Bump version to 2.5.5

Cherry pick security fix (#274) to 2-5-stable

.travis.yml

@@ -1,10 +1,11 @@
 rvm:
   - 1.8.7
-  - 1.9.2
+  - 1.9.3
   - ree
-  - jruby
-  - rbx
-  - rbx-2.0
+  - jruby-18mode
+  - jruby-19mode
+  - rbx-18mode
+  - rbx-19mode
 
 script: "rake test"
 

History.md

@@ -1,6 +1,47 @@
 # Liquid Version History
 
-## 2.3.0
+## 2.5.5 / 2014-01-10 / branch "2-5-stable"
+
+Security fix, cherry-picked from master (4e14a65):
+* Don't call to_sym when creating conditions for security reasons, see #273 [Bouke van der Bijl, bouk]
+* Prevent arbitrary method invocation on condition objects, see #274 [Dylan Thacker-Smith, dylanahsmith]
+
+## 2.5.4 / 2013-11-11
+
+* Fix "can't convert Fixnum into String" for "replace", see #173, [wǒ_is神仙, jsw0528]
+
+## 2.5.3 / 2013-10-09
+
+* #232, #234, #237: Fix map filter bugs [Florian Weingarten, fw42]
+
+## 2.5.2 / 2013-09-03 / deleted
+
+Yanked from rubygems, as it contained too many changes that broke compatibility. Those changes will be on following major releases.
+
+## 2.5.1 / 2013-07-24
+
+* #230: Fix security issue with map filter, Use invoke_drop in map filter [Florian Weingarten, fw42]
+
+## 2.5.0 / 2013-03-06
+
+* Prevent Object methods from being called on drops
+* Avoid symbol injection from liquid
+* Added break and continue statements
+* Fix filter parser for args without space separators
+* Add support for filter keyword arguments
+
+## 2.4.0 / 2012-08-03
+
+* Performance improvements
+* Allow filters in `assign`
+* Add `modulo` filter
+* Ruby 1.8, 1.9, and Rubinius compatibility fixes
+* Add support for `quoted['references']` in `tablerow`
+* Add support for Enumerable to `tablerow`
+* `strip_html` filter removes html comments
+
+
+## 2.3.0 / 2011-10-16
 
 * Several speed/memory improvements
 * Numerous bug fixes

README.md

@@ -6,15 +6,15 @@ Liquid is a template engine which was written with very specific requirements:
 
 * It has to have beautiful and simple markup. Template engines which don't produce good looking markup are no fun to use.
 * It needs to be non evaling and secure. Liquid templates are made so that users can edit them. You don't want to run code on your server which your users wrote.
-* It has to be stateless. Compile and render steps have to be seperate so that the expensive parsing and compiling can be done once and later on you can just render it passing in a hash with local variables and objects.
+* It has to be stateless. Compile and render steps have to be separate so that the expensive parsing and compiling can be done once and later on you can just render it passing in a hash with local variables and objects.
 
 ## Why you should use Liquid
 
 * You want to allow your users to edit the appearance of your application but don't want them to run **insecure code on your server**.
-* You want to render templates directly from the database
-* You like smarty (PHP) style template engines
-* You need a template engine which does HTML just as well as emails
-* You don't like the markup of your current templating engine
+* You want to render templates directly from the database.
+* You like smarty (PHP) style template engines.
+* You need a template engine which does HTML just as well as emails.
+* You don't like the markup of your current templating engine.
 
