liquid 4.0.0 → 5.0.1

data/lib/liquid/drop.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'set'
 
 module Liquid
@@ -25,7 +27,7 @@ module Liquid
 
     # Catch all for the method
     def liquid_method_missing(method)
-      return nil unless @context && @context.strict_variables
+      return nil unless @context&.strict_variables
       raise Liquid::UndefinedDropMethod, "undefined method #{method}"
     end
 
@@ -67,7 +69,7 @@ module Liquid
 
         if include?(Enumerable)
           blacklist += Enumerable.public_instance_methods
-          blacklist -= [:sort, :count, :first, :min, :max, :include?]
+          blacklist -= [:sort, :count, :first, :min, :max]
         end
 
         whitelist = [:to_liquid] + (public_instance_methods - blacklist)

data/lib/liquid/errors.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Liquid
   class Error < ::StandardError
     attr_accessor :line_number
@@ -5,7 +7,7 @@ module Liquid
     attr_accessor :markup_context
 
     def to_s(with_prefix = true)
-      str = ""
+      str = +""
       str << message_prefix if with_prefix
       str << super()
 
@@ -20,11 +22,11 @@ module Liquid
     private
 
     def message_prefix
-      str = ""
-      if is_a?(SyntaxError)
-        str << "Liquid syntax error"
+      str = +""
+      str << if is_a?(SyntaxError)
+        "Liquid syntax error"
       else
-        str << "Liquid error"
+        "Liquid error"
       end
 
       if line_number
@@ -38,19 +40,19 @@ module Liquid
     end
   end
 
-  ArgumentError = Class.new(Error)
-  ContextError = Class.new(Error)
-  FileSystemError = Class.new(Error)
-  StandardError = Class.new(Error)
-  SyntaxError = Class.new(Error)
-  StackLevelError = Class.new(Error)
-  TaintedError = Class.new(Error)
-  MemoryError = Class.new(Error)
-  ZeroDivisionError = Class.new(Error)
-  FloatDomainError = Class.new(Error)
-  UndefinedVariable = Class.new(Error)
+  ArgumentError       = Class.new(Error)
+  ContextError        = Class.new(Error)
+  FileSystemError     = Class.new(Error)
+  StandardError       = Class.new(Error)
+  SyntaxError         = Class.new(Error)
+  StackLevelError     = Class.new(Error)
+  MemoryError         = Class.new(Error)
+  ZeroDivisionError   = Class.new(Error)
+  FloatDomainError    = Class.new(Error)
+  UndefinedVariable   = Class.new(Error)
   UndefinedDropMethod = Class.new(Error)
-  UndefinedFilter = Class.new(Error)
+  UndefinedFilter     = Class.new(Error)
   MethodOverrideError = Class.new(Error)
-  InternalError = Class.new(Error)
+  DisabledError       = Class.new(Error)
+  InternalError       = Class.new(Error)
 end

data/lib/liquid/expression.rb

@@ -1,41 +1,40 @@
+# frozen_string_literal: true
+
 module Liquid
   class Expression
-    class MethodLiteral
-      attr_reader :method_name, :to_s
+    LITERALS = {
+      nil => nil, 'nil' => nil, 'null' => nil, '' => nil,
+      'true' => true,
+      'false' => false,
+      'blank' => '',
+      'empty' => ''
+    }.freeze
 
-      def initialize(method_name, to_s)
-        @method_name = method_name
-        @to_s = to_s
-      end
+    SINGLE_QUOTED_STRING = /\A\s*'(.*)'\s*\z/m
+    DOUBLE_QUOTED_STRING = /\A\s*"(.*)"\s*\z/m
+    INTEGERS_REGEX       = /\A\s*(-?\d+)\s*\z/
+    FLOATS_REGEX         = /\A\s*(-?\d[\d\.]+)\s*\z/
 
-      def to_liquid
-        to_s
-      end
-    end
-
-    LITERALS = {
-      nil => nil, 'nil'.freeze => nil, 'null'.freeze => nil, ''.freeze => nil,
-      'true'.freeze  => true,
-      'false'.freeze => false,
-      'blank'.freeze => MethodLiteral.new(:blank?, '').freeze,
-      'empty'.freeze => MethodLiteral.new(:empty?, '').freeze
-    }
+    # Use an atomic group (?>...) to avoid pathological backtracing from
+    # malicious input as described in https://github.com/Shopify/liquid/issues/1357
+    RANGES_REGEX         = /\A\s*\(\s*(?>(\S+)\s*\.\.)\s*(\S+)\s*\)\s*\z/
 
     def self.parse(markup)
-      if LITERALS.key?(markup)
-        LITERALS[markup]
+      case markup
+      when nil
+        nil
+      when SINGLE_QUOTED_STