liquid 3.0.6 → 5.4.0

data/lib/liquid/drop.rb

@@ -1,7 +1,8 @@
+# frozen_string_literal: true
+
 require 'set'
 
 module Liquid
-
   # A drop in liquid is a class which allows you to export DOM like things to liquid.
   # Methods of drops are callable.
   # The main use for liquid drops is to implement lazy loaded objects.
@@ -19,28 +20,27 @@ module Liquid
   #   tmpl = Liquid::Template.parse( ' {% for product in product.top_sales %} {{ product.name }} {%endfor%} '  )
   #   tmpl.render('product' => ProductDrop.new ) # will invoke top_sales query.
   #
-  # Your drop can either implement the methods sans any parameters or implement the before_method(name) method which is a
-  # catch all.
+  # Your drop can either implement the methods sans any parameters
+  # or implement the liquid_method_missing(name) method which is a catch all.
   class Drop
     attr_writer :context
 
-    EMPTY_STRING = ''.freeze
-
     # Catch all for the method
-    def before_method(method)
-      nil
+    def liquid_method_missing(method)
+      return nil unless @context&.strict_variables
+      raise Liquid::UndefinedDropMethod, "undefined method #{method}"
     end
 
     # called by liquid to invoke a drop
     def invoke_drop(method_or_key)
-      if method_or_key && method_or_key != EMPTY_STRING && self.class.invokable?(method_or_key)
+      if self.class.invokable?(method_or_key)
         send(method_or_key)
       else
-        before_method(method_or_key)
+        liquid_method_missing(method_or_key)
       end
     end
 
-    def has_key?(name)
+    def key?(_name)
       true
     end
 
@@ -56,22 +56,25 @@ module Liquid
       self.class.name
     end
 
-    alias :[] :invoke_drop
-
-    private
+    alias_method :[], :invoke_drop
 
     # Check for method existence without invoking respond_to?, which creates symbols
     def self.invokable?(method_name)
-      unless @invokable_methods
+      invokable_methods.include?(method_name.to_s)
+    end
+
+    def self.invokable_methods
+      @invokable_methods ||= begin
         blacklist = Liquid::Drop.public_instance_methods + [:each]
+
         if include?(Enumerable)
           blacklist += Enumerable.public_instance_methods
-          blacklist -= [:sort, :count, :first, :min, :max, :include?]
+          blacklist -= [:sort, :count, :first, :min, :max]
         end
+
         whitelist = [:to_liquid] + (public_instance_methods - blacklist)
-        @invokable_methods = Set.new(whitelist.map(&:to_s))
+        Set.new(whitelist.map(&:to_s))
       end
-      @invokable_methods.include?(method_name.to_s)
     end
   end
 end

data/lib/liquid/errors.rb

@@ -1,10 +1,13 @@
+# frozen_string_literal: true
+
 module Liquid
   class Error < ::StandardError
     attr_accessor :line_number
+    attr_accessor :template_name
     attr_accessor :markup_context
 
-    def to_s(with_prefix=true)
-      str = ""
+    def to_s(with_prefix = true)
+      str = +""
       str << message_prefix if with_prefix
       str << super()
 
@@ -16,32 +19,20 @@ module Liquid
       str
     end
 
-    def set_line_number_from_token(token)
-      return unless token.respond_to?(:line_number)
-      return if self.line_number
-      self.line_number = token.line_number
-    end
-
-    def self.render(e)
-      if e.is_a?(Liquid::Error)
-        e.to_s
-      else
-        "Liquid error: #{e.to_s}"
-      end
-    end
-
     private
 
     def message_prefix
-      str = ""
-      if is_a?(SyntaxError)
-        str << "Liquid syntax error"
+      str = +""
+      str << if is_a?(SyntaxError)
+        "Liquid syntax error"
       else
-        str << "Liquid error"
+        "Liquid error"
       end
 
       if line_number
-        str << " (line #{line_number})"
+        str << " ("
+        str << template_name << " " if template_name
+        str << "line " << line_number.to_s << ")"
       end
 
       str << ": "
@@ -49,12 +40,19 @@ module Liquid
     end
   end
 
-  class ArgumentError < Error; end
-  class ContextError < Error; end
-  class FileSystemError < Error; end
-  class StandardError < Error; end
-  class SyntaxError < Error; end
-  class StackLevelError < Error; end
-  class TaintedError < Error; end
-  class MemoryError < Error; end
+  ArgumentError       = Class.new(Error)
+  ContextError        = Class.new(Error)
+  FileSystemError     = Class.new(Error)
+  StandardError       = Class.new(Error)
+  SyntaxError         = Class.new(Error)
+  StackLevelError     = Class.new(Error)
+  MemoryError         = Class.new(Error)
+  ZeroDivisionError   = Class.new(Error)
+  FloatDomainError    = Class.new(Error)
+  UndefinedVariable   = Class.new(Error)
+  UndefinedDropMethod = Class.new(Error)
+  UndefinedFilter     = Class.new(Error)
+  MethodOverrideError = Class.new(Error)
+  DisabledError       = Class.new(Error)
+  InternalError       = Class.new(Error)
 end

data/lib/liquid/expression.rb

@@ -1,33 +1,45 @@
+# frozen_string_literal: true
+
 module Liquid
   class Expression
     LITERALS = {
-      nil => nil, 'nil'.freeze => nil, 'null'.freeze => nil, ''.freeze => nil,
-      'true'.freeze  => true,
-      'false'.freeze => false,
-      'blank'.freeze => :blank?,
-      'empty'.freeze => :empty?
-    }
+      nil => nil, 'nil' => nil, 'null' => nil, '' => nil,
+      'true' => true,
+      'false' => false,
+      'blank' => '',
+      'empty' => ''
+    }.freeze
+
+    INTEGERS_REGEX       = /\A(-?\d+)\z/
+    FLOATS_REGEX         = /\A(-?\d[\d\.]+)\z/
+
+    # Use an atomic group (?>...) to avoid pathological backtracing from
+    # malicious input as described in https://github.com/Shopify/liquid/issues/1357
+    RANGES_REGEX         = /\A\(\s*(?>(\S+)\s*\.\.)\s*(\S+)\s*\)\z/
 
     def self.parse(markup)
-      if LITERALS.key?(markup)
-        LITERALS[markup]
+      return nil unless markup
+
+      markup = markup.strip
+      if (markup.start_with?('"') && markup.end_with?('"')) ||
+         (markup.start_with?("'") && markup.end_with?("'"))
+        return markup[1..-2]
+      end
+
+      case markup
+      when INTEGERS_REGEX
+        Regexp.last_match(1).to_i
+      when RANGES_REGEX
+        RangeLookup.parse(Regexp.last_match(1), Regexp.last_match(2))
+      when FLOATS_REGEX
+        Regexp.last_match(1).to_f
       else
-        case markup
-        when /\A'(.*)'\z/m # Single quoted strings
-          $1
-        when /\A"(.*)"\z/m # Double quoted strings
-          $1
-        when /\A(-?\d+)\z/ # Integer and floats
-          $1.to_i
-        when /\A\((\S+)\.\.(\S+)\)\z/ # Ranges
-          RangeLookup.parse($1, $2)
-        when /\A(-?\d[\d\.]+)\z/ # Floats
-          $1.to_f
+        if LITERALS.key?(markup)
+          LITERALS[markup]
         else
           VariableLookup.parse(markup)
         end
       end
     end
-
   end
 end

data/lib/liquid/extensions.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'time'
 require 'date'
 
@@ -7,44 +9,56 @@ class String # :nodoc:
   end
 end
 
-class Array  # :nodoc:
+class Symbol # :nodoc:
+  def to_liquid
+    to_s
+  end
+end
+
+class Array # :nodoc:
   def to_liquid
     self
   end
 end
 
-class Hash  # :nodoc:
+class Hash # :nodoc:
   def to_liquid
     self
   end
 end
 
-class Numeric  # :nodoc:
+class Numeric # :nodoc:
   def to_liquid
     self
   end
 end
 
-class Time  # :nodoc:
+class Range # :nodoc:
   def to_liquid
     self
   end
 end
 
-class DateTime < Date  # :nodoc:
+class Time # :nodoc:
   def to_liquid
     self
   end
 end
 
-class Date  # :nodoc:
+class DateTime < Date # :nodoc:
+  def to_liquid
+    self
+  end
+end
+
+class Date # :nodoc:
   def to_liquid
     self
   end
 end
 
 class TrueClass
-  def to_liquid  # :nodoc:
+  def to_liquid # :nodoc:
     self
   end
 end

data/lib/liquid/file_system.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Liquid
   # A Liquid file system is a way to let your templates retrieve other templates for use with the include tag.
   #
@@ -8,13 +10,13 @@ module Liquid
   #
   # Example:
   #
-  # Liquid::Template.file_system = Liquid::LocalFileSystem.new(template_path)
-  # liquid = Liquid::Template.parse(template)
+  #   Liquid::Template.file_system = Liquid::LocalFileSystem.new(template_path)
+  #   liquid = Liquid::Template.parse(template)
   #
   # This will parse the template with a LocalFileSystem implementation rooted at 'template_path'.
   class BlankFileSystem
     # Called by Liquid to retrieve a template file
-    def read_template_file(template_path, context)
+    def read_template_file(_template_path)
       raise FileSystemError, "This liquid context does not allow includes."
     end
   end
@@ -26,10 +28,10 @@ module Liquid
   #
   # Example:
   #
-  # file_system = Liquid::LocalFileSystem.new("/some/path")
+  #   file_system = Liquid::LocalFileSystem.new("/some/path")
   #
-  # file_system.full_path("mypartial")       # => "/some/path/_mypartial.liquid"
-  # file_system.full_path("dir/mypartial")   # => "/some/path/dir/_mypartial.liquid"
+  #   file_system.full_path("mypartial")       # => "/some/path/_mypartial.liquid"
+  #   file_system.full_path("dir/mypartial")   # => "/some/path/dir/_mypartial.liquid"
   #
   # Optionally in the second argument you can specify a custom pattern for template filenames.
   # The Kernel::sprintf format specification is used.
@@ -37,35 +39,35 @@ module Liquid
   #
   # Example:
   #
-  # file_system = Liquid::LocalFileSystem.new("/some/path", "%s.html")
+  #   file_system = Liquid::LocalFileSystem.new("/some/path", "%s.html")
   #
-  # file_system.full_path("index") # => "/some/path/index.html"
+  #   file_system.full_path("index") # => "/some/path/index.html"
   #
   class LocalFileSystem
     attr_accessor :root
 
-    def initialize(root, pattern = "_%s.liquid".freeze)
-      @root = root
+    def initialize(root, pattern = "_%s.liquid")
+      @root    = root
       @pattern = pattern
     end
 
-    def read_template_file(template_path, context)
+    def read_template_file(template_path)
       full_path = full_path(template_path)
-      raise FileSystemError, "No such template '#{template_path}'" unless File.exists?(full_path)
+      raise FileSystemError, "No such template '#{template_path}'" unless File.exist?(full_path)
 
       File.read(full_path)
     end
 
     def full_path(template_path)
-      raise FileSystemError, "Illegal template name '#{template_path}'" unless template_path =~ /\A[^.\/][a-zA-Z0-9_\/]+\z/
+      raise FileSystemError, "Illegal template name '#{template_path}'" unless %r{\A[^./][a-zA-Z0-9_/]+\z}.match?(template_path)
 
-      full_path = if template_path.include?('/'.freeze)
+      full_path = if template_path.include?('/')
         File.join(root, File.dirname(template_path), @pattern % File.basename(template_path))
       else
         File.join(root, @pattern % template_path)
       end
 
-      raise FileSystemError, "Illegal template path '#{File.expand_path(full_path)}'" unless File.expand_path(full_path) =~ /\A#{File.expand_path(root)}/
+      raise FileSystemError, "Illegal template path '#{File.expand_path(full_path)}'" unless File.expand_path(full_path).start_with?(File.expand_path(root))
 