 ## What does it look like?
 
@@ -31,7 +31,7 @@ Liquid is a template engine which was written with very specific requirements:
 </ul>
 ```
 
-## Howto use Liquid
+## How to use Liquid
 
 Liquid supports a very simple API based around the Liquid::Template class.
 For standard use you can just pass it the content of a file and call render with a parameters hash.

Rakefile

@@ -9,7 +9,7 @@ task :default => 'test'
 
 Rake::TestTask.new(:test) do |t|
   t.libs << '.' << 'lib' << 'test'
-  t.pattern = 'test/liquid/**/*_test.rb'
+  t.test_files = FileList['test/liquid/**/*_test.rb']
   t.verbose = false
 end
 
@@ -27,7 +27,7 @@ namespace :benchmark do
 
   desc "Run the liquid benchmark"
   task :run do
-    ruby "performance/benchmark.rb"
+    ruby "./performance/benchmark.rb"
   end
 
 end
@@ -37,12 +37,12 @@ namespace :profile do
 
   desc "Run the liquid profile/performance coverage"
   task :run do
-    ruby "performance/profile.rb"
+    ruby "./performance/profile.rb"
   end
 
   desc "Run KCacheGrind"
   task :grind => :run  do
-    system "kcachegrind /tmp/liquid.rubyprof_calltreeprinter.txt"
+    system "qcachegrind /tmp/liquid.rubyprof_calltreeprinter.txt"
   end
 
 end

lib/liquid.rb

@@ -32,22 +32,23 @@ module Liquid
   VariableEnd                 = /\}\}/
   VariableIncompleteEnd       = /\}\}?/
   QuotedString                = /"[^"]*"|'[^']*'/
-  QuotedFragment              = /#{QuotedString}|(?:[^\s,\|'"]|#{QuotedString})+/
+  QuotedFragment              = /#{QuotedString}|(?:[^\s,\|'"]|#{QuotedString})+/o
   StrictQuotedFragment        = /"[^"]+"|'[^']+'|[^\s|:,]+/
-  FirstFilterArgument         = /#{FilterArgumentSeparator}(?:#{StrictQuotedFragment})/
-  OtherFilterArgument         = /#{ArgumentSeparator}(?:#{StrictQuotedFragment})/
-  SpacelessFilter             = /^(?:'[^']+'|"[^"]+"|[^'"])*#{FilterSeparator}(?:#{StrictQuotedFragment})(?:#{FirstFilterArgument}(?:#{OtherFilterArgument})*)?/
-  Expression                  = /(?:#{QuotedFragment}(?:#{SpacelessFilter})*)/
-  TagAttributes               = /(\w+)\s*\:\s*(#{QuotedFragment})/
+  FirstFilterArgument         = /#{FilterArgumentSeparator}(?:#{StrictQuotedFragment})/o
+  OtherFilterArgument         = /#{ArgumentSeparator}(?:#{StrictQuotedFragment})/o
+  SpacelessFilter             = /^(?:'[^']+'|"[^"]+"|[^'"])*#{FilterSeparator}(?:#{StrictQuotedFragment})(?:#{FirstFilterArgument}(?:#{OtherFilterArgument})*)?/o
+  Expression                  = /(?:#{QuotedFragment}(?:#{SpacelessFilter})*)/o
+  TagAttributes               = /(\w+)\s*\:\s*(#{QuotedFragment})/o
   AnyStartingTag              = /\{\{|\{\%/
-  PartialTemplateParser       = /#{TagStart}.*?#{TagEnd}|#{VariableStart}.*?#{VariableIncompleteEnd}/
-  TemplateParser              = /(#{PartialTemplateParser}|#{AnyStartingTag})/
-  VariableParser              = /\[[^\]]+\]|#{VariableSegment}+\??/
+  PartialTemplateParser       = /#{TagStart}.*?#{TagEnd}|#{VariableStart}.*?#{VariableIncompleteEnd}/o
+  TemplateParser              = /(#{PartialTemplateParser}|#{AnyStartingTag})/o
+  VariableParser              = /\[[^\]]+\]|#{VariableSegment}+\??/o
 end
 
 require 'liquid/drop'
 require 'liquid/extensions'
 require 'liquid/errors'
+require 'liquid/interrupts'
 require 'liquid/strainer'
 require 'liquid/context'
 require 'liquid/tag'
@@ -60,6 +61,7 @@ require 'liquid/htmltags'
 require 'liquid/standardfilters'
 require 'liquid/condition'
 require 'liquid/module_ex'
+require 'liquid/utils'
 
 # Load all the tags of the standard library
 #

lib/liquid/block.rb

@@ -1,10 +1,10 @@
 module Liquid
 
   class Block < Tag
-    IsTag             = /^#{TagStart}/
-    IsVariable        = /^#{VariableStart}/
-    FullToken         = /^#{TagStart}\s*(\w+)\s*(.*)?#{TagEnd}$/
-    ContentOfVariable = /^#{VariableStart}(.*)#{VariableEnd}$/
+    IsTag             = /^#{TagStart}/o
+    IsVariable        = /^#{VariableStart}/o
+    FullToken         = /^#{TagStart}\s*(\w+)\s*(.*)?#{TagEnd}$/o
+    ContentOfVariable = /^#{VariableStart}(.*)#{VariableEnd}$/o
 
     def parse(tokens)
       @nodelist ||= []
@@ -89,13 +89,27 @@ module Liquid
     end
 
     def render_all(list, context)
-      list.collect do |token|
+      output = []
+      list.each do |token|
+        # Break out if we have any unhanded interrupts.
+        break if context.has_interrupt?
+
         begin
-          token.respond_to?(:render) ? token.render(context) : token
+          # If we get an Interrupt that means the block must stop processing. An
+          # Interrupt is any command that stops block execution such as {% break %} 
+          # or {% continue %}
+          if token.is_a? Continue or token.is_a? Break
+            context.push_interrupt(token.interrupt)
+            break
+          end
+
+          output << (token.respond_to?(:render) ? token.render(context) : token)
         rescue ::StandardError => e
-          context.handle_error(e)
+          output << (context.handle_error(e))
         end
-      end.join
+      end
+
+      output.join
     end
   end
 end

lib/liquid/context.rb

@@ -22,6 +22,8 @@ module Liquid
       @errors         = []
       @rethrow_errors = rethrow_errors
       squash_instance_assigns_with_environments
+
+      @interrupts = []
     end
 
     def strainer
@@ -37,10 +39,26 @@ module Liquid
 
       filters.each do |f|
         raise ArgumentError, "Expected module but got: #{f.class}" unless f.is_a?(Module)
+        Strainer.add_known_filter(f)
         strainer.extend(f)
       end
     end
 
+    # are there any not handled interrupts?
+    def has_interrupt?
+      !@interrupts.empty?
+    end
+
+    # push an interrupt to the stack. this interrupt is considered not handled.
+    def push_interrupt(e)
+      @interrupts.push(e)
+    end
+
+    # pop an interrupt from the stack
+    def pop_interrupt
+      @interrupts.pop
+    end
+
     def handle_error(e)
       errors.push(e)
       raise if @rethrow_errors
@@ -54,11 +72,7 @@ module Liquid
     end
 
     def invoke(method, *args)
-      if strainer.respond_to?(method)
-        strainer.__send__(method, *args)
-      else
-        args.first
-      end
+      strainer.invoke(method, *args)
     end
 
     # Push new local scope on the stack. use <tt>Context#stack</tt> instead
@@ -136,11 +150,11 @@ module Liquid
             $1
           when /^"(.*)"$/ # Double quoted strings
             $1
-          when /^(\d+)$/ # Integer and floats
+          when /^(-?\d+)$/ # Integer and floats
             $1.to_i
           when /^\((\S+)\.\.(\S+)\)$/ # Ranges
             (resolve($1).to_i..resolve($2).to_i)
-          when /^(\d[\d\.]+)$/ # Floats
+          when /^(-?\d[\d\.]+)$/ # Floats
             $1.to_f
           else
             variable(key)

lib/liquid/drop.rb

@@ -1,10 +1,12 @@
+require 'set'
+
 module Liquid
 
-  # A drop in liquid is a class which allows you to to export DOM like things to liquid.
+  # A drop in liquid is a class which allows you to export DOM like things to liquid.
   # Methods of drops are callable.
-  # The main use for liquid drops is the implement lazy loaded objects.
+  # The main use for liquid drops is to implement lazy loaded objects.
   # If you would like to make data available to the web designers which you don't want loaded unless needed then
-  # a drop is a great way to do that
+  # a drop is a great way to do that.
   #
   # Example:
   #
@@ -18,10 +20,12 @@ module Liquid
   #   tmpl.render('product' => ProductDrop.new ) # will invoke top_sales query.
   #
   # Your drop can either implement the methods sans any parameters or implement the before_method(name) method which is a
-  # catch all
+  # catch all.
   class Drop
     attr_writer :context
 
+    EMPTY_STRING = ''.freeze
+
     # Catch all for the method
     def before_method(method)
       nil
@@ -29,8 +33,8 @@ module Liquid
 
     # called by liquid to invoke a drop
     def invoke_drop(method_or_key)
-      if method_or_key && method_or_key != '' && self.class.public_method_defined?(method_or_key.to_s.to_sym)
-        send(method_or_key.to_s.to_sym)
+      if method_or_key && method_or_key != EMPTY_STRING && self.class.invokable?(method_or_key)
+        send(method_or_key)
       else
         before_method(method_or_key)
       end
@@ -45,5 +49,13 @@ module Liquid
     end
 
     alias :[] :invoke_drop
+
+    private
+
+    # Check for method existence without invoking respond_to?, which creates symbols
+    def self.invokable?(method_name)
+      @invokable_methods ||= Set.new(["to_liquid"] + (public_instance_methods - Liquid::Drop.public_instance_methods).map(&:to_s))
+      @invokable_methods.include?(method_name.to_s)
+    end
   end
 end

lib/liquid/errors.rb

@@ -8,4 +8,4 @@ module Liquid
   class StandardError < Error; end
   class SyntaxError < Error; end
   class StackLevelError < Error; end
-end
+end

lib/liquid/htmltags.rb

@@ -1,6 +1,6 @@
 module Liquid
   class TableRow < Block
-    Syntax = /(\w+)\s+in\s+(#{VariableSignature}+)/
+    Syntax = /(\w+)\s+in\s+(#{QuotedFragment}+)/o
 
     def initialize(tag_name, markup, tokens)
       if markup =~ Syntax
@@ -20,11 +20,10 @@ module Liquid
     def render(context)
       collection = context[@collection_name] or return ''
 
-      if @attributes['limit'] or @attributes['offset']
-        limit = context[@attributes['limit']] || -1
-        offset = context[@attributes['offset']] || 0
