mirror of
https://github.com/harttle/liquidjs.git
synced 2026-09-17 13:20:41 -07:00
3129d46dc9
* fix(date): cap strftime widths and account padding in memoryLimit - Clamp numeric strftime pad widths to MAX_STRFTIME_PAD (1024) - Export estimateStrftimePaddingMemory for the date filter to charge memoryLimit - Replace unbounded pad() concatenation loop with ch.repeat + single concat - Add regression tests for clamping and memoryLimit on huge %width directives Co-authored-by: Cursor <[email protected]> * fix(date): harden strftime memory accounting and document security model Move strftime memory charging into the same formatting path used for padding, enforce pre-allocation checks, and add regression tests for non-string date format PoCs. Add dedicated docs clarifying that memoryLimit is cooperative DoS mitigation and not strict heap isolation. Co-authored-by: Cursor <[email protected]> * docs(zh-cn): add security model docs for DoS limits Add a Chinese security-model tutorial and link it from the Chinese DoS guide to clarify that memoryLimit is cooperative accounting, list uncounted custom conversion cases, and recommend avoiding fully user-defined templates in online services. Co-authored-by: Cursor <[email protected]> * docs: consolidate DoS docs into security-model pages Merge DoS guidance into security-model docs in both English and Chinese, and remove the placeholder dos.md pages to avoid duplicate/redirect-only docs. Co-authored-by: Cursor <[email protected]> * docs: merge DoS details into security-model docs Move the detailed parseLimit/renderLimit/memoryLimit explanations and examples into the English and Chinese security-model pages so content from the removed dos pages is preserved. Co-authored-by: Cursor <[email protected]> * docs: reorganize security-model structure for clarity Restructure English and Chinese security-model docs into a consistent flow: security boundary, limits overview, per-limit details, and online service guidance. Co-authored-by: Cursor <[email protected]> * refactor(strftime): simplify %N width parsing logic Use regex-backed width assumptions to simplify %N width normalization and padding memory accounting while keeping behavior equivalent. Co-authored-by: Cursor <[email protected]> * refactor(strftime): rely on memoryLimit for width control Remove MAX_STRFTIME_PAD hard capping and rely on memoryLimit enforcement before padding allocation. Update strftime/date tests and security-model docs to match the new boundary and renderLimit caveats. Co-authored-by: Cursor <[email protected]> * fix(strftime): use add() once for padding, minimize churn - pad(): replace per-char loop with a single add(str, ch.repeat(n)) call. The earlier `probe[0] === ch` heuristic was wrong when ch happened to equal a leading char of 'probe' (e.g. ch === 'p'). - strftime.ts: revert unrelated typing/structural refactors so the diff contains only the memoryLimit threading and the %N memory charge. - docs: rewire the deleted dos.html sidebar entry to security-model.html (with localized labels) so the deleted page does not 404 from the sidebar. Co-authored-by: Cursor <[email protected]> --------- Co-authored-by: Cursor <[email protected]>
68 lines
1.8 KiB
YAML
68 lines
1.8 KiB
YAML
menu:
|
||
tutorials: 教程
|
||
tags: 标签
|
||
filters: 过滤器
|
||
playground: 演示
|
||
api: API
|
||
search: 搜索
|
||
|
||
index:
|
||
get_started: 开始使用
|
||
contributors:
|
||
title: 贡献
|
||
description: 'LiquidJS 欢迎任何形式的贡献，可以从 <a href="tutorials/contribution-guidelines.html">阅读贡献指南</a> 开始！感谢这些参与过 LiquidJS 项目的人：'
|
||
sponsors:
|
||
title: 赞助
|
||
description: '如果你喜欢 LiquidJS 或你的公司在使用 LiquidJS，请考虑 <a href="tutorials/contribution-guidelines.html#成为赞助者！">赞助 LiquidJS</a>！'
|
||
|
||
playground:
|
||
title: 演示
|
||
loading: 加载中...
|
||
|
||
page:
|
||
contents: 目录
|
||
back_to_top: 回到顶部
|
||
improve: 改进这篇文档
|
||
report: 报告问题
|
||
prev: 上一页
|
||
next: 下一页
|
||
last_updated: 上次更新：%s
|
||
|
||
sidebar:
|
||
tutorials:
|
||
getting_started: 开始使用
|
||
intro: Liquid 简介
|
||
setup: 安装
|
||
options: 选项
|
||
render_file: 文件渲染
|
||
partials: 引用/继承
|
||
express: Express.js 中使用
|
||
|
||
advanced: 高级主题
|
||
caching: 缓存
|
||
escaping: 转义
|
||
registration: 注册标签/过滤器
|
||
access_scope_in_filters: 过滤器里访问上下文
|
||
parse_parameters: 参数解析
|
||
render_tag_content: 渲染标签内容
|
||
drops: Liquid Drop
|
||
sync_and_async: 同步和异步
|
||
whitespace: 换行和缩进
|
||
plugins: 插件
|
||
operators: 运算符
|
||
truth: 真和假
|
||
security_model: 安全模型
|
||
static_analysis: 静态分析
|
||
|
||
miscellaneous: 其他
|
||
migration9: '迁移到 LiquidJS 9'
|
||
contribution_guidelines: '贡献指南'
|
||
differences: 与 Shopify/liquid 的不同
|
||
changelog: '更新日志'
|
||
filters:
|
||
overview: 概述
|
||
tags:
|
||
overview: 概述
|
||
|
||
footer:
|
||
license: '本文档通过 <a href="http://creativecommons.org/licenses/by/4.0/" target="_blank">CC BY 4.0</a> 授权。' |