Prevent Range usage in templates from blowing up

Make Template.tags loop-able

History.md

@@ -3,6 +3,7 @@
 ## 4.0.0 / not yet released / branch "master"
 
 ### Changed
+* Add to_number Drop method to allow custom drops to work with number filters (#731)
 * Add strict_variables and strict_filters options to detect undefined references (#691)
 * Improve loop performance (#681) [Florian Weingarten]
 * Rename Drop method `before_method` to `liquid_method_missing` (#661) [Thierry Joyal]

lib/liquid/context.rb

@@ -21,6 +21,7 @@ module Liquid
       @registers        = registers
       @errors           = []
       @partial          = false
+      @strict_variables = false
       @resource_limits  = resource_limits || ResourceLimits.new(Template.default_resource_limits)
       squash_instance_assigns_with_environments
 

lib/liquid/drop.rb

@@ -25,7 +25,7 @@ module Liquid
 
     # Catch all for the method
     def liquid_method_missing(method)
-      return nil unless @context.strict_variables
+      return nil unless @context && @context.strict_variables
       raise Liquid::UndefinedDropMethod, "undefined method #{method}"
     end
 
@@ -62,16 +62,17 @@ module Liquid
     end
 
     def self.invokable_methods
-      unless @invokable_methods
+      @invokable_methods ||= begin
         blacklist = Liquid::Drop.public_instance_methods + [:each]
+
         if include?(Enumerable)
           blacklist += Enumerable.public_instance_methods
           blacklist -= [:sort, :count, :first, :min, :max, :include?]
         end
+
         whitelist = [:to_liquid] + (public_instance_methods - blacklist)
-        @invokable_methods = Set.new(whitelist.map(&:to_s))
+        Set.new(whitelist.map(&:to_s))
       end
-      @invokable_methods
     end
   end
 end

lib/liquid/extensions.rb

@@ -25,6 +25,12 @@ class Numeric # :nodoc:
   end
 end
 
+class Range # :nodoc:
+  def to_liquid
+    self
+  end
+end
+
 class Time # :nodoc:
   def to_liquid
     self

lib/liquid/file_system.rb

@@ -65,7 +65,7 @@ module Liquid
         File.join(root, @pattern % template_path)
       end
 
-      raise FileSystemError, "Illegal template path '#{File.expand_path(full_path)}'" unless File.expand_path(full_path) =~ /\A#{File.expand_path(root)}/
+      raise FileSystemError, "Illegal template path '#{File.expand_path(full_path)}'" unless File.expand_path(full_path).start_with?(File.expand_path(root))
 
       full_path
     end

lib/liquid/parse_context.rb

@@ -1,7 +1,7 @@
 module Liquid
   class ParseContext
-    attr_accessor :partial, :locale, :line_number
-    attr_reader :warnings, :error_mode
+    attr_accessor :locale, :line_number
+    attr_reader :partial, :warnings, :error_mode
 
     def initialize(options = {})
       @template_options = options ? options.dup : {}

lib/liquid/standardfilters.rb

@@ -216,6 +216,9 @@ module Liquid
     end
 
     def concat(input, array)
+      unless array.respond_to?(:to_ary)
+        raise ArgumentError.new("concat filter requires an array argument")
+      end
       InputIterator.new(input).concat(array)
     end
 
@@ -286,6 +289,12 @@ module Liquid
       array.last if array.respond_to?(:last)
     end
 
+    # absolute value
+    def abs(input)
+      result = Utils.to_number(input).abs
+      result.is_a?(BigDecimal) ? result.to_f : result
+    end
+
     # addition
     def plus(input, operand)
       apply_operation(input, operand, :+)
@@ -370,7 +379,7 @@ module Liquid
       end
 
       def concat(args)
-        to_a.concat args
+        to_a.concat(args)
       end
 
       def reverse

lib/liquid/tags/for.rb

@@ -48,8 +48,10 @@ module Liquid
 
     def initialize(tag_name, markup, options)
       super
+      @from = @limit = nil
       parse_with_selected_parser(markup)
       @for_block = BlockBody.new
+      @else_block = nil
     end
 
     def parse(tokens)

lib/liquid/tags/raw.rb

@@ -6,9 +6,7 @@ module Liquid
     def initialize(tag_name, markup, parse_context)
       super
 
-      unless markup =~ Syntax
-        raise SyntaxError.new(parse_context.locale.t("errors.syntax.tag_unexpected_args".freeze, tag: tag_name))
-      end
+      ensure_valid_markup(tag_name, markup, parse_context)
     end
 
     def parse(tokens)
@@ -35,6 +33,14 @@ module Liquid
     def blank?
       @body.empty?
     end
+
+    protected
+
+    def ensure_valid_markup(tag_name, markup, parse_context)
+      unless markup =~ Syntax
+        raise SyntaxError.new(parse_context.locale.t("errors.syntax.tag_unexpected_args".freeze, tag: tag_name))
+      end
+    end
   end
 
   Template.register_tag('raw'.freeze, Raw)

lib/liquid/template.rb

@@ -19,8 +19,10 @@ module Liquid
     @@file_system = BlankFileSystem.new
 
     class TagRegistry
+      include Enumerable
+
       def initialize
-        @tags  = {}
+        @tags = {}
         @cache = {}
       end
 
@@ -41,6 +43,10 @@ module Liquid
         @cache.delete(tag_name)
       end
 
+      def each(&block)
+        @tags.each(&block)
+      end
+
       private
 
       def lookup_class(name)
@@ -80,11 +86,11 @@ module Liquid
       end
 
       def error_mode
-        @error_mode || :lax
+        @error_mode ||= :lax
       end
 
       def taint_mode
-        @taint_mode || :lax
+        @taint_mode ||= :lax
       end
 
       # Pass a module with filter methods which should be available
@@ -107,6 +113,7 @@ module Liquid
     end
 
     def initialize
+      @rethrow_errors = false
       @resource_limits = ResourceLimits.new(self.class.default_resource_limits)
     end
 

lib/liquid/tokenizer.rb

@@ -4,7 +4,7 @@ module Liquid
 
     def initialize(source, line_numbers = false)
       @source = source
-      @line_number = 1 if line_numbers
+      @line_number = line_numbers ? 1 : nil
       @tokens = tokenize
     end
 

lib/liquid/utils.rb

@@ -50,9 +50,13 @@ module Liquid
       when Numeric
         obj
       when String
-        (obj.strip =~ /\A\d+\.\d+\z/) ? BigDecimal.new(obj) : obj.to_i
+        (obj.strip =~ /\A-?\d+\.\d+\z/) ? BigDecimal.new(obj) : obj.to_i
       else
-        0
+        if obj.respond_to?(:to_number)
+          obj.to_number
+        else
+          0
+        end
       end
     end
 

lib/liquid/version.rb

@@ -1,4 +1,4 @@
 # encoding: utf-8
 module Liquid
-  VERSION = "4.0.0.rc1"
+  VERSION = "4.0.0.rc2"
 end

test/integration/error_handling_test.rb

@@ -94,7 +94,7 @@ class ErrorHandlingTest < Minitest::Test
       )
     end
 
-    assert_match /Liquid syntax error \(line 4\)/, err.message
+    assert_match(/Liquid syntax error \(line 4\)/, err.message)
   end
 
   def test_parsing_warn_with_line_numbers_adds_numbers_to_lexer_errors

test/integration/hash_ordering_test.rb

@@ -1,18 +1,18 @@
 require 'test_helper'
 