       full_path
     end

data/lib/liquid/forloop_drop.rb

@@ -0,0 +1,92 @@
+# frozen_string_literal: true
+
+module Liquid
+  # @liquid_public_docs
+  # @liquid_type object
+  # @liquid_name forloop
+  # @liquid_summary
+  #   Information about a parent [`for` loop](/api/liquid/tags#for).
+  class ForloopDrop < Drop
+    def initialize(name, length, parentloop)
+      @name       = name
+      @length     = length
+      @parentloop = parentloop
+      @index      = 0
+    end
+
+    # @liquid_public_docs
+    # @liquid_name length
+    # @liquid_summary
+    #   The total number of iterations in the loop.
+    # @liquid_return [number]
+    attr_reader :length
+
+    # @liquid_public_docs
+    # @liquid_name parentloop
+    # @liquid_summary
+    #   The parent `forloop` object.
+    # @liquid_description
+    #   If the current `for` loop isn't nested inside another `for` loop, then `nil` is returned.
+    # @liquid_return [forloop]
+    attr_reader :parentloop
+
+    def name
+      Usage.increment('forloop_drop_name')
+      @name
+    end
+
+    # @liquid_public_docs
+    # @liquid_summary
+    #   The 1-based index of the current iteration.
+    # @liquid_return [number]
+    def index
+      @index + 1
+    end
+
+    # @liquid_public_docs
+    # @liquid_summary
+    #   The 0-based index of the current iteration.
+    # @liquid_return [number]
+    def index0
+      @index
+    end
+
+    # @liquid_public_docs
+    # @liquid_summary
+    #   The 1-based index of the current iteration, in reverse order.
+    # @liquid_return [number]
+    def rindex
+      @length - @index
+    end
+
+    # @liquid_public_docs
+    # @liquid_summary
+    #   The 0-based index of the current iteration, in reverse order.
+    # @liquid_return [number]
+    def rindex0
+      @length - @index - 1
+    end
+
+    # @liquid_public_docs
+    # @liquid_summary
+    #   Returns `true` if the current iteration is the first. Returns `false` if not.
+    # @liquid_return [boolean]
+    def first
+      @index == 0
+    end
+
+    # @liquid_public_docs
+    # @liquid_summary
+    #   Returns `true` if the current iteration is the last. Returns `false` if not.
+    # @liquid_return [boolean]
+    def last
+      @index == @length - 1
+    end
+
+    protected
+
+    def increment!
+      @index += 1
+    end
+  end
+end

data/lib/liquid/i18n.rb

@@ -1,11 +1,12 @@
+# frozen_string_literal: true
+
 require 'yaml'
 
 module Liquid
   class I18n
-    DEFAULT_LOCALE = File.join(File.expand_path(File.dirname(__FILE__)), "locales", "en.yml")
+    DEFAULT_LOCALE = File.join(File.expand_path(__dir__), "locales", "en.yml")
 
-    class TranslationError < StandardError
-    end
+    TranslationError = Class.new(StandardError)
 
     attr_reader :path
 
@@ -23,16 +24,17 @@ module Liquid
     end
 
     private
+
     def interpolate(name, vars)
-      name.gsub(/%\{(\w+)\}/) {
+      name.gsub(/%\{(\w+)\}/) do
         # raise TranslationError, "Undefined key #{$1} for interpolation in translation #{name}"  unless vars[$1.to_sym]
-        "#{vars[$1.to_sym]}"
-      }
+        (vars[Regexp.last_match(1).to_sym]).to_s
+      end
     end
 
     def deep_fetch_translation(name)
-      name.split('.'.freeze).reduce(locale) do |level, cur|
-        level[cur] or raise TranslationError, "Translation for #{name} does not exist in locale #{path}"
+      name.split('.').reduce(locale) do |level, cur|
+        level[cur] || raise(TranslationError, "Translation for #{name} does not exist in locale #{path}")
       end
     end
   end

data/lib/liquid/interrupts.rb

@@ -1,11 +1,12 @@
-module Liquid
+# frozen_string_literal: true
 
+module Liquid
   # An interrupt is any command that breaks processing of a block (ex: a for loop).
   class Interrupt
     attr_reader :message
 
-    def initialize(message=nil)
-      @message = message || "interrupt".freeze
+    def initialize(message = nil)
+      @message = message || "interrupt"
     end
   end
 

data/lib/liquid/lexer.rb

@@ -1,43 +1,54 @@
+# frozen_string_literal: true
+
 require "strscan"
 module Liquid
   class Lexer
     SPECIALS = {
-      '|'.freeze => :pipe,
-      '.'.freeze => :dot,
-      ':'.freeze => :colon,
-      ','.freeze => :comma,
-      '['.freeze => :open_square,
-      ']'.freeze => :close_square,
-      '('.freeze => :open_round,
-      ')'.freeze => :close_round
-    }
-    IDENTIFIER = /[\w\-?!]+/
+      '|' => :pipe,
+      '.' => :dot,
+      ':' => :colon,
+      ',' => :comma,
+      '[' => :open_square,
+      ']' => :close_square,
+      '(' => :open_round,
+      ')' => :close_round,
+      '?' => :question,
+      '-' => :dash,
+    }.freeze
+    IDENTIFIER            = /[a-zA-Z_][\w-]*\??/
     SINGLE_STRING_LITERAL = /'[^\']*'/
     DOUBLE_STRING_LITERAL = /"[^\"]*"/
-    NUMBER_LITERAL = /-?\d+(\.\d+)?/
-    DOTDOT = /\.\./
-    COMPARISON_OPERATOR = /==|!=|<>|<=?|>=?|contains/
+    NUMBER_LITERAL        = /-?\d+(\.\d+)?/
+    DOTDOT                = /\.\./
+    COMPARISON_OPERATOR   = /==|!=|<>|<=?|>=?|contains(?=\s)/
+    WHITESPACE_OR_NOTHING = /\s*/
 
     def initialize(input)
-      @ss = StringScanner.new(input.rstrip)
+      @ss = StringScanner.new(input)
     end
 
     def tokenize
       @output = []
 