-        collection = collection[offset.to_i..(limit.to_i + offset.to_i - 1)]
-      end
+      from = @attributes['offset'] ? context[@attributes['offset']].to_i : 0
+      to = @attributes['limit'] ? from + context[@attributes['limit']].to_i : nil
+
+      collection = Utils.slice_collection_using_each(collection, from, to)
 
       length = collection.length
 
@@ -46,7 +45,7 @@ module Liquid
             'col0'    => col,
             'index0'  => index,
             'rindex'  => length - index,
-            'rindex0' => length - index -1,
+            'rindex0' => length - index - 1,
             'first'   => (index == 0),
             'last'    => (index == length - 1),
             'col_first' => (col == 0),

lib/liquid/interrupts.rb

@@ -0,0 +1,17 @@
+module Liquid
+
+  # An interrupt is any command that breaks processing of a block (ex: a for loop).
+  class Interrupt
+    attr_reader :message
+
+    def initialize(message=nil)
+      @message = message || "interrupt"
+    end
+  end
+
+  # Interrupt that is thrown whenever a {% break %} is called.
+  class BreakInterrupt < Interrupt; end
+
+  # Interrupt that is thrown whenever a {% continue %} is called.
+  class ContinueInterrupt < Interrupt; end
+end

lib/liquid/standardfilters.rb

@@ -54,12 +54,16 @@ module Liquid
     end
 
     # Split input string into an array of substrings separated by given pattern.
+    #
+    # Example:
+    #   <div class="summary">{{ post | split '//' | first }}</div>
+    #
     def split(input, pattern)
       input.split(pattern)
     end
 
     def strip_html(input)
-      input.to_s.gsub(/<script.*?<\/script>/, '').gsub(/<.*?>/, '')
+      input.to_s.gsub(/<script.*?<\/script>/, '').gsub(/<!--.*?-->/, '').gsub(/<.*?>/, '')
     end
 
     # Remove all newlines from the string
@@ -89,21 +93,26 @@ module Liquid
     # map/collect on a given property
     def map(input, property)
       ary = [input].flatten
-      if ary.first.respond_to?('[]') and !ary.first[property].nil?
-        ary.map {|e| e[property] }
-      elsif ary.first.respond_to?(property)
-        ary.map {|e| e.send(property) }
+      ary.map do |e|
+        e = e.call if e.is_a?(Proc)
+        e = e.to_liquid if e.respond_to?(:to_liquid)
+
+        if property == "to_liquid"
+          e
+        elsif e.respond_to?(:[])
+          e[property]
+        end
       end
     end
 
     # Replace occurrences of a string with another
     def replace(input, string, replacement = '')
-      input.to_s.gsub(string, replacement)
+      input.to_s.gsub(string, replacement.to_s)
     end
 
     # Replace the first occurrences of a string with another
     def replace_first(input, string, replacement = '')
-      input.to_s.sub(string, replacement)
+      input.to_s.sub(string, replacement.to_s)
     end
 
     # remove a substring
@@ -218,6 +227,10 @@ module Liquid
       to_number(input) / to_number(operand)
     end
 
+    def modulo(input, operand)
+      to_number(input) % to_number(operand)
+    end
+
     private
 
       def to_number(obj)

lib/liquid/strainer.rb

@@ -2,24 +2,15 @@ require 'set'
 
 module Liquid
 
-  parent_object = if defined? BlankObject
-    BlankObject
-  else
-    Object
-  end
-
   # Strainer is the parent class for the filters system.
-  # New filters are mixed into the strainer class which is then instanciated for each liquid template render run.
+  # New filters are mixed into the strainer class which is then instantiated for each liquid template render run.
   #
-  # One of the strainer's responsibilities is to keep malicious method calls out
-  class Strainer < parent_object #:nodoc:
-    INTERNAL_METHOD = /^__/
-    @@required_methods = Set.new([:__id__, :__send__, :respond_to?, :kind_of?, :extend, :methods, :singleton_methods, :class, :object_id])
-
-    # Ruby 1.9.2 introduces Object#respond_to_missing?, which is invoked by Object#respond_to?
-    @@required_methods << :respond_to_missing? if Object.respond_to? :respond_to_missing?
-
+  # The Strainer only allows method calls defined in filters given to it via Strainer.global_filter,
+  # Context#add_filters or Template.register_filter
+  class Strainer #:nodoc:
     @@filters = {}
+    @@known_filters = Set.new
+    @@known_methods = Set.new
 
     def initialize(context)
       @context = context
@@ -27,28 +18,36 @@ module Liquid
 
     def self.global_filter(filter)
       raise ArgumentError, "Passed filter is not a module" unless filter.is_a?(Module)
+      add_known_filter(filter)
       @@filters[filter.name] = filter
     end
 
+    def self.add_known_filter(filter)
+      unless @@known_filters.include?(filter)
+        @@method_blacklist ||= Set.new(Strainer.instance_methods.map(&:to_s))
+        new_methods = filter.instance_methods.map(&:to_s)
+        new_methods.reject!{ |m| @@method_blacklist.include?(m) }
+        @@known_methods.merge(new_methods)
+        @@known_filters.add(filter)
+      end
+    end
+
     def self.create(context)
       strainer = Strainer.new(context)
       @@filters.each { |k,m| strainer.extend(m) }
       strainer
     end
 
-    def respond_to?(method, include_private = false)
-      method_name = method.to_s
-      return false if method_name =~ INTERNAL_METHOD
-      return false if @@required_methods.include?(method_name)
-      super
+    def invoke(method, *args)
+      if invokable?(method)
+        send(method, *args)
+      else
+        args.first
+      end
     end
 
-    # remove all standard methods from the bucket so circumvent security
-    # problems
-    instance_methods.each do |m|
-      unless @@required_methods.include?(m.to_sym)
-        undef_method m
-      end
+    def invokable?(method)
+      @@known_methods.include?(method.to_s) && respond_to?(method)
     end
   end
 end

lib/liquid/tags/assign.rb

@@ -9,12 +9,12 @@ module Liquid
   #  {{ foo }}
   #
   class Assign < Tag
-    Syntax = /(#{VariableSignature}+)\s*=\s*(#{QuotedFragment}+)/   
+    Syntax = /(#{VariableSignature}+)\s*=\s*(.*)\s*/o
   
     def initialize(tag_name, markup, tokens)          
       if markup =~ Syntax
         @to = $1
-        @from = $2
+        @from = Variable.new($2)
       else
         raise SyntaxError.new("Syntax Error in 'assign' - Valid syntax: assign [var] = [source]")
       end
@@ -23,7 +23,7 @@ module Liquid
     end
   
     def render(context)
-       context.scopes.last[@to] = context[@from]
+       context.scopes.last[@to] = @from.render(context)
        ''
     end 
   

lib/liquid/tags/break.rb

@@ -0,0 +1,21 @@
+module Liquid
+
+  # Break tag to be used to break out of a for loop.
+  #
+  # == Basic Usage:
+  #    {% for item in collection %}
+  #      {% if item.condition %}
+  #        {% break %}
+  #      {% endif %}
+  #    {% endfor %}
+  # 
+  class Break < Tag 
+
+    def interrupt
+      BreakInterrupt.new
+    end
+
+  end
+
+  Template.register_tag('break', Break)
+end

lib/liquid/tags/case.rb

@@ -1,7 +1,7 @@
 module Liquid
   class Case < Block
-    Syntax     = /(#{QuotedFragment})/
-    WhenSyntax = /(#{QuotedFragment})(?:(?:\s+or\s+|\s*\,\s*)(#{QuotedFragment}.*))?/
+    Syntax     = /(#{QuotedFragment})/o
+    WhenSyntax = /(#{QuotedFragment})(?:(?:\s+or\s+|\s*\,\s*)(#{QuotedFragment}.*))?/o
 
     def initialize(tag_name, markup, tokens)      
       @blocks = []

lib/liquid/tags/continue.rb

@@ -0,0 +1,21 @@
+module Liquid
+
+  # Continue tag to be used to break out of a for loop.
+  #
+  # == Basic Usage:
+  #    {% for item in collection %}
+  #      {% if item.condition %}
+  #        {% continue %}
+  #      {% endif %}
+  #    {% endfor %}
+  # 
+  class Continue < Tag
+
+    def interrupt
+      ContinueInterrupt.new
+    end
+
+  end
+
+  Template.register_tag('continue', Continue)
+end

lib/liquid/tags/cycle.rb

@@ -13,8 +13,8 @@ module Liquid
   #    <div class="green"> Item five</div>
   #
   class Cycle < Tag
-    SimpleSyntax = /^#{QuotedFragment}+/        
-    NamedSyntax  = /^(#{QuotedFragment})\s*\:\s*(.*)/
+    SimpleSyntax = /^#{QuotedFragment}+/o
+    NamedSyntax  = /^(#{QuotedFragment})\s*\:\s*(.*)/o
   
     def initialize(tag_name, markup, tokens)      
       case markup
@@ -48,7 +48,7 @@ module Liquid
   
     def variables_from_string(markup)
       markup.split(',').collect do |var|
-    	  var =~ /\s*(#{QuotedFragment})\s*/
+    	  var =~ /\s*(#{QuotedFragment})\s*/o
     	  $1 ? $1 : nil
     	end.compact
     end
@@ -56,4 +56,4 @@ module Liquid
   end
   
   Template.register_tag('cycle', Cycle)
-end
+end

lib/liquid/tags/for.rb

@@ -44,7 +44,7 @@ module Liquid
   # forloop.last:: Returns true if the item is the last item.
   #
   class For < Block                                             
-    Syntax = /(\w+)\s+in\s+(#{QuotedFragment}+)\s*(reversed)?/   
+    Syntax = /(\w+)\s+in\s+(#{QuotedFragment}+)\s*(reversed)?/o
   
     def initialize(tag_name, markup, tokens)
       if markup =~ Syntax
@@ -69,13 +69,14 @@ module Liquid
       @nodelist = @else_block = []
     end
   
-    def render(context)        
+    def render(context)       
       context.registers[:for] ||= Hash.new(0)
     
       collection = context[@collection_name]
       collection = collection.to_a if collection.is_a?(Range)
     
-      return render_else(context) unless collection.respond_to?(:each) 
+      # Maintains Ruby 1.8.7 String#each behaviour on 1.9
+      return render_else(context) unless iterable?(collection)
                                                  
       from = if @attributes['offset'] == 'continue'
         context.registers[:for][@name].to_i
@@ -85,10 +86,10 @@ module Liquid
         
       limit = context[@attributes['limit']]
       to    = limit ? limit.to_i + from : nil  
-          
-                       
-      segment = slice_collection_using_each(collection, from, to)      
-      
+
+
+      segment = Utils.slice_collection_using_each(collection, from, to)
+
       return render_else(context) if segment.empty?
       
       segment.reverse! if @reversed
@@ -100,8 +101,8 @@ module Liquid
       # Store our progress through the collection for the continue flag
       context.registers[:for][@name] = from + segment.length
               
-      context.stack do 
-        segment.each_with_index do |item, index|     
+      context.stack do
+        segment.each_with_index do |item, index|
           context[@variable_name] = item
           context['forloop'] = {
             'name'    => @name,
@@ -109,35 +110,22 @@ module Liquid
             'index'   => index + 1, 
             'index0'  => index, 
             'rindex'  => length - index,
-            'rindex0' => length - index -1,
+            'rindex0' => length - index - 1,
             'first'   => (index == 0),
             'last'    => (index == length - 1) }
 
           result << render_all(@for_block, context)
+
+          # Handle any interrupts if they exist.
+          if context.has_interrupt?
+            interrupt = context.pop_interrupt
+            break if interrupt.is_a? BreakInterrupt
+            next if interrupt.is_a? ContinueInterrupt
+          end
         end
       end
       result     
     end          
-        
-    def slice_collection_using_each(collection, from, to)       
-      segments = []      
-      index = 0      
-      yielded = 0
-      collection.each do |item|         
-                
-        if to && to <= index
-          break
-        end
-        
-        if from <= index                               
-          segments << item
-        end                    
-                
-        index += 1
-      end    
-
-      segments
-    end
 
     private
 
@@ -145,6 +133,9 @@ module Liquid
         return @else_block ? [render_all(@else_block, context)] : ''
       end
 
+      def iterable?(collection)
+        collection.respond_to?(:each) || Utils.non_blank_string?(collection)
+      end
   end
 
   Template.register_tag('for', For)

lib/liquid/tags/if.rb

@@ -13,8 +13,9 @@ module Liquid
   #
   class If < Block
     SyntaxHelp = "Syntax Error in tag 'if' - Valid syntax: if [expression]"
-    Syntax = /(#{QuotedFragment})\s*([=!<>a-z_]+)?\s*(#{QuotedFragment})?/
-    ExpressionsAndOperators = /(?:\b(?:\s?and\s?|\s?or\s?)\b|(?:\s*(?!\b(?:\s?and\s?|\s?or\s?)\b)(?:#{QuotedFragment}|\S+)\s*)+)/
+    Syntax = /(#{QuotedFragment})\s*([=!<>a-z_]+)?\s*(#{QuotedFragment})?/o
+    ExpressionsAndOperators = /(?:\b(?:\s?and\s?|\s?or\s?)\b|(?:\s*(?!\b(?:\s?and\s?|\s?or\s?)\b)(?:#{QuotedFragment}|\S+)\s*)+)/o
+    BOOLEAN_OPERATORS = %w(and or)
 
     def initialize(tag_name, markup, tokens)
       @blocks = []
@@ -61,7 +62,8 @@ module Liquid
             raise(SyntaxError, SyntaxHelp) unless expressions.shift.to_s =~ Syntax
 
             new_condition = Condition.new($1, $2, $3)
-            new_condition.send(operator.to_sym, condition)
+            raise SyntaxError, "invalid boolean operator" unless BOOLEAN_OPERATORS.include?(operator)
+            new_condition.send(operator, condition)
             condition = new_condition
           end
 
@@ -71,8 +73,6 @@ module Liquid
         @blocks.push(block)
         @nodelist = block.attach(Array.new)
       end
-
-
   end
 
   Template.register_tag('if', If)

lib/liquid/tags/include.rb

@@ -1,6 +1,6 @@
 module Liquid
   class Include < Tag
-    Syntax = /(#{QuotedFragment}+)(\s+(?:with|for)\s+(#{QuotedFragment}+))?/
+    Syntax = /(#{QuotedFragment}+)(\s+(?:with|for)\s+(#{QuotedFragment}+))?/o
   
     def initialize(tag_name, markup, tokens)      
       if markup =~ Syntax
@@ -62,4 +62,4 @@ module Liquid
   end
 
   Template.register_tag('include', Include)  
-end
+end

lib/liquid/utils.rb

@@ -0,0 +1,31 @@
+module Liquid
+  module Utils
+    def self.slice_collection_using_each(collection, from, to)
+      segments = []
+      index = 0
+      yielded = 0
+
+      # Maintains Ruby 1.8.7 String#each behaviour on 1.9
+      return [collection] if non_blank_string?(collection)
+
+      collection.each do |item|
+
+        if to && to <= index
+          break
+        end
+
+        if from <= index
+          segments << item
+        end
+
+        index += 1
+      end
+
+      segments
+    end
+
+    def self.non_blank_string?(collection)
+      collection.is_a?(String) && collection != ''
+    end
+  end
+end

lib/liquid/variable.rb

@@ -11,22 +11,22 @@ module Liquid
   #   {{ user | link }}
   #
   class Variable
-    FilterParser = /(?:#{FilterSeparator}|(?:\s*(?!(?:#{FilterSeparator}))(?:#{QuotedFragment}|\S+)\s*)+)/
+    FilterParser = /(?:#{FilterSeparator}|(?:\s*(?:#{QuotedFragment}|#{ArgumentSeparator})\s*)+)/o
     attr_accessor :filters, :name
 
     def initialize(markup)
       @markup  = markup
       @name    = nil
       @filters = []
-      if match = markup.match(/\s*(#{QuotedFragment})(.*)/)
+      if match = markup.match(/\s*(#{QuotedFragment})(.*)/o)
         @name = match[1]
-        if match[2].match(/#{FilterSeparator}\s*(.*)/)
+        if match[2].match(/#{FilterSeparator}\s*(.*)/o)
           filters = Regexp.last_match(1).scan(FilterParser)
           filters.each do |f|
-            if matches = f.match(/\s*(\w+)/)
+            if matches = f.match(/\s*(\w+)(?:\s*#{FilterArgumentSeparator}(.*))?/)
               filtername = matches[1]
-              filterargs = f.scan(/(?:#{FilterArgumentSeparator}|#{ArgumentSeparator})\s*(#{QuotedFragment})/).flatten
-              @filters << [filtername.to_sym, filterargs]
+              filterargs = matches[2].to_s.scan(/(?:\A|#{ArgumentSeparator})\s*((?:\w+\s*\:\s*)?#{QuotedFragment})/o).flatten
+              @filters << [filtername, filterargs]
             end
           end
         end
@@ -36,9 +36,16 @@ module Liquid
     def render(context)
       return '' if @name.nil?
       @filters.inject(context[@name]) do |output, filter|
-        filterargs = filter[1].to_a.collect do |a|
-          context[a]
+        filterargs = []
+        keyword_args = {}
+        filter[1].to_a.each do |a|
+          if matches = a.match(/\A#{TagAttributes}\z/o)
+            keyword_args[matches[1]] = context[matches[2]]
+          else
+            filterargs << context[a]
+          end
         end
+        filterargs << keyword_args unless keyword_args.empty?
         begin
           output = context.invoke(filter[0], output, *filterargs)
         rescue FilterNotFound

liquid.gemspec

@@ -2,7 +2,7 @@
 
 Gem::Specification.new do |s|
   s.name        = "liquid"
-  s.version     = "2.3.0"
+  s.version     = "2.5.5"
   s.platform    = Gem::Platform::RUBY
   s.summary     = "A secure, non-evaling end user template engine with aesthetic markup."
   s.authors     = ["Tobias Luetke"]

performance/benchmark.rb

@@ -5,6 +5,7 @@ require File.dirname(__FILE__) + '/theme_runner'
 profiler = ThemeRunner.new
 
 Benchmark.bmbm do |x|
-  x.report("parse & run:")   { 10.times { profiler.run(false) } }
+  x.report("parse:")   { 100.times { profiler.compile } }
+  x.report("parse & run:")   { 100.times { profiler.run } }
 end
 

performance/profile.rb

@@ -6,14 +6,14 @@ profiler = ThemeRunner.new
 
 puts 'Running profiler...'
 
-results  = profiler.run(true)
+results  = profiler.run
 
 puts 'Success'
 puts
 
 [RubyProf::FlatPrinter, RubyProf::GraphPrinter, RubyProf::GraphHtmlPrinter, RubyProf::CallTreePrinter].each do |klass|
-  filename = (ENV['TMP'] || '/tmp') + (klass.name.include?('Html') ? "/liquid.#{klass.name.downcase}.html" : "/liquid.#{klass.name.downcase}.txt")
+  filename = (ENV['TMP'] || '/tmp') + (klass.name.include?('Html') ? "/liquid.#{klass.name.downcase}.html" : "/callgrind.liquid.#{klass.name.downcase}.txt")
   filename.gsub!(/:+/, '_')
-  File.open(filename, "w+") { |fp| klass.new(results).print(fp) }
+  File.open(filename, "w+") { |fp| klass.new(results).print(fp, :print_file => true) }
   $stderr.puts "wrote #{klass.name} output to #{filename}"
 end

performance/theme_runner.rb

@@ -27,9 +27,34 @@ class ThemeRunner
     end.compact
   end  
 
+  def compile
+    # Dup assigns because will make some changes to them
 
-  def run(profile = false)
-    RubyProf.measure_mode = RubyProf::WALL_TIME if profile
+    @tests.each do |liquid, layout, template_name|
+
+      tmpl = Liquid::Template.new
+      tmpl.parse(liquid)
+      tmpl = Liquid::Template.new
+      tmpl.parse(layout)
+    end
+  end
+
+   def run
+    # Dup assigns because will make some changes to them
+    assigns = Database.tables.dup
+
+    @tests.each do |liquid, layout, template_name|
+
+      # Compute page_tempalte outside of profiler run, uninteresting to profiler
+      page_template = File.basename(template_name, File.extname(template_name))
+      compile_and_render(liquid, layout, assigns, page_template) 
+       
+    end
+  end
+
+
+  def run_profile
+    RubyProf.measure_mode = RubyProf::WALL_TIME
 