-module MoneyFilter
-  def money(input)
-    sprintf(' %d$ ', input)
-  end
-end
-
-module CanadianMoneyFilter
-  def money(input)
-    sprintf(' %d$ CAD ', input)
-  end
-end
-
 class HashOrderingTest < Minitest::Test
+  module MoneyFilter
+    def money(input)
+      sprintf(' %d$ ', input)
+    end
+  end
+
+  module CanadianMoneyFilter
+    def money(input)
+      sprintf(' %d$ CAD ', input)
+    end
+  end
+
   include Liquid
 
   def test_global_register_order

test/integration/security_test.rb

@@ -9,6 +9,10 @@ end
 class SecurityTest < Minitest::Test
   include Liquid
 
+  def setup
+    @assigns = {}
+  end
+
   def test_no_instance_eval
     text = %( {{ '1+1' | instance_eval }} )
     expected = %( 1+1 )

test/integration/standard_filter_test.rb

@@ -41,6 +41,16 @@ class TestEnumerable < Liquid::Drop
   end
 end
 
+class NumberLikeThing < Liquid::Drop
+  def initialize(amount)
+    @amount = amount
+  end
+
+  def to_number
+    @amount
+  end
+end
+
 class StandardFiltersTest < Minitest::Test
   include Liquid
 
@@ -364,20 +374,38 @@ class StandardFiltersTest < Minitest::Test
   def test_plus
     assert_template_result "2", "{{ 1 | plus:1 }}"
     assert_template_result "2.0", "{{ '1' | plus:'1.0' }}"
+
+    assert_template_result "5", "{{ price | plus:'2' }}", 'price' => NumberLikeThing.new(3)
   end
 
   def test_minus
     assert_template_result "4", "{{ input | minus:operand }}", 'input' => 5, 'operand' => 1
     assert_template_result "2.3", "{{ '4.3' | minus:'2' }}"
+
+    assert_template_result "5", "{{ price | minus:'2' }}", 'price' => NumberLikeThing.new(7)
+  end
+
+  def test_abs
+    assert_template_result "17", "{{ 17 | abs }}"
+    assert_template_result "17", "{{ -17 | abs }}"
+    assert_template_result "17", "{{ '17' | abs }}"
+    assert_template_result "17", "{{ '-17' | abs }}"
+    assert_template_result "0", "{{ 0 | abs }}"
+    assert_template_result "0", "{{ '0' | abs }}"
+    assert_template_result "17.42", "{{ 17.42 | abs }}"
+    assert_template_result "17.42", "{{ -17.42 | abs }}"
+    assert_template_result "17.42", "{{ '17.42' | abs }}"
+    assert_template_result "17.42", "{{ '-17.42' | abs }}"
   end
 
   def test_times
     assert_template_result "12", "{{ 3 | times:4 }}"
     assert_template_result "0", "{{ 'foo' | times:4 }}"
-
     assert_template_result "6", "{{ '2.1' | times:3 | replace: '.','-' | plus:0}}"
-
     assert_template_result "7.25", "{{ 0.0725 | times:100 }}"
+    assert_template_result "-7.25", '{{ "-0.0725" | times:100 }}'
+    assert_template_result "7.25", '{{ "-0.0725" | times: -100 }}'
+    assert_template_result "4", "{{ price | times:2 }}", 'price' => NumberLikeThing.new(2)
   end
 
   def test_divided_by
@@ -391,6 +419,8 @@ class StandardFiltersTest < Minitest::Test
     assert_raises(Liquid::ZeroDivisionError) do
       assert_template_result "4", "{{ 1 | modulo: 0 }}"
     end
+
+    assert_template_result "5", "{{ price | divided_by:2 }}", 'price' => NumberLikeThing.new(10)
   end
 
   def test_modulo
@@ -398,6 +428,8 @@ class StandardFiltersTest < Minitest::Test
     assert_raises(Liquid::ZeroDivisionError) do
       assert_template_result "4", "{{ 1 | modulo: 0 }}"
     end
+
+    assert_template_result "1", "{{ price | modulo:2 }}", 'price' => NumberLikeThing.new(3)
   end
 
   def test_round
@@ -407,6 +439,9 @@ class StandardFiltersTest < Minitest::Test
     assert_raises(Liquid::FloatDomainError) do
       assert_template_result "4", "{{ 1.0 | divided_by: 0.0 | round }}"
     end
+
+    assert_template_result "5", "{{ price | round }}", 'price' => NumberLikeThing.new(4.6)
+    assert_template_result "4", "{{ price | round }}", 'price' => NumberLikeThing.new(4.3)
   end
 
