liquid 4.0.0.rc3 → 5.0.0

data/lib/liquid/document.rb

@@ -1,26 +1,64 @@
+# frozen_string_literal: true
+
 module Liquid
-  class Document < BlockBody
+  class Document
     def self.parse(tokens, parse_context)
-      doc = new
+      doc = new(parse_context)
       doc.parse(tokens, parse_context)
       doc
     end
 
-    def parse(tokens, parse_context)
-      super do |end_tag_name, end_tag_params|
-        unknown_tag(end_tag_name, parse_context) if end_tag_name
+    attr_reader :parse_context, :body
+
+    def initialize(parse_context)
+      @parse_context = parse_context
+      @body = new_body
+    end
+
+    def nodelist
+      @body.nodelist
+    end
+
+    def parse(tokenizer, parse_context)
+      while parse_body(tokenizer)
       end
+      @body.freeze
     rescue SyntaxError => e
       e.line_number ||= parse_context.line_number
       raise
     end
 
-    def unknown_tag(tag, parse_context)
+    def unknown_tag(tag, _markup, _tokenizer)
       case tag
-      when 'else'.freeze, 'end'.freeze
-        raise SyntaxError.new(parse_context.locale.t("errors.syntax.unexpected_outer_tag".freeze, tag: tag))
+      when 'else', 'end'
+        raise SyntaxError, parse_context.locale.t("errors.syntax.unexpected_outer_tag", tag: tag)
       else
-        raise SyntaxError.new(parse_context.locale.t("errors.syntax.unknown_tag".freeze, tag: tag))
+        raise SyntaxError, parse_context.locale.t("errors.syntax.unknown_tag", tag: tag)
+      end
+    end
+
+    def render_to_output_buffer(context, output)
+      @body.render_to_output_buffer(context, output)
+    end
+
+    def render(context)
+      render_to_output_buffer(context, +'')
+    end
+
+    private
+
+    def new_body
+      parse_context.new_block_body
+    end
+
+    def parse_body(tokenizer)
+      @body.parse(tokenizer, parse_context) do |unknown_tag_name, unknown_tag_markup|
+        if unknown_tag_name
+          unknown_tag(unknown_tag_name, unknown_tag_markup, tokenizer)
+          true
+        else
+          false
+        end
       end
     end
   end

data/lib/liquid/drop.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'set'
 
 module Liquid
@@ -25,7 +27,7 @@ module Liquid
 
     # Catch all for the method
     def liquid_method_missing(method)
-      return nil unless @context && @context.strict_variables
+      return nil unless @context&.strict_variables
       raise Liquid::UndefinedDropMethod, "undefined method #{method}"
     end
 
@@ -67,7 +69,7 @@ module Liquid
 
         if include?(Enumerable)
           blacklist += Enumerable.public_instance_methods
-          blacklist -= [:sort, :count, :first, :min, :max, :include?]
+          blacklist -= [:sort, :count, :first, :min, :max]
         end
 
         whitelist = [:to_liquid] + (public_instance_methods - blacklist)

data/lib/liquid/errors.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Liquid
   class Error < ::StandardError
     attr_accessor :line_number
@@ -5,7 +7,7 @@ module Liquid
     attr_accessor :markup_context
 
     def to_s(with_prefix = true)
-      str = ""
+      str = +""
       str << message_prefix if with_prefix
       str << super()
 
@@ -17,22 +19,14 @@ module Liquid
       str
     end
 
-    def self.render(e)
-      if e.is_a?(Liquid::Error)
-        e.to_s
-      else
-        "Liquid error: #{e}"
-      end
-    end
-
     private
 
     def message_prefix
-      str = ""
-      if is_a?(SyntaxError)
-        str << "Liquid syntax error"
+      str = +""
+      str << if is_a?(SyntaxError)
+        "Liquid syntax error"
       else
-        str << "Liquid error"
+        "Liquid error"
       end
 