     # Dup assigns because will make some changes to them
     assigns = Database.tables.dup
@@ -40,26 +65,27 @@ class ThemeRunner
       html = nil
       page_template = File.basename(template_name, File.extname(template_name))
 
-      # Profile compiling and rendering both
-      
-      if profile
-
-        RubyProf.resume do 
-          html = compile_and_render(liquid, layout, assigns, page_template) 
-        end 
-
-      else
-        html = compile_and_render(liquid, layout, assigns, page_template) 
+      unless @started
+        RubyProf.start
+        RubyProf.pause
+        @started = true
       end
 
+      html = nil
+
+      RubyProf.resume
+      html = compile_and_render(liquid, layout, assigns, page_template) 
+      RubyProf.pause
+      
+
       # return the result and the MD5 of the content, this can be used to detect regressions between liquid version
-      $stdout.puts "* rendered template %s, content: %s" % [template_name, Digest::MD5.hexdigest(html)] if profile
+      $stdout.puts "* rendered template %s, content: %s" % [template_name, Digest::MD5.hexdigest(html)]
  
       # Uncomment to dump html files to /tmp so that you can inspect for errors
       # File.open("/tmp/#{File.basename(template_name)}.html", "w+") { |fp| fp <<html}
     end
 
-    RubyProf.stop if profile
+    RubyProf.stop
   end
 
   def compile_and_render(template, layout, assigns, page_template)    

test/liquid/assign_test.rb

@@ -12,4 +12,10 @@ class AssignTest < Test::Unit::TestCase
                            '{% assign foo = values %}.{{ foo[1] }}.',
                            'values' => %w{foo bar baz})
   end
+  
+  def test_assign_with_filter
+    assert_template_result('.bar.',
+                           '{% assign foo = values | split: "," %}.{{ foo[1] }}.',
+                           'values' => "foo,bar,baz")
+  end
 end # AssignTest

test/liquid/block_test.rb

@@ -1,6 +1,6 @@
 require 'test_helper'
 
-class VariableTest < Test::Unit::TestCase
+class BlockTest < Test::Unit::TestCase
   include Liquid
 
   def test_blankspace

test/liquid/condition_test.rb

@@ -18,6 +18,11 @@ class ConditionTest < Test::Unit::TestCase
     assert_evalutes_true '2', '>=', '1'
     assert_evalutes_true '1', '<=', '2'
     assert_evalutes_true '1', '<=', '1'
+    # negative numbers
+    assert_evalutes_true '1', '>', '-1'
+    assert_evalutes_true '-1', '<', '1'
+    assert_evalutes_true '1.0', '>', '-1.0'
+    assert_evalutes_true '-1.0', '<', '1.0'
   end
 
   def test_default_operators_evalute_false

test/liquid/context_test.rb

@@ -189,10 +189,10 @@ class ContextTest < Test::Unit::TestCase
     end
 
     context = Context.new
-    methods_before = context.strainer.methods.map { |method| method.to_s }
+    assert_equal "Wookie", context.invoke("hi", "Wookie")
+
     context.add_filters(filter)
-    methods_after = context.strainer.methods.map { |method| method.to_s }
-    assert_equal (methods_before + ["hi"]).sort, methods_after.sort
+    assert_equal "Wookie hi!", context.invoke("hi", "Wookie")
   end
 
   def test_add_item_in_outer_scope

test/liquid/drop_test.rb

@@ -71,23 +71,34 @@ class DropsTest < Test::Unit::TestCase
   include Liquid
 
   def test_product_drop
-
     assert_nothing_raised do
       tpl = Liquid::Template.parse( '  '  )
       tpl.render('product' => ProductDrop.new)
     end
   end
 
+  def test_drop_does_only_respond_to_whitelisted_methods
+    assert_equal "", Liquid::Template.parse("{{ product.inspect }}").render('product' => ProductDrop.new)
+    assert_equal "", Liquid::Template.parse("{{ product.pretty_inspect }}").render('product' => ProductDrop.new)
+    assert_equal "", Liquid::Template.parse("{{ product.whatever }}").render('product' => ProductDrop.new)
+    assert_equal "", Liquid::Template.parse('{{ product | map: "inspect" }}').render('product' => ProductDrop.new)
+    assert_equal "", Liquid::Template.parse('{{ product | map: "pretty_inspect" }}').render('product' => ProductDrop.new)
+    assert_equal "", Liquid::Template.parse('{{ product | map: "whatever" }}').render('product' => ProductDrop.new)
+  end
+
+  def test_drops_respond_to_to_liquid
+    assert_equal "text1", Liquid::Template.parse("{{ product.to_liquid.texts.text }}").render('product' => ProductDrop.new)
+    assert_equal "text1", Liquid::Template.parse('{{ product | map: "to_liquid" | map: "texts" | map: "text" }}').render('product' => ProductDrop.new)
+  end
+
   def test_text_drop
     output = Liquid::Template.parse( ' {{ product.texts.text }} '  ).render('product' => ProductDrop.new)
     assert_equal ' text1 ', output
-
   end
 
   def test_unknown_method
     output = Liquid::Template.parse( ' {{ product.catchall.unknown }} '  ).render('product' => ProductDrop.new)
     assert_equal ' method: unknown ', output
-
   end
 
   def test_integer_argument_drop
@@ -115,6 +126,13 @@ class DropsTest < Test::Unit::TestCase
     assert_equal '  ', output
   end
 
+  def test_object_methods_not_allowed
+    [:dup, :clone, :singleton_class, :eval, :class_eval, :inspect].each do |method|
+      output = Liquid::Template.parse(" {{ product.#{method} }} ").render('product' => ProductDrop.new)
+      assert_equal '  ', output
+    end
+  end
+
   def test_scope
     assert_equal '1', Liquid::Template.parse( '{{ context.scopes }}'  ).render('context' => ContextDrop.new)
     assert_equal '2', Liquid::Template.parse( '{%for i in dummy%}{{ context.scopes }}{%endfor%}'  ).render('context' => ContextDrop.new, 'dummy' => [1])

test/liquid/filter_test.rb

@@ -16,6 +16,12 @@ module CanadianMoneyFilter
   end
 end
 
+module SubstituteFilter
+  def substitute(input, params={})
+    input.gsub(/%\{(\w+)\}/) { |match| params[$1] }
+  end
+end
+
 class FiltersTest < Test::Unit::TestCase
   include Liquid
 
@@ -75,6 +81,12 @@ class FiltersTest < Test::Unit::TestCase
     assert_equal "bla blub", Variable.new("var | strip_html").render(@context)
   end
 
+  def test_strip_html_ignore_comments_with_html
+    @context['var'] = "<!-- split and some <ul> tag --><b>bla blub</a>"
+
+    assert_equal "bla blub", Variable.new("var | strip_html").render(@context)
+  end
+
   def test_capitalize
     @context['var'] = "blub"
 
@@ -86,6 +98,13 @@ class FiltersTest < Test::Unit::TestCase
 
     assert_equal 1000, Variable.new("var | xyzzy").render(@context)
   end
+
+  def test_filter_with_keyword_arguments
+    @context['surname'] = 'john'
+    @context.add_filters(SubstituteFilter)
+    output = Variable.new(%! 'hello %{first_name}, %{last_name}' | substitute: first_name: surname, last_name: 'doe' !).render(@context)
+    assert_equal 'hello john, doe', output
+  end
 end
 
 class FiltersInTemplate < Test::Unit::TestCase

test/liquid/security_test.rb

@@ -38,4 +38,27 @@ class SecurityTest < Test::Unit::TestCase
 
     assert_equal expected, Template.parse(text).render(@assigns, :filters => SecurityFilter)
   end
+
+  def test_does_not_add_filters_to_symbol_table
+    current_symbols = Symbol.all_symbols
+
+    test = %( {{ "some_string" | a_bad_filter }} )
+
+    template = Template.parse(test)
+    assert_equal [], (Symbol.all_symbols - current_symbols)
+
+    template.render
+    assert_equal [], (Symbol.all_symbols - current_symbols)
+  end
+
+  def test_does_not_add_drop_methods_to_symbol_table
+    current_symbols = Symbol.all_symbols
+
+    drop = Drop.new
+    drop.invoke_drop("custom_method_1")
+    drop.invoke_drop("custom_method_2")
+    drop.invoke_drop("custom_method_3")
+
+    assert_equal [], (Symbol.all_symbols - current_symbols)
+  end
 end # SecurityTest

test/liquid/standard_filter_test.rb

@@ -4,6 +4,27 @@ class Filters
   include Liquid::StandardFilters
 end
 
+class TestThing
+  def initialize
+    @foo = 0
+  end
+
+  def to_s
+    "woot: #{@foo}"
+  end
+
+  def to_liquid
+    @foo += 1
+    self
+  end
+end
+
+class TestDrop < Liquid::Drop
+  def test
+    "testfoo"
+  end
+end
+
 class StandardFiltersTest < Test::Unit::TestCase
   include Liquid
 
@@ -86,6 +107,23 @@ class StandardFiltersTest < Test::Unit::TestCase
       'ary' => [{'foo' => {'bar' => 'a'}}, {'foo' => {'bar' => 'b'}}, {'foo' => {'bar' => 'c'}}]
   end
 
+  def test_map_doesnt_call_arbitrary_stuff
+    assert_equal "", Liquid::Template.parse('{{ "foo" | map: "__id__" }}').render
+    assert_equal "", Liquid::Template.parse('{{ "foo" | map: "inspect" }}').render
+  end
+
+  def test_map_calls_to_liquid
+    t = TestThing.new
+    assert_equal "woot: 1", Liquid::Template.parse('{{ foo }}').render("foo" => t)
+  end
+
+  def test_map_over_proc
+    drop = TestDrop.new
+    p = Proc.new{ drop }
+    templ = '{{ procs | map: "test" }}'
+    assert_equal "testfoo", Liquid::Template.parse(templ).render("procs" => [p])
+  end
+
   def test_date
     assert_equal 'May', @filters.date(Time.parse("2006-05-05 10:00:00"), "%B")
     assert_equal 'June', @filters.date(Time.parse("2006-06-05 10:00:00"), "%B")
@@ -119,9 +157,9 @@ class StandardFiltersTest < Test::Unit::TestCase
   end
 
   def test_replace
-    assert_equal 'b b b b', @filters.replace("a a a a", 'a', 'b')
-    assert_equal 'b a a a', @filters.replace_first("a a a a", 'a', 'b')
-    assert_template_result 'b a a a', "{{ 'a a a a' | replace_first: 'a', 'b' }}"
+    assert_equal '2 2 2 2', @filters.replace('1 1 1 1', '1', 2)
+    assert_equal '2 1 1 1', @filters.replace_first('1 1 1 1', '1', 2)