   def test_ceil
@@ -415,6 +450,8 @@ class StandardFiltersTest < Minitest::Test
     assert_raises(Liquid::FloatDomainError) do
       assert_template_result "4", "{{ 1.0 | divided_by: 0.0 | ceil }}"
     end
+
+    assert_template_result "5", "{{ price | ceil }}", 'price' => NumberLikeThing.new(4.6)
   end
 
   def test_floor
@@ -423,6 +460,8 @@ class StandardFiltersTest < Minitest::Test
     assert_raises(Liquid::FloatDomainError) do
       assert_template_result "4", "{{ 1.0 | divided_by: 0.0 | floor }}"
     end
+
+    assert_template_result "5", "{{ price | floor }}", 'price' => NumberLikeThing.new(5.4)
   end
 
   def test_append
@@ -436,8 +475,7 @@ class StandardFiltersTest < Minitest::Test
     assert_equal [1, 2, 'a'],  @filters.concat([1, 2], ['a'])
     assert_equal [1, 2, 10],   @filters.concat([1, 2], [10])
 
-    assert_raises(TypeError) do
-      # no implicit conversion of Fixnum into Array
+    assert_raises(Liquid::ArgumentError, "concat filter requires an array argument") do
       @filters.concat([1, 2], 10)
     end
   end

test/integration/tags/raw_tag_test.rb

@@ -24,8 +24,8 @@ class RawTagTest < Minitest::Test
   end
 
   def test_invalid_raw
-    assert_match_syntax_error /tag was never closed/, '{% raw %} foo'
-    assert_match_syntax_error /Valid syntax/, '{% raw } foo {% endraw %}'
-    assert_match_syntax_error /Valid syntax/, '{% raw } foo %}{% endraw %}'
+    assert_match_syntax_error(/tag was never closed/, '{% raw %} foo')
+    assert_match_syntax_error(/Valid syntax/, '{% raw } foo {% endraw %}')
+    assert_match_syntax_error(/Valid syntax/, '{% raw } foo %}{% endraw %}')
   end
 end

test/integration/template_test.rb

@@ -306,4 +306,14 @@ class TemplateTest < Minitest::Test
       t.render!({ 'x' => 'foo' }, { strict_filters: true })
     end
   end
+
+  def test_using_range_literal_works_as_expected
+    t = Template.parse("{% assign foo = (x..y) %}{{ foo }}")
+    result = t.render({ 'x' => 1, 'y' => 5 })
+    assert_equal '1..5', result
+
+    t = Template.parse("{% assign nums = (x..y) %}{% for num in nums %}{{ num }}{% endfor %}")
+    result = t.render({ 'x' => 1, 'y' => 5 })
+    assert_equal '12345', result
+  end
 end

test/unit/block_unit_test.rb

@@ -46,6 +46,8 @@ class BlockUnitTest < Minitest::Test
   def test_with_custom_tag
     Liquid::Template.register_tag("testtag", Block)
     assert Liquid::Template.parse("{% testtag %} {% endtesttag %}")
+  ensure
+    Liquid::Template.tags.delete('testtag')
   end
 
   private

test/unit/condition_unit_test.rb

@@ -3,50 +3,54 @@ require 'test_helper'
 class ConditionUnitTest < Minitest::Test
   include Liquid
 
