kemko/liquid
1
0
Fork 0
mirror of https://github.com/kemko/liquid.git synced 2026-01-06 10:15:40 +03:00
Code Issues Actions Packages Projects Releases Wiki Activity

security: Prevent arbitrary method invocation on conditions in if tag.

Browse Source
This commit is contained in:
Dylan Thacker-Smith
2013-10-28 11:19:25 -04:00
parent 71a386f723
commit cc982e92d0
3 changed files with 11 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
test/liquid/tags/if_else_tag_test.rb
View File

@@ -157,4 +157,10 @@ class IfElseTagTest < Test::Unit::TestCase
assert_template_result('yes',
%({% if 'gnomeslab-and-or-liquid' contains 'gnomeslab-and-or-liquid' %}yes{% endif %}))
end
def test_operators_are_whitelisted
assert_raise(SyntaxError) do
assert_template_result('', %({% if 1 or throw or or 1 %}yes{% endif %}))
end
end
end # IfElseTest