+    assert_template_result '2 1 1 1', "{{ '1 1 1 1' | replace_first: '1', 2 }}"
   end
 
   def test_remove
@@ -173,6 +211,10 @@ class StandardFiltersTest < Test::Unit::TestCase
     assert_template_result "Liquid error: divided by 0", "{{ 5 | divided_by:0 }}"
   end
 
+  def test_modulo
+    assert_template_result "1", "{{ 3 | modulo:2 }}"
+  end
+
   def test_append
     assigns = {'a' => 'bc', 'b' => 'd' }
     assert_template_result('bcd',"{{ a | append: 'd'}}",assigns)

test/liquid/strainer_test.rb

@@ -3,23 +3,50 @@ require 'test_helper'
 class StrainerTest < Test::Unit::TestCase
   include Liquid
 
+  module AccessScopeFilters
+    def public_filter
+      "public"
+    end
+
+    def private_filter
+      "private"
+    end
+    private :private_filter
+  end
+
+  Strainer.global_filter(AccessScopeFilters)
+
   def test_strainer
     strainer = Strainer.create(nil)
-    assert_equal false, strainer.respond_to?('__test__')
-    assert_equal false, strainer.respond_to?('test')
-    assert_equal false, strainer.respond_to?('instance_eval')
-    assert_equal false, strainer.respond_to?('__send__')
-    assert_equal true, strainer.respond_to?('size') # from the standard lib
+    assert_equal 5, strainer.invoke('size', 'input')
+    assert_equal "public", strainer.invoke("public_filter")
   end
 
-  def test_should_respond_to_two_parameters
+  def test_strainer_only_invokes_public_filter_methods
     strainer = Strainer.create(nil)
-    assert_equal true, strainer.respond_to?('size', false)
+    assert_equal false, strainer.invokable?('__test__')
+    assert_equal false, strainer.invokable?('test')
+    assert_equal false, strainer.invokable?('instance_eval')
+    assert_equal false, strainer.invokable?('__send__')
+    assert_equal true, strainer.invokable?('size') # from the standard lib
   end
 
-  # Asserts that Object#respond_to_missing? is not being undefined in Ruby versions where it has been implemented
-  # Currently this method is only present in Ruby v1.9.2, or higher
-  def test_object_respond_to_missing
-    assert_equal Object.respond_to?(:respond_to_missing?), Strainer.create(nil).respond_to?(:respond_to_missing?)
+  def test_strainer_returns_nil_if_no_filter_method_found
+    strainer = Strainer.create(nil)
+    assert_nil strainer.invoke("private_filter")
+    assert_nil strainer.invoke("undef_the_filter")
   end
+
+  def test_strainer_returns_first_argument_if_no_method_and_arguments_given
+    strainer = Strainer.create(nil)
+    assert_equal "password", strainer.invoke("undef_the_method", "password")
+  end
+
+  def test_strainer_only_allows_methods_defined_in_filters
+    strainer = Strainer.create(nil)
+    assert_equal "1 + 1", strainer.invoke("instance_eval", "1 + 1")
+    assert_equal "puts",  strainer.invoke("__send__", "puts", "Hi Mom")
+    assert_equal "has_method?", strainer.invoke("invoke", "has_method?", "invoke")
+  end
+
 end # StrainerTest

test/liquid/tags/break_tag_test.rb

@@ -0,0 +1,16 @@
+require 'test_helper'
+
+class BreakTagTest < Test::Unit::TestCase
+  include Liquid
+
+  # tests that no weird errors are raised if break is called outside of a
+  # block
+  def test_break_with_no_block
+    assigns = {'i' => 1}
+    markup = '{% break %}'
+    expected = ''
+
+    assert_template_result(expected, markup, assigns)
+  end
+
+end

test/liquid/tags/continue_tag_test.rb

@@ -0,0 +1,16 @@
+require 'test_helper'
+
+class ContinueTagTest < Test::Unit::TestCase
+  include Liquid
+
+  # tests that no weird errors are raised if continue is called outside of a
+  # block
+  def test_continue_with_no_block
+    assigns = {}
+    markup = '{% continue %}'
+    expected = ''
+
+    assert_template_result(expected, markup, assigns)
+  end
+
+end

test/liquid/tags/for_tag_test.rb

@@ -0,0 +1,284 @@
+require 'test_helper'
+
+class ForTagTest < Test::Unit::TestCase
+  include Liquid
+
+  def test_for
+    assert_template_result(' yo  yo  yo  yo ','{%for item in array%} yo {%endfor%}','array' => [1,2,3,4])
+    assert_template_result('yoyo','{%for item in array%}yo{%endfor%}','array' => [1,2])
+    assert_template_result(' yo ','{%for item in array%} yo {%endfor%}','array' => [1])
+    assert_template_result('','{%for item in array%}{%endfor%}','array' => [1,2])
+    expected = <<HERE
+
+  yo
+
+  yo
+
+  yo
+
+HERE
+    template = <<HERE
+{%for item in array%}
+  yo
+{%endfor%}
+HERE
+    assert_template_result(expected,template,'array' => [1,2,3])
+  end
+
+  def test_for_reversed
+    assigns = {'array' => [ 1, 2, 3] }
+    assert_template_result('321','{%for item in array reversed %}{{item}}{%endfor%}',assigns)
+  end
+
+  def test_for_with_range
+    assert_template_result(' 1  2  3 ','{%for item in (1..3) %} {{item}} {%endfor%}')
+  end
+
+  def test_for_with_variable
+    assert_template_result(' 1  2  3 ','{%for item in array%} {{item}} {%endfor%}','array' => [1,2,3])
+    assert_template_result('123','{%for item in array%}{{item}}{%endfor%}','array' => [1,2,3])
+    assert_template_result('123','{% for item in array %}{{item}}{% endfor %}','array' => [1,2,3])
+    assert_template_result('abcd','{%for item in array%}{{item}}{%endfor%}','array' => ['a','b','c','d'])
+    assert_template_result('a b c','{%for item in array%}{{item}}{%endfor%}','array' => ['a',' ','b',' ','c'])
+    assert_template_result('abc','{%for item in array%}{{item}}{%endfor%}','array' => ['a','','b','','c'])
+  end
+
+  def test_for_helpers
+    assigns = {'array' => [1,2,3] }
+    assert_template_result(' 1/3  2/3  3/3 ',
+                           '{%for item in array%} {{forloop.index}}/{{forloop.length}} {%endfor%}',
+                           assigns)
+    assert_template_result(' 1  2  3 ', '{%for item in array%} {{forloop.index}} {%endfor%}', assigns)
+    assert_template_result(' 0  1  2 ', '{%for item in array%} {{forloop.index0}} {%endfor%}', assigns)
+    assert_template_result(' 2  1  0 ', '{%for item in array%} {{forloop.rindex0}} {%endfor%}', assigns)
+    assert_template_result(' 3  2  1 ', '{%for item in array%} {{forloop.rindex}} {%endfor%}', assigns)
+    assert_template_result(' true  false  false ', '{%for item in array%} {{forloop.first}} {%endfor%}', assigns)
+    assert_template_result(' false  false  true ', '{%for item in array%} {{forloop.last}} {%endfor%}', assigns)
+  end
+
+  def test_for_and_if
+    assigns = {'array' => [1,2,3] }
+    assert_template_result('+--',
+                           '{%for item in array%}{% if forloop.first %}+{% else %}-{% endif %}{%endfor%}',
+                           assigns)
+  end
+
+  def test_for_else
+    assert_template_result('+++', '{%for item in array%}+{%else%}-{%endfor%}', 'array'=>[1,2,3])
+    assert_template_result('-',   '{%for item in array%}+{%else%}-{%endfor%}', 'array'=>[])
+    assert_template_result('-',   '{%for item in array%}+{%else%}-{%endfor%}', 'array'=>nil)
+  end
+
+  def test_limiting
+    assigns = {'array' => [1,2,3,4,5,6,7,8,9,0]}
+    assert_template_result('12', '{%for i in array limit:2 %}{{ i }}{%endfor%}', assigns)
+    assert_template_result('1234', '{%for i in array limit:4 %}{{ i }}{%endfor%}', assigns)
+    assert_template_result('3456', '{%for i in array limit:4 offset:2 %}{{ i }}{%endfor%}', assigns)
+    assert_template_result('3456', '{%for i in array limit: 4 offset: 2 %}{{ i }}{%endfor%}', assigns)
+  end
+
+  def test_dynamic_variable_limiting
+    assigns = {'array' => [1,2,3,4,5,6,7,8,9,0]}
+    assigns['limit'] = 2
+    assigns['offset'] = 2
+
+    assert_template_result('34', '{%for i in array limit: limit offset: offset %}{{ i }}{%endfor%}', assigns)
+  end
+
+  def test_nested_for
+    assigns = {'array' => [[1,2],[3,4],[5,6]] }
+    assert_template_result('123456', '{%for item in array%}{%for i in item%}{{ i }}{%endfor%}{%endfor%}', assigns)
+  end
+
+  def test_offset_only
+    assigns = {'array' => [1,2,3,4,5,6,7,8,9,0]}
+    assert_template_result('890', '{%for i in array offset:7 %}{{ i }}{%endfor%}', assigns)
+  end
+
+  def test_pause_resume
+    assigns = {'array' => {'items' => [1,2,3,4,5,6,7,8,9,0]}}
+    markup = <<-MKUP
+      {%for i in array.items limit: 3 %}{{i}}{%endfor%}
+      next
+      {%for i in array.items offset:continue limit: 3 %}{{i}}{%endfor%}
+      next
+      {%for i in array.items offset:continue limit: 3 %}{{i}}{%endfor%}
+      MKUP
+    expected = <<-XPCTD
+      123
+      next
+      456
+      next
+      789
+      XPCTD
+    assert_template_result(expected,markup,assigns)
+  end
+
+  def test_pause_resume_limit
+    assigns = {'array' => {'items' => [1,2,3,4,5,6,7,8,9,0]}}
+    markup = <<-MKUP
+      {%for i in array.items limit:3 %}{{i}}{%endfor%}
+      next
+      {%for i in array.items offset:continue limit:3 %}{{i}}{%endfor%}
+      next
+      {%for i in array.items offset:continue limit:1 %}{{i}}{%endfor%}
+      MKUP
+    expected = <<-XPCTD
+      123
+      next
+      456
+      next
+      7
+      XPCTD
+    assert_template_result(expected,markup,assigns)
+  end
+
+  def test_pause_resume_BIG_limit
+    assigns = {'array' => {'items' => [1,2,3,4,5,6,7,8,9,0]}}
+    markup = <<-MKUP
+      {%for i in array.items limit:3 %}{{i}}{%endfor%}
+      next
+      {%for i in array.items offset:continue limit:3 %}{{i}}{%endfor%}
+      next
+      {%for i in array.items offset:continue limit:1000 %}{{i}}{%endfor%}
+      MKUP
+    expected = <<-XPCTD
+      123
+      next
+      456