+  def setup
+    @context = Liquid::Context.new
+  end
+
   def test_basic_condition
     assert_equal false, Condition.new(1, '==', 2).evaluate
     assert_equal true,  Condition.new(1, '==', 1).evaluate
   end
 
   def test_default_operators_evalute_true
-    assert_evalutes_true 1, '==', 1
-    assert_evalutes_true 1, '!=', 2
-    assert_evalutes_true 1, '<>', 2
-    assert_evalutes_true 1, '<', 2
-    assert_evalutes_true 2, '>', 1
-    assert_evalutes_true 1, '>=', 1
-    assert_evalutes_true 2, '>=', 1
-    assert_evalutes_true 1, '<=', 2
-    assert_evalutes_true 1, '<=', 1
+    assert_evaluates_true 1, '==', 1
+    assert_evaluates_true 1, '!=', 2
+    assert_evaluates_true 1, '<>', 2
+    assert_evaluates_true 1, '<', 2
+    assert_evaluates_true 2, '>', 1
+    assert_evaluates_true 1, '>=', 1
+    assert_evaluates_true 2, '>=', 1
+    assert_evaluates_true 1, '<=', 2
+    assert_evaluates_true 1, '<=', 1
     # negative numbers
-    assert_evalutes_true 1, '>', -1
-    assert_evalutes_true -1, '<', 1
-    assert_evalutes_true 1.0, '>', -1.0
-    assert_evalutes_true -1.0, '<', 1.0
+    assert_evaluates_true 1, '>', -1
+    assert_evaluates_true (-1), '<', 1
+    assert_evaluates_true 1.0, '>', -1.0
+    assert_evaluates_true (-1.0), '<', 1.0
   end
 
   def test_default_operators_evalute_false
-    assert_evalutes_false 1, '==', 2
-    assert_evalutes_false 1, '!=', 1
-    assert_evalutes_false 1, '<>', 1
-    assert_evalutes_false 1, '<', 0
-    assert_evalutes_false 2, '>', 4
-    assert_evalutes_false 1, '>=', 3
-    assert_evalutes_false 2, '>=', 4
-    assert_evalutes_false 1, '<=', 0
-    assert_evalutes_false 1, '<=', 0
+    assert_evaluates_false 1, '==', 2
+    assert_evaluates_false 1, '!=', 1
+    assert_evaluates_false 1, '<>', 1
+    assert_evaluates_false 1, '<', 0
+    assert_evaluates_false 2, '>', 4
+    assert_evaluates_false 1, '>=', 3
+    assert_evaluates_false 2, '>=', 4
+    assert_evaluates_false 1, '<=', 0
+    assert_evaluates_false 1, '<=', 0
   end
 
   def test_contains_works_on_strings
-    assert_evalutes_true 'bob', 'contains', 'o'
-    assert_evalutes_true 'bob', 'contains', 'b'
-    assert_evalutes_true 'bob', 'contains', 'bo'
-    assert_evalutes_true 'bob', 'contains', 'ob'
-    assert_evalutes_true 'bob', 'contains', 'bob'
+    assert_evaluates_true 'bob', 'contains', 'o'
+    assert_evaluates_true 'bob', 'contains', 'b'
+    assert_evaluates_true 'bob', 'contains', 'bo'
+    assert_evaluates_true 'bob', 'contains', 'ob'
+    assert_evaluates_true 'bob', 'contains', 'bob'
 
-    assert_evalutes_false 'bob', 'contains', 'bob2'
-    assert_evalutes_false 'bob', 'contains', 'a'
-    assert_evalutes_false 'bob', 'contains', '---'
+    assert_evaluates_false 'bob', 'contains', 'bob2'
+    assert_evaluates_false 'bob', 'contains', 'a'
+    assert_evaluates_false 'bob', 'contains', '---'
   end
 
   def test_invalid_comparation_operator
@@ -65,29 +69,29 @@ class ConditionUnitTest < Minitest::Test
     @context['array'] = [1, 2, 3, 4, 5]
     array_expr = VariableLookup.new("array")
 