       if line_number
@@ -46,18 +40,19 @@ module Liquid
     end
   end
 
-  ArgumentError = Class.new(Error)
-  ContextError = Class.new(Error)
-  FileSystemError = Class.new(Error)
-  StandardError = Class.new(Error)
-  SyntaxError = Class.new(Error)
-  StackLevelError = Class.new(Error)
-  TaintedError = Class.new(Error)
-  MemoryError = Class.new(Error)
-  ZeroDivisionError = Class.new(Error)
-  FloatDomainError = Class.new(Error)
-  UndefinedVariable = Class.new(Error)
+  ArgumentError       = Class.new(Error)
+  ContextError        = Class.new(Error)
+  FileSystemError     = Class.new(Error)
+  StandardError       = Class.new(Error)
+  SyntaxError         = Class.new(Error)
+  StackLevelError     = Class.new(Error)
+  MemoryError         = Class.new(Error)
+  ZeroDivisionError   = Class.new(Error)
+  FloatDomainError    = Class.new(Error)
+  UndefinedVariable   = Class.new(Error)
   UndefinedDropMethod = Class.new(Error)
-  UndefinedFilter = Class.new(Error)
+  UndefinedFilter     = Class.new(Error)
   MethodOverrideError = Class.new(Error)
+  DisabledError       = Class.new(Error)
+  InternalError       = Class.new(Error)
 end

data/lib/liquid/expression.rb

@@ -1,41 +1,40 @@
+# frozen_string_literal: true
+
 module Liquid
   class Expression
-    class MethodLiteral
-      attr_reader :method_name, :to_s
+    LITERALS = {
+      nil => nil, 'nil' => nil, 'null' => nil, '' => nil,
+      'true' => true,
+      'false' => false,
+      'blank' => '',
+      'empty' => ''
+    }.freeze
 
-      def initialize(method_name, to_s)
-        @method_name = method_name
-        @to_s = to_s
-      end
+    SINGLE_QUOTED_STRING = /\A\s*'(.*)'\s*\z/m
+    DOUBLE_QUOTED_STRING = /\A\s*"(.*)"\s*\z/m
+    INTEGERS_REGEX       = /\A\s*(-?\d+)\s*\z/
+    FLOATS_REGEX         = /\A\s*(-?\d[\d\.]+)\s*\z/
 
-      def to_liquid
-        to_s
-      end
-    end
-
-    LITERALS = {
-      nil => nil, 'nil'.freeze => nil, 'null'.freeze => nil, ''.freeze => nil,
-      'true'.freeze  => true,
-      'false'.freeze => false,
-      'blank'.freeze => MethodLiteral.new(:blank?, '').freeze,
-      'empty'.freeze => MethodLiteral.new(:empty?, '').freeze
-    }
+    # Use an atomic group (?>...) to avoid pathological backtracing from
+    # malicious input as described in https://github.com/Shopify/liquid/issues/1357
+    RANGES_REGEX         = /\A\s*\(\s*(?>(\S+)\s*\.\.)\s*(\S+)\s*\)\s*\z/
 
     def self.parse(markup)
-      if LITERALS.key?(markup)
-        LITERALS[markup]
+      case markup
+      when nil
+        nil
+      when SINGLE_QUOTED_STRING, DOUBLE_QUOTED_STRING
+        Regexp.last_match(1)
+      when INTEGERS_REGEX
+        Regexp.last_match(1).to_i
+      when RANGES_REGEX
+        RangeLookup.parse(Regexp.last_match(1), Regexp.last_match(2))
+      when FLOATS_REGEX
+        Regexp.last_match(1).to_f
       else
-        case markup
-        when /\A'(.*)'\z/m # Single quoted strings
-          $1
-        when /\A"(.*)"\z/m # Double quoted strings
-          $1
-        when /\A(-?\d+)\z/ # Integer and floats
-          $1.to_i
-        when /\A\((\S+)\.\.(\S+)\)\z/ # Ranges
-          RangeLookup.parse($1, $2)
-        when /\A(-?\d[\d\.]+)\z/ # Floats
-          $1.to_f
+        markup = markup.strip
+        if LITERALS.key?(markup)
+          LITERALS[markup]
         else
           VariableLookup.parse(markup)
         end

data/lib/liquid/extensions.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'time'
 require 'date'
 
