(2)
})
it('should throw when property is hidden and strictVariables is true', function () {
ctx = new Context(ctx, {
ownPropertyOnly: true,
strictVariables: true
} as any)
ctx.push({ foo: Object.create({ bar: 'BAR' }) })
return expect(() => ctx.getSync(['foo', 'bar'])).toThrow(/undefined variable: foo.bar/)
})
it('should return undefined for inherited array indices', function () {
// eslint-disable-next-line no-extend-native
Array.prototype[0] = 'POLLUTED'
try {
const a: number[] = []
a.length = 1
ctx.push({ foo: a })
expect(ctx.getSync(['foo', 0])).toEqual(undefined)
expect(ctx.getSync(['foo', -1])).toEqual(undefined)
expect(ctx.getSync(['foo', 'first'])).toEqual(undefined)
expect(ctx.getSync(['foo', 'last'])).toEqual(undefined)
} finally {
delete (Array.prototype as any)[0]
}
})
})
describe('.getAll()', function () {
it('should get all properties when arguments empty', async function () {
expect(ctx.getAll()).toEqual(scope)
})
})
describe('.push()', function () {
it('should push scope', async function () {
ctx.push({ 'bar': 'bar' })
ctx.push({
foo: 'foo'
})
expect(ctx.getSync(['foo'])).toEqual('foo')
expect(ctx.getSync(['bar'])).toEqual('bar')
})
it('should hide deep properties by push', async function () {
ctx.push({ bar: { bar: 'bar' } })
ctx.push({ bar: { foo: 'foo' } })
expect(ctx.getSync(['bar', 'foo'])).toEqual('foo')
expect(ctx.getSync(['bar', 'bar'])).toEqual(undefined)
})
})
describe('.pop()', function () {
it('should pop scope', async function () {
ctx.push({
foo: 'foo'
})
ctx.pop()
expect(ctx.getSync(['foo'])).toEqual('zoo')
})
})
})