-    assert_evalutes_false array_expr, 'contains', 0
-    assert_evalutes_true array_expr, 'contains', 1
-    assert_evalutes_true array_expr, 'contains', 2
-    assert_evalutes_true array_expr, 'contains', 3
-    assert_evalutes_true array_expr, 'contains', 4
-    assert_evalutes_true array_expr, 'contains', 5
-    assert_evalutes_false array_expr, 'contains', 6
-    assert_evalutes_false array_expr, 'contains', "1"
+    assert_evaluates_false array_expr, 'contains', 0
+    assert_evaluates_true array_expr, 'contains', 1
+    assert_evaluates_true array_expr, 'contains', 2
+    assert_evaluates_true array_expr, 'contains', 3
+    assert_evaluates_true array_expr, 'contains', 4
+    assert_evaluates_true array_expr, 'contains', 5
+    assert_evaluates_false array_expr, 'contains', 6
+    assert_evaluates_false array_expr, 'contains', "1"
   end
 
   def test_contains_returns_false_for_nil_operands
     @context = Liquid::Context.new
-    assert_evalutes_false VariableLookup.new('not_assigned'), 'contains', '0'
-    assert_evalutes_false 0, 'contains', VariableLookup.new('not_assigned')
+    assert_evaluates_false VariableLookup.new('not_assigned'), 'contains', '0'
+    assert_evaluates_false 0, 'contains', VariableLookup.new('not_assigned')
   end
 
   def test_contains_return_false_on_wrong_data_type
-    assert_evalutes_false 1, 'contains', 0
+    assert_evaluates_false 1, 'contains', 0
   end
 
   def test_contains_with_string_left_operand_coerces_right_operand_to_string
-    assert_evalutes_true ' 1 ', 'contains', 1
-    assert_evalutes_false ' 1 ', 'contains', 2
+    assert_evaluates_true ' 1 ', 'contains', 1
+    assert_evaluates_false ' 1 ', 'contains', 2
   end
 
   def test_or_condition
@@ -121,8 +125,8 @@ class ConditionUnitTest < Minitest::Test
   def test_should_allow_custom_proc_operator
     Condition.operators['starts_with'] = proc { |cond, left, right| left =~ %r{^#{right}} }
 
-    assert_evalutes_true 'bob', 'starts_with', 'b'
-    assert_evalutes_false 'bob', 'starts_with', 'o'
+    assert_evaluates_true 'bob', 'starts_with', 'b'
+    assert_evaluates_false 'bob', 'starts_with', 'o'
   ensure
     Condition.operators.delete 'starts_with'
   end
@@ -131,24 +135,24 @@ class ConditionUnitTest < Minitest::Test
     @context = Liquid::Context.new
     @context['one'] = @context['another'] = "gnomeslab-and-or-liquid"
 
-    assert_evalutes_true VariableLookup.new("one"), '==', VariableLookup.new("another")
+    assert_evaluates_true VariableLookup.new("one"), '==', VariableLookup.new("another")
   end
 
   private
 
-  def assert_evalutes_true(left, op, right)
-    assert Condition.new(left, op, right).evaluate(@context || Liquid::Context.new),
+  def assert_evaluates_true(left, op, right)
+    assert Condition.new(left, op, right).evaluate(@context),
       "Evaluated false: #{left} #{op} #{right}"
   end
 
-  def assert_evalutes_false(left, op, right)
-    assert !Condition.new(left, op, right).evaluate(@context || Liquid::Context.new),
+  def assert_evaluates_false(left, op, right)
+    assert !Condition.new(left, op, right).evaluate(@context),
       "Evaluated true: #{left} #{op} #{right}"
   end
 
   def assert_evaluates_argument_error(left, op, right)
     assert_raises(Liquid::ArgumentError) do
-      Condition.new(left, op, right).evaluate(@context || Liquid::Context.new)
+      Condition.new(left, op, right).evaluate(@context)
     end
   end
 end # ConditionTest

test/unit/template_unit_test.rb

@@ -67,4 +67,12 @@ class TemplateUnitTest < Minitest::Test
     Template.tags.delete('fake')
     assert_nil Template.tags['fake']
   end
+
+  def test_tags_can_be_looped_over
+    Template.register_tag('fake', FakeTag)
+    result = Template.tags.map { |name, klass| [name, klass] }
+    assert result.include?(["fake", "TemplateUnitTest::FakeTag"])
+  ensure
+    Template.tags.delete('fake')
+  end
 end