-      while !@ss.eos?
-        @ss.skip(/\s*/)
-        tok = case
-        when t = @ss.scan(COMPARISON_OPERATOR) then [:comparison, t]
-        when t = @ss.scan(SINGLE_STRING_LITERAL) then [:string, t]
-        when t = @ss.scan(DOUBLE_STRING_LITERAL) then [:string, t]
-        when t = @ss.scan(NUMBER_LITERAL) then [:number, t]
-        when t = @ss.scan(IDENTIFIER) then [:id, t]
-        when t = @ss.scan(DOTDOT) then [:dotdot, t]
+      until @ss.eos?
+        @ss.skip(WHITESPACE_OR_NOTHING)
+        break if @ss.eos?
+        tok      = if (t = @ss.scan(COMPARISON_OPERATOR))
+          [:comparison, t]
+        elsif (t = @ss.scan(SINGLE_STRING_LITERAL))
+          [:string, t]
+        elsif (t = @ss.scan(DOUBLE_STRING_LITERAL))
+          [:string, t]
+        elsif (t = @ss.scan(NUMBER_LITERAL))
+          [:number, t]
+        elsif (t = @ss.scan(IDENTIFIER))
+          [:id, t]
+        elsif (t = @ss.scan(DOTDOT))
+          [:dotdot, t]
         else
-          c = @ss.getch
-          if s = SPECIALS[c]
-            [s,c]
+          c     = @ss.getch
+          if (s = SPECIALS[c])
+            [s, c]
           else
             raise SyntaxError, "Unexpected character #{c}"
           end

data/lib/liquid/locales/en.yml

@@ -1,6 +1,7 @@
 ---
   errors:
     syntax:
+      tag_unexpected_args: "Syntax Error in '%{tag}' - Valid syntax: %{tag}"
       assign: "Syntax Error in 'assign' - Valid syntax: assign [var] = [source]"
       capture: "Syntax Error in 'capture' - Valid syntax: capture [var]"
       case: "Syntax Error in 'case' - Valid syntax: case [condition]"
@@ -12,11 +13,17 @@
       for_invalid_attribute: "Invalid attribute in for loop. Valid attributes are limit and offset"
       if: "Syntax Error in tag 'if' - Valid syntax: if [expression]"
       include: "Error in tag 'include' - Valid syntax: include '[template]' (with|for) [object|collection]"
-      unknown_tag: "Unknown tag '%{tag}'"
-      invalid_delimiter: "'end' is not a valid delimiter for %{block_name} tags. use %{block_delimiter}"
-      unexpected_else: "%{block_name} tag does not expect else tag"
+      inline_comment_invalid: "Syntax error in tag '#' - Each line of comments must be prefixed by the '#' character"
+      invalid_delimiter: "'%{tag}' is not a valid delimiter for %{block_name} tags. use %{block_delimiter}"
+      render: "Syntax error in tag 'render' - Template name must be a quoted string"
+      table_row: "Syntax Error in 'table_row loop' - Valid syntax: table_row [item] in [collection] cols=3"
+      tag_never_closed: "'%{block_name}' tag was never closed"
       tag_termination: "Tag '%{token}' was not properly terminated with regexp: %{tag_end}"
+      unexpected_else: "%{block_name} tag does not expect 'else' tag"
+      unexpected_outer_tag: "Unexpected outer '%{tag}' tag"
+      unknown_tag: "Unknown tag '%{tag}'"
       variable_termination: "Variable '%{token}' was not properly terminated with regexp: %{tag_end}"
-      tag_never_closed: "'%{block_name}' tag was never closed"
-      meta_syntax_error: "Liquid syntax error: #{e.message}"
-      table_row: "Syntax Error in 'table_row loop' - Valid syntax: table_row [item] in [collection] cols=3"
+    argument:
+      include: "Argument error in tag 'include' - Illegal template name"
+    disabled:
+      tag: "usage is not allowed in this context"