+      next
+      7890
+      XPCTD
+      assert_template_result(expected,markup,assigns)
+  end
+
+
+  def test_pause_resume_BIG_offset
+    assigns = {'array' => {'items' => [1,2,3,4,5,6,7,8,9,0]}}
+    markup = %q({%for i in array.items limit:3 %}{{i}}{%endfor%}
+      next
+      {%for i in array.items offset:continue limit:3 %}{{i}}{%endfor%}
+      next
+      {%for i in array.items offset:continue limit:3 offset:1000 %}{{i}}{%endfor%})
+    expected = %q(123
+      next
+      456
+      next
+      )
+      assert_template_result(expected,markup,assigns)
+  end
+
+  def test_for_with_break
+    assigns = {'array' => {'items' => [1,2,3,4,5,6,7,8,9,10]}}
+
+    markup = '{% for i in array.items %}{% break %}{% endfor %}'
+    expected = ""
+    assert_template_result(expected,markup,assigns)
+
+    markup = '{% for i in array.items %}{{ i }}{% break %}{% endfor %}'
+    expected = "1"
+    assert_template_result(expected,markup,assigns)
+
+    markup = '{% for i in array.items %}{% break %}{{ i }}{% endfor %}'
+    expected = ""
+    assert_template_result(expected,markup,assigns)
+
+    markup = '{% for i in array.items %}{{ i }}{% if i > 3 %}{% break %}{% endif %}{% endfor %}'
+    expected = "1234"
+    assert_template_result(expected,markup,assigns)
+
+    # tests to ensure it only breaks out of the local for loop 
+    # and not all of them.
+    assigns = {'array' => [[1,2],[3,4],[5,6]] }
+    markup = '{% for item in array %}' + 
+               '{% for i in item %}' + 
+                 '{% if i == 1 %}' + 
+                   '{% break %}' + 
+                 '{% endif %}' + 
+                 '{{ i }}' + 
+               '{% endfor %}' + 
+             '{% endfor %}'
+    expected = '3456'
+    assert_template_result(expected, markup, assigns)
+
+    # test break does nothing when unreached
+    assigns = {'array' => {'items' => [1,2,3,4,5]}}
+    markup = '{% for i in array.items %}{% if i == 9999 %}{% break %}{% endif %}{{ i }}{% endfor %}'
+    expected = '12345'
+    assert_template_result(expected, markup, assigns)
+  end
+
+  def test_for_with_continue
+    assigns = {'array' => {'items' => [1,2,3,4,5]}}
+
+    markup = '{% for i in array.items %}{% continue %}{% endfor %}'
+    expected = ""
+    assert_template_result(expected,markup,assigns) 
+
+    markup = '{% for i in array.items %}{{ i }}{% continue %}{% endfor %}'
+    expected = "12345"
+    assert_template_result(expected,markup,assigns) 
+
+    markup = '{% for i in array.items %}{% continue %}{{ i }}{% endfor %}'
+    expected = ""
+    assert_template_result(expected,markup,assigns) 
+
+    markup = '{% for i in array.items %}{% if i > 3 %}{% continue %}{% endif %}{{ i }}{% endfor %}'
+    expected = "123"
+    assert_template_result(expected,markup,assigns)
+
+    markup = '{% for i in array.items %}{% if i == 3 %}{% continue %}{% else %}{{ i }}{% endif %}{% endfor %}'
+    expected = "1245"
+    assert_template_result(expected,markup,assigns)
+
+    # tests to ensure it only continues the local for loop and not all of them.
+    assigns = {'array' => [[1,2],[3,4],[5,6]] }
+    markup = '{% for item in array %}' + 
+               '{% for i in item %}' + 
+                 '{% if i == 1 %}' + 
+                   '{% continue %}' + 
+                 '{% endif %}' + 
+                 '{{ i }}' + 
+               '{% endfor %}' + 
+             '{% endfor %}'
+    expected = '23456'
+    assert_template_result(expected, markup, assigns)
+
+    # test continue does nothing when unreached
+    assigns = {'array' => {'items' => [1,2,3,4,5]}}
+    markup = '{% for i in array.items %}{% if i == 9999 %}{% continue %}{% endif %}{{ i }}{% endfor %}'
+    expected = '12345'
+    assert_template_result(expected, markup, assigns)
+  end
+
+  def test_for_tag_string
+    # ruby 1.8.7 "String".each => Enumerator with single "String" element.
+    # ruby 1.9.3 no longer supports .each on String though we mimic 
+    # the functionality for backwards compatibility
+
+    assert_template_result('test string', 
+                '{%for val in string%}{{val}}{%endfor%}', 
+                'string' => "test string")
+
+    assert_template_result('test string', 
+                '{%for val in string limit:1%}{{val}}{%endfor%}', 
+                'string' => "test string")
+
+    assert_template_result('val-string-1-1-0-1-0-true-true-test string', 
+                '{%for val in string%}' + 
+                '{{forloop.name}}-' + 
+                '{{forloop.index}}-' + 
+                '{{forloop.length}}-' + 
+                '{{forloop.index0}}-' + 
+                '{{forloop.rindex}}-' + 
+                '{{forloop.rindex0}}-' + 
+                '{{forloop.first}}-' + 
+                '{{forloop.last}}-' + 
+                '{{val}}{%endfor%}', 
+                'string' => "test string")
+  end
+
+  def test_blank_string_not_iterable
+    assert_template_result('', "{% for char in characters %}I WILL NOT BE OUTPUT{% endfor %}", 'characters' => '')
+  end
+end

test/liquid/tags/html_tag_test.rb

@@ -3,6 +3,18 @@ require 'test_helper'
 class HtmlTagTest < Test::Unit::TestCase
   include Liquid
 
+  class ArrayDrop < Liquid::Drop
+    include Enumerable
+
+    def initialize(array)
+      @array = array
+    end
+
+    def each(&block)
+      @array.each(&block)
+    end
+  end
+
   def test_html_table
 
     assert_template_result("<tr class=\"row1\">\n<td class=\"col1\"> 1 </td><td class=\"col2\"> 2 </td><td class=\"col3\"> 3 </td></tr>\n<tr class=\"row2\"><td class=\"col1\"> 4 </td><td class=\"col2\"> 5 </td><td class=\"col3\"> 6 </td></tr>\n",
@@ -26,4 +38,26 @@ class HtmlTagTest < Test::Unit::TestCase
                            '{% tablerow n in numbers cols:2%}{{tablerowloop.col}}{% endtablerow %}',
                            'numbers' => [1,2,3,4,5,6])
   end
+
+  def test_quoted_fragment
+    assert_template_result("<tr class=\"row1\">\n<td class=\"col1\"> 1 </td><td class=\"col2\"> 2 </td><td class=\"col3\"> 3 </td></tr>\n<tr class=\"row2\"><td class=\"col1\"> 4 </td><td class=\"col2\"> 5 </td><td class=\"col3\"> 6 </td></tr>\n",
+                           "{% tablerow n in collections.frontpage cols:3%} {{n}} {% endtablerow %}",
+                           'collections' => {'frontpage' => [1,2,3,4,5,6]})    
+    assert_template_result("<tr class=\"row1\">\n<td class=\"col1\"> 1 </td><td class=\"col2\"> 2 </td><td class=\"col3\"> 3 </td></tr>\n<tr class=\"row2\"><td class=\"col1\"> 4 </td><td class=\"col2\"> 5 </td><td class=\"col3\"> 6 </td></tr>\n",
+                           "{% tablerow n in collections['frontpage'] cols:3%} {{n}} {% endtablerow %}",
+                           'collections' => {'frontpage' => [1,2,3,4,5,6]})
+    
+  end
+
+  def test_enumerable_drop
+    assert_template_result("<tr class=\"row1\">\n<td class=\"col1\"> 1 </td><td class=\"col2\"> 2 </td><td class=\"col3\"> 3 </td></tr>\n<tr class=\"row2\"><td class=\"col1\"> 4 </td><td class=\"col2\"> 5 </td><td class=\"col3\"> 6 </td></tr>\n",
+                           '{% tablerow n in numbers cols:3%} {{n}} {% endtablerow %}',
+                           'numbers' => ArrayDrop.new([1,2,3,4,5,6]))
+  end
+
+  def test_offset_and_limit
+    assert_template_result("<tr class=\"row1\">\n<td class=\"col1\"> 1 </td><td class=\"col2\"> 2 </td><td class=\"col3\"> 3 </td></tr>\n<tr class=\"row2\"><td class=\"col1\"> 4 </td><td class=\"col2\"> 5 </td><td class=\"col3\"> 6 </td></tr>\n",
+                           '{% tablerow n in numbers cols:3 offset:1 limit:6%} {{n}} {% endtablerow %}',
+                           'numbers' => [0,1,2,3,4,5,6,7])
+  end
 end # HtmlTagTest

test/liquid/tags/if_else_tag_test.rb

@@ -157,4 +157,10 @@ class IfElseTagTest < Test::Unit::TestCase
     assert_template_result('yes',
                            %({% if 'gnomeslab-and-or-liquid' contains 'gnomeslab-and-or-liquid' %}yes{% endif %}))
   end
+
+  def test_operators_are_whitelisted
+    assert_raise(SyntaxError) do
+      assert_template_result('', %({% if 1 or throw or or 1 %}yes{% endif %}))
+    end
+  end
 end # IfElseTest

test/liquid/tags/standard_tag_test.rb

@@ -47,166 +47,6 @@ class StandardTagTest < Test::Unit::TestCase
                                      {%endcomment%}bar')
   end
 
-  def test_for
-    assert_template_result(' yo  yo  yo  yo ','{%for item in array%} yo {%endfor%}','array' => [1,2,3,4])
-    assert_template_result('yoyo','{%for item in array%}yo{%endfor%}','array' => [1,2])
-    assert_template_result(' yo ','{%for item in array%} yo {%endfor%}','array' => [1])
-    assert_template_result('','{%for item in array%}{%endfor%}','array' => [1,2])
-    expected = <<HERE
-
-  yo
-
-  yo
-
-  yo
-
-HERE
-    template = <<HERE
-{%for item in array%}
-  yo
-{%endfor%}
-HERE
-    assert_template_result(expected,template,'array' => [1,2,3])
-  end
-
-  def test_for_with_range
-    assert_template_result(' 1  2  3 ','{%for item in (1..3) %} {{item}} {%endfor%}')
-  end
-
-  def test_for_with_variable
-    assert_template_result(' 1  2  3 ','{%for item in array%} {{item}} {%endfor%}','array' => [1,2,3])
-    assert_template_result('123','{%for item in array%}{{item}}{%endfor%}','array' => [1,2,3])
-    assert_template_result('123','{% for item in array %}{{item}}{% endfor %}','array' => [1,2,3])
-    assert_template_result('abcd','{%for item in array%}{{item}}{%endfor%}','array' => ['a','b','c','d'])
