Yang JunandCursor bb7df7f0a8 fix(filters): charge json/jsonify/inspect serialization to memoryLimit ...

json/jsonify/inspect serialized values without charging memoryLimit, so
a concat-doubled array (cheap reference copies) could be materialized
into a huge JSON string past the configured limit — the same unbounded
class as the join bug (GHSA-4r6h-5v86-94p3). Charge via a JSON.stringify
replacer that accounts string lengths as it walks, aborting mid-
serialization instead of allocating the full blob first.

Co-authored-by: Cursor <[email protected]>

2026-07-06 20:53:20 +08:00

..

context

fix: enforce ownPropertyOnly for inherited array indices (#924)

2026-07-06 20:12:09 +08:00

drop

fix: isComparable full interface check (#701)

2024-05-24 10:35:49 +08:00

filters

fix(filters): modulo should follow divisor sign for negative operands (#922)

2026-06-26 01:19:59 +08:00

liquid

fix(filters): charge json/jsonify/inspect serialization to memoryLimit

2026-07-06 20:53:20 +08:00

misc

fix: consistent range syntax parsing, #791

2025-01-19 17:58:00 +08:00

static_analysis

feat: static variable analysis (#770)

2024-12-28 21:35:28 +08:00

tags

fix: propagate ownPropertyOnly into Context.spawn() for {% render %} (#893)

2026-05-03 22:35:31 +08:00