@@ -7,6 +9,12 @@ class String # :nodoc:
   end
 end
 
+class Symbol # :nodoc:
+  def to_liquid
+    to_s
+  end
+end
+
 class Array # :nodoc:
   def to_liquid
     self

data/lib/liquid/file_system.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Liquid
   # A Liquid file system is a way to let your templates retrieve other templates for use with the include tag.
   #
@@ -44,8 +46,8 @@ module Liquid
   class LocalFileSystem
     attr_accessor :root
 
-    def initialize(root, pattern = "_%s.liquid".freeze)
-      @root = root
+    def initialize(root, pattern = "_%s.liquid")
+      @root    = root
       @pattern = pattern
     end
 
@@ -57,9 +59,9 @@ module Liquid
     end
 
     def full_path(template_path)
-      raise FileSystemError, "Illegal template name '#{template_path}'" unless template_path =~ /\A[^.\/][a-zA-Z0-9_\/]+\z/
+      raise FileSystemError, "Illegal template name '#{template_path}'" unless %r{\A[^./][a-zA-Z0-9_/]+\z}.match?(template_path)
 
-      full_path = if template_path.include?('/'.freeze)
+      full_path = if template_path.include?('/')
         File.join(root, File.dirname(template_path), @pattern % File.basename(template_path))
       else
         File.join(root, @pattern % template_path)

data/lib/liquid/forloop_drop.rb

@@ -1,13 +1,20 @@
+# frozen_string_literal: true
+
 module Liquid
   class ForloopDrop < Drop
     def initialize(name, length, parentloop)
-      @name = name
-      @length = length
+      @name       = name
+      @length     = length
       @parentloop = parentloop
-      @index = 0
+      @index      = 0
     end
 
-    attr_reader :name, :length, :parentloop
+    attr_reader :length, :parentloop
+
+    def name
+      Usage.increment('forloop_drop_name')
+      @name
+    end
 
     def index
       @index + 1

data/lib/liquid/i18n.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'yaml'
 
 module Liquid
@@ -26,13 +28,13 @@ module Liquid
     def interpolate(name, vars)
       name.gsub(/%\{(\w+)\}/) do
         # raise TranslationError, "Undefined key #{$1} for interpolation in translation #{name}"  unless vars[$1.to_sym]
-        "#{vars[$1.to_sym]}"
+        (vars[Regexp.last_match(1).to_sym]).to_s
       end
     end
 
     def deep_fetch_translation(name)
-      name.split('.'.freeze).reduce(locale) do |level, cur|
-        level[cur] or raise TranslationError, "Translation for #{name} does not exist in locale #{path}"
+      name.split('.').reduce(locale) do |level, cur|
+        level[cur] || raise(TranslationError, "Translation for #{name} does not exist in locale #{path}")
       end
     end
   end

data/lib/liquid/interrupts.rb

@@ -1,10 +1,12 @@
+# frozen_string_literal: true
+
 module Liquid
   # An interrupt is any command that breaks processing of a block (ex: a for loop).
   class Interrupt
     attr_reader :message
 
     def initialize(message = nil)
-      @message = message || "interrupt".freeze
+      @message = message || "interrupt"
     end
   end
 