-    assert_template_result('a b c','{%for item in array%}{{item}}{%endfor%}','array' => ['a',' ','b',' ','c'])
-    assert_template_result('abc','{%for item in array%}{{item}}{%endfor%}','array' => ['a','','b','','c'])
-  end
-
-  def test_for_helpers
-    assigns = {'array' => [1,2,3] }
-    assert_template_result(' 1/3  2/3  3/3 ',
-                           '{%for item in array%} {{forloop.index}}/{{forloop.length}} {%endfor%}',
-                           assigns)
-    assert_template_result(' 1  2  3 ', '{%for item in array%} {{forloop.index}} {%endfor%}', assigns)
-    assert_template_result(' 0  1  2 ', '{%for item in array%} {{forloop.index0}} {%endfor%}', assigns)
-    assert_template_result(' 2  1  0 ', '{%for item in array%} {{forloop.rindex0}} {%endfor%}', assigns)
-    assert_template_result(' 3  2  1 ', '{%for item in array%} {{forloop.rindex}} {%endfor%}', assigns)
-    assert_template_result(' true  false  false ', '{%for item in array%} {{forloop.first}} {%endfor%}', assigns)
-    assert_template_result(' false  false  true ', '{%for item in array%} {{forloop.last}} {%endfor%}', assigns)
-  end
-
-  def test_for_and_if
-    assigns = {'array' => [1,2,3] }
-    assert_template_result('+--',
-                           '{%for item in array%}{% if forloop.first %}+{% else %}-{% endif %}{%endfor%}',
-                           assigns)
-  end
-
-  def test_for_else
-    assert_template_result('+++', '{%for item in array%}+{%else%}-{%endfor%}', 'array'=>[1,2,3])
-    assert_template_result('-',   '{%for item in array%}+{%else%}-{%endfor%}', 'array'=>[])
-    assert_template_result('-',   '{%for item in array%}+{%else%}-{%endfor%}', 'array'=>nil)
-  end
-
-  def test_limiting
-    assigns = {'array' => [1,2,3,4,5,6,7,8,9,0]}
-    assert_template_result('12', '{%for i in array limit:2 %}{{ i }}{%endfor%}', assigns)
-    assert_template_result('1234', '{%for i in array limit:4 %}{{ i }}{%endfor%}', assigns)
-    assert_template_result('3456', '{%for i in array limit:4 offset:2 %}{{ i }}{%endfor%}', assigns)
-    assert_template_result('3456', '{%for i in array limit: 4 offset: 2 %}{{ i }}{%endfor%}', assigns)
-  end
-
-  def test_dynamic_variable_limiting
-    assigns = {'array' => [1,2,3,4,5,6,7,8,9,0]}
-    assigns['limit'] = 2
-    assigns['offset'] = 2
-
-    assert_template_result('34', '{%for i in array limit: limit offset: offset %}{{ i }}{%endfor%}', assigns)
-  end
-
-  def test_nested_for
-    assigns = {'array' => [[1,2],[3,4],[5,6]] }
-    assert_template_result('123456', '{%for item in array%}{%for i in item%}{{ i }}{%endfor%}{%endfor%}', assigns)
-  end
-
-  def test_offset_only
-    assigns = {'array' => [1,2,3,4,5,6,7,8,9,0]}
-    assert_template_result('890', '{%for i in array offset:7 %}{{ i }}{%endfor%}', assigns)
-  end
-
-  def test_pause_resume
-    assigns = {'array' => {'items' => [1,2,3,4,5,6,7,8,9,0]}}
-    markup = <<-MKUP
-      {%for i in array.items limit: 3 %}{{i}}{%endfor%}
-      next
-      {%for i in array.items offset:continue limit: 3 %}{{i}}{%endfor%}
-      next
-      {%for i in array.items offset:continue limit: 3 %}{{i}}{%endfor%}
-      MKUP
-    expected = <<-XPCTD
-      123
-      next
-      456
-      next
-      789
-      XPCTD
-    assert_template_result(expected,markup,assigns)
-  end
-
-  def test_pause_resume_limit
-    assigns = {'array' => {'items' => [1,2,3,4,5,6,7,8,9,0]}}
-    markup = <<-MKUP
-      {%for i in array.items limit:3 %}{{i}}{%endfor%}
-      next
-      {%for i in array.items offset:continue limit:3 %}{{i}}{%endfor%}
-      next
-      {%for i in array.items offset:continue limit:1 %}{{i}}{%endfor%}
-      MKUP
-    expected = <<-XPCTD
-      123
-      next
-      456
-      next
-      7
-      XPCTD
-    assert_template_result(expected,markup,assigns)
-  end
-
-  def test_pause_resume_BIG_limit
-    assigns = {'array' => {'items' => [1,2,3,4,5,6,7,8,9,0]}}
-    markup = <<-MKUP
-      {%for i in array.items limit:3 %}{{i}}{%endfor%}
-      next
-      {%for i in array.items offset:continue limit:3 %}{{i}}{%endfor%}
-      next
-      {%for i in array.items offset:continue limit:1000 %}{{i}}{%endfor%}
-      MKUP
-    expected = <<-XPCTD
-      123
-      next
-      456
-      next
-      7890
-      XPCTD
-      assert_template_result(expected,markup,assigns)
-  end
-
-
-  def test_pause_resume_BIG_offset
-    assigns = {'array' => {'items' => [1,2,3,4,5,6,7,8,9,0]}}
-    markup = %q({%for i in array.items limit:3 %}{{i}}{%endfor%}
-      next
-      {%for i in array.items offset:continue limit:3 %}{{i}}{%endfor%}
-      next
-      {%for i in array.items offset:continue limit:3 offset:1000 %}{{i}}{%endfor%})
-    expected = %q(123
-      next
-      456
-      next
-      )
-      assert_template_result(expected,markup,assigns)
-  end
-
   def test_assign
     assigns = {'var' => 'content' }
     assert_template_result('var2:  var2:content', 'var2:{{var2}} {%assign var2 = var%} var2:{{var2}}', assigns)
@@ -445,12 +285,6 @@ HERE
     assert_template_result('', '{% if null == true %}?{% endif %}', {})
   end
 
-  def test_for_reversed
-    assigns = {'array' => [ 1, 2, 3] }
-    assert_template_result('321','{%for item in array reversed %}{{item}}{%endfor%}',assigns)
-  end
-
-
   def test_ifchanged
     assigns = {'array' => [ 1, 1, 2, 2, 3, 3] }
     assert_template_result('123','{%for item in array%}{%ifchanged%}{{item}}{% endifchanged %}{%endfor%}',assigns)

test/liquid/variable_test.rb

@@ -11,67 +11,71 @@ class VariableTest < Test::Unit::TestCase
   def test_filters
     var = Variable.new('hello | textileze')
     assert_equal 'hello', var.name
-    assert_equal [[:textileze,[]]], var.filters
+    assert_equal [["textileze",[]]], var.filters
 
     var = Variable.new('hello | textileze | paragraph')
     assert_equal 'hello', var.name
-    assert_equal [[:textileze,[]], [:paragraph,[]]], var.filters
+    assert_equal [["textileze",[]], ["paragraph",[]]], var.filters
 
     var = Variable.new(%! hello | strftime: '%Y'!)
     assert_equal 'hello', var.name
-    assert_equal [[:strftime,["'%Y'"]]], var.filters
+    assert_equal [["strftime",["'%Y'"]]], var.filters
 
     var = Variable.new(%! 'typo' | link_to: 'Typo', true !)
     assert_equal %!'typo'!, var.name
-    assert_equal [[:link_to,["'Typo'", "true"]]], var.filters
+    assert_equal [["link_to",["'Typo'", "true"]]], var.filters
 
     var = Variable.new(%! 'typo' | link_to: 'Typo', false !)
     assert_equal %!'typo'!, var.name
-    assert_equal [[:link_to,["'Typo'", "false"]]], var.filters
+    assert_equal [["link_to",["'Typo'", "false"]]], var.filters
 
     var = Variable.new(%! 'foo' | repeat: 3 !)
     assert_equal %!'foo'!, var.name
-    assert_equal [[:repeat,["3"]]], var.filters
+    assert_equal [["repeat",["3"]]], var.filters
 
     var = Variable.new(%! 'foo' | repeat: 3, 3 !)
     assert_equal %!'foo'!, var.name
-    assert_equal [[:repeat,["3","3"]]], var.filters
+    assert_equal [["repeat",["3","3"]]], var.filters
 
     var = Variable.new(%! 'foo' | repeat: 3, 3, 3 !)
     assert_equal %!'foo'!, var.name
-    assert_equal [[:repeat,["3","3","3"]]], var.filters
+    assert_equal [["repeat",["3","3","3"]]], var.filters
 
     var = Variable.new(%! hello | strftime: '%Y, okay?'!)
     assert_equal 'hello', var.name
-    assert_equal [[:strftime,["'%Y, okay?'"]]], var.filters
+    assert_equal [["strftime",["'%Y, okay?'"]]], var.filters
 
     var = Variable.new(%! hello | things: "%Y, okay?", 'the other one'!)
     assert_equal 'hello', var.name
-    assert_equal [[:things,["\"%Y, okay?\"","'the other one'"]]], var.filters
+    assert_equal [["things",["\"%Y, okay?\"","'the other one'"]]], var.filters
   end
 
   def test_filter_with_date_parameter
 
     var = Variable.new(%! '2006-06-06' | date: "%m/%d/%Y"!)
     assert_equal "'2006-06-06'", var.name
-    assert_equal [[:date,["\"%m/%d/%Y\""]]], var.filters
+    assert_equal [["date",["\"%m/%d/%Y\""]]], var.filters
 
   end
 
   def test_filters_without_whitespace
     var = Variable.new('hello | textileze | paragraph')
     assert_equal 'hello', var.name
-    assert_equal [[:textileze,[]], [:paragraph,[]]], var.filters
+    assert_equal [["textileze",[]], ["paragraph",[]]], var.filters
 
     var = Variable.new('hello|textileze|paragraph')
     assert_equal 'hello', var.name
-    assert_equal [[:textileze,[]], [:paragraph,[]]], var.filters
+    assert_equal [["textileze",[]], ["paragraph",[]]], var.filters
+
+    var = Variable.new("hello|replace:'foo','bar'|textileze")
+    assert_equal 'hello', var.name
+    assert_equal [["replace", ["'foo'", "'bar'"]], ["textileze", []]], var.filters
   end
 
   def test_symbol
     var = Variable.new("http://disney.com/logo.gif | image: 'med' ")
     assert_equal 'http://disney.com/logo.gif', var.name
-    assert_equal [[:image,["'med'"]]], var.filters
+    assert_equal [["image",["'med'"]]], var.filters
   end
 
   def test_string_single_quoted
@@ -103,6 +107,12 @@ class VariableTest < Test::Unit::TestCase
     var = Variable.new(%| test.test |)
     assert_equal 'test.test', var.name
   end
+
+  def test_filter_with_keyword_arguments
+    var = Variable.new(%! hello | things: greeting: "world", farewell: 'goodbye'!)
+    assert_equal 'hello', var.name
+    assert_equal [['things',["greeting: \"world\"","farewell: 'goodbye'"]]], var.filters
+  end
 end