mirror of
https://github.com/harttle/liquidjs.git
synced 2026-09-15 04:10:40 -07:00
3129d46dc9
* fix(date): cap strftime widths and account padding in memoryLimit - Clamp numeric strftime pad widths to MAX_STRFTIME_PAD (1024) - Export estimateStrftimePaddingMemory for the date filter to charge memoryLimit - Replace unbounded pad() concatenation loop with ch.repeat + single concat - Add regression tests for clamping and memoryLimit on huge %width directives Co-authored-by: Cursor <[email protected]> * fix(date): harden strftime memory accounting and document security model Move strftime memory charging into the same formatting path used for padding, enforce pre-allocation checks, and add regression tests for non-string date format PoCs. Add dedicated docs clarifying that memoryLimit is cooperative DoS mitigation and not strict heap isolation. Co-authored-by: Cursor <[email protected]> * docs(zh-cn): add security model docs for DoS limits Add a Chinese security-model tutorial and link it from the Chinese DoS guide to clarify that memoryLimit is cooperative accounting, list uncounted custom conversion cases, and recommend avoiding fully user-defined templates in online services. Co-authored-by: Cursor <[email protected]> * docs: consolidate DoS docs into security-model pages Merge DoS guidance into security-model docs in both English and Chinese, and remove the placeholder dos.md pages to avoid duplicate/redirect-only docs. Co-authored-by: Cursor <[email protected]> * docs: merge DoS details into security-model docs Move the detailed parseLimit/renderLimit/memoryLimit explanations and examples into the English and Chinese security-model pages so content from the removed dos pages is preserved. Co-authored-by: Cursor <[email protected]> * docs: reorganize security-model structure for clarity Restructure English and Chinese security-model docs into a consistent flow: security boundary, limits overview, per-limit details, and online service guidance. Co-authored-by: Cursor <[email protected]> * refactor(strftime): simplify %N width parsing logic Use regex-backed width assumptions to simplify %N width normalization and padding memory accounting while keeping behavior equivalent. Co-authored-by: Cursor <[email protected]> * refactor(strftime): rely on memoryLimit for width control Remove MAX_STRFTIME_PAD hard capping and rely on memoryLimit enforcement before padding allocation. Update strftime/date tests and security-model docs to match the new boundary and renderLimit caveats. Co-authored-by: Cursor <[email protected]> * fix(strftime): use add() once for padding, minimize churn - pad(): replace per-char loop with a single add(str, ch.repeat(n)) call. The earlier `probe[0] === ch` heuristic was wrong when ch happened to equal a leading char of 'probe' (e.g. ch === 'p'). - strftime.ts: revert unrelated typing/structural refactors so the diff contains only the memoryLimit threading and the %N memory charge. - docs: rewire the deleted dos.html sidebar entry to security-model.html (with localized labels) so the deleted page does not 404 from the sidebar. Co-authored-by: Cursor <[email protected]> --------- Co-authored-by: Cursor <[email protected]>
138 lines
3.5 KiB
YAML
138 lines
3.5 KiB
YAML
tutorials:
|
|
getting_started:
|
|
intro: intro-to-liquid.html
|
|
setup: setup.html
|
|
options: options.html
|
|
render_file: render-file.html
|
|
partials: partials-and-layouts.html
|
|
express: use-in-expressjs.html
|
|
advanced:
|
|
caching: caching.html
|
|
escaping: escaping.html