data/lib/liquid/lexer.rb

@@ -1,44 +1,53 @@
+# frozen_string_literal: true
+
 require "strscan"
 module Liquid
   class Lexer
     SPECIALS = {
-      '|'.freeze => :pipe,
-      '.'.freeze => :dot,
-      ':'.freeze => :colon,
-      ','.freeze => :comma,
-      '['.freeze => :open_square,
-      ']'.freeze => :close_square,
-      '('.freeze => :open_round,
-      ')'.freeze => :close_round,
-      '?'.freeze => :question,
-      '-'.freeze => :dash
-    }
-    IDENTIFIER = /[a-zA-Z_][\w-]*\??/
+      '|' => :pipe,
+      '.' => :dot,
+      ':' => :colon,
+      ',' => :comma,
+      '[' => :open_square,
+      ']' => :close_square,
+      '(' => :open_round,
+      ')' => :close_round,
+      '?' => :question,
+      '-' => :dash,
+    }.freeze
+    IDENTIFIER            = /[a-zA-Z_][\w-]*\??/
     SINGLE_STRING_LITERAL = /'[^\']*'/
     DOUBLE_STRING_LITERAL = /"[^\"]*"/
-    NUMBER_LITERAL = /-?\d+(\.\d+)?/
-    DOTDOT = /\.\./
-    COMPARISON_OPERATOR = /==|!=|<>|<=?|>=?|contains/
+    NUMBER_LITERAL        = /-?\d+(\.\d+)?/
+    DOTDOT                = /\.\./
+    COMPARISON_OPERATOR   = /==|!=|<>|<=?|>=?|contains(?=\s)/
+    WHITESPACE_OR_NOTHING = /\s*/
 
     def initialize(input)
-      @ss = StringScanner.new(input.rstrip)
+      @ss = StringScanner.new(input)
     end
 
     def tokenize
       @output = []
 
       until @ss.eos?
-        @ss.skip(/\s*/)
-        tok = case
-        when t = @ss.scan(COMPARISON_OPERATOR) then [:comparison, t]
-        when t = @ss.scan(SINGLE_STRING_LITERAL) then [:string, t]
-        when t = @ss.scan(DOUBLE_STRING_LITERAL) then [:string, t]
-        when t = @ss.scan(NUMBER_LITERAL) then [:number, t]
-        when t = @ss.scan(IDENTIFIER) then [:id, t]
-        when t = @ss.scan(DOTDOT) then [:dotdot, t]
+        @ss.skip(WHITESPACE_OR_NOTHING)
+        break if @ss.eos?
+        tok      = if (t = @ss.scan(COMPARISON_OPERATOR))
+          [:comparison, t]
+        elsif (t = @ss.scan(SINGLE_STRING_LITERAL))
+          [:string, t]
+        elsif (t = @ss.scan(DOUBLE_STRING_LITERAL))
+          [:string, t]
+        elsif (t = @ss.scan(NUMBER_LITERAL))
+          [:number, t]
+        elsif (t = @ss.scan(IDENTIFIER))
+          [:id, t]
+        elsif (t = @ss.scan(DOTDOT))
+          [:dotdot, t]
         else
-          c = @ss.getch
-          if s = SPECIALS[c]
+          c     = @ss.getch
+          if (s = SPECIALS[c])
             [s, c]
           else
             raise SyntaxError, "Unexpected character #{c}"

data/lib/liquid/locales/en.yml

@@ -14,13 +14,15 @@
       if: "Syntax Error in tag 'if' - Valid syntax: if [expression]"
       include: "Error in tag 'include' - Valid syntax: include '[template]' (with|for) [object|collection]"
       unknown_tag: "Unknown tag '%{tag}'"
-      invalid_delimiter: "'end' is not a valid delimiter for %{block_name} tags. use %{block_delimiter}"
+      invalid_delimiter: "'%{tag}' is not a valid delimiter for %{block_name} tags. use %{block_delimiter}"
       unexpected_else: "%{block_name} tag does not expect 'else' tag"
       unexpected_outer_tag: "Unexpected outer '%{tag}' tag"
       tag_termination: "Tag '%{token}' was not properly terminated with regexp: %{tag_end}"
       variable_termination: "Variable '%{token}' was not properly terminated with regexp: %{tag_end}"
       tag_never_closed: "'%{block_name}' tag was never closed"
-      meta_syntax_error: "Liquid syntax error: #{e.message}"
       table_row: "Syntax Error in 'table_row loop' - Valid syntax: table_row [item] in [collection] cols=3"
+      render: "Syntax error in tag 'render' - Template name must be a quoted string"
     argument:
       include: "Argument error in tag 'include' - Illegal template name"
+    disabled:
+      tag: "usage is not allowed in this context"