|
|
registration: register-filters-tags.html
|
|
access_scope_in_filters: access-scope-in-filters.html
|
|
parse_parameters: parse-parameters.html
|
|
render_tag_content: render-tag-content.html
|
|
drops: drops.html
|
|
sync_and_async: sync-and-async.html
|
|
whitespace: whitespace-control.html
|
|
plugins: plugins.html
|
|
operators: operators.html
|
|
truth: truthy-and-falsy.html
|
|
security_model: security-model.html
|
|
static_analysis: static-analysis.html
|
|
miscellaneous:
|
|
migration9: migrate-to-9.html
|
|
changelog: changelog.html
|
|
differences: differences.html
|
|
contribution_guidelines: contribution-guidelines.html
|
|
|
|
filters:
|
|
overview: overview.html
|
|
abs: abs.html
|
|
append: append.html
|
|
array_to_sentence_string: array_to_sentence_string.html
|
|
at_least: at_least.html
|
|
at_most: at_most.html
|
|
capitalize: capitalize.html
|
|
ceil: ceil.html
|
|
cgi_escape: cgi_escape.html
|
|
compact: compact.html
|
|
concat: concat.html
|
|
date: date.html
|
|
date_to_long_string: date_to_long_string.html
|
|
date_to_rfc822: date_to_rfc822.html
|
|
date_to_string: date_to_string.html
|
|
date_to_xmlschema: date_to_xmlschema.html
|
|
default: default.html
|
|
divided_by: divided_by.html
|
|
downcase: downcase.html
|
|
escape: escape.html
|
|
escape_once: escape_once.html
|
|
find: find.html
|
|
find_exp: find_exp.html
|
|
find_index: find_index.html
|
|
find_index_exp: find_index_exp.html
|
|
first: first.html
|
|
floor: floor.html
|
|
group_by: group_by.html
|
|
group_by_exp: group_by_exp.html
|
|
has: has.html
|
|
has_exp: has_exp.html
|
|
inspect: inspect.html
|
|
join: join.html
|
|
json: json.html
|
|
jsonify: jsonify.html
|
|
last: last.html
|
|
lstrip: lstrip.html
|
|
map: map.html
|
|
minus: minus.html
|
|
modulo: modulo.html
|
|
newline_to_br: newline_to_br.html
|
|
normalize_whitespace: normalize_whitespace.html
|
|
number_of_words: number_of_words.html
|
|
plus: plus.html
|
|
pop: pop.html
|
|
push: push.html
|
|
prepend: prepend.html
|
|
raw: raw.html
|
|
reject: reject.html
|
|
reject_exp: reject_exp.html
|
|
remove: remove.html
|
|
remove_first: remove_first.html
|
|
remove_last: remove_last.html
|
|
replace: replace.html
|
|
replace_first: replace_first.html
|
|
replace_last: replace_last.html
|
|
reverse: reverse.html
|
|
round: round.html
|
|
rstrip: rstrip.html
|
|
shift: shift.html
|
|
size: size.html
|
|
slice: slice.html
|
|
slugify: slugify.html
|
|
sort: sort.html
|
|
sort_natural: sort_natural.html
|
|
split: split.html
|
|
strip: strip.html
|
|
strip_html: strip_html.html
|
|
strip_newlines: strip_newlines.html
|
|
sum: sum.html
|
|
times: times.html
|
|
to_integer: to_integer.html
|
|
truncate: truncate.html
|
|
truncatewords: truncatewords.html
|
|
uniq: uniq.html
|
|
unshift: unshift.html
|
|
upcase: upcase.html
|
|
uri_escape: uri_escape.html
|
|
url_decode: url_decode.html
|
|
url_encode: url_encode.html
|
|
where: where.html
|
|
where_exp: where_exp.html
|
|
xml_escape: xml_escape.html
|
|
|
|
tags:
|
|
overview: overview.html
|
|
"#": inline_comment.html
|
|
assign: assign.html
|
|
capture: capture.html
|
|
case: case.html
|
|
comment: comment.html
|
|
cycle: cycle.html
|
|
decrement: decrement.html
|
|
echo: echo.html
|
|
else: if.html
|
|
elsif: if.html
|
|
for: for.html
|
|
if: if.html
|
|
include: include.html
|
|
increment: increment.html
|
|
layout: layout.html
|
|
liquid: liquid.html
|
|
raw: raw.html
|
|
render: render.html
|
|
tablerow: tablerow.html
|
|
unless: unless.html
|
|
when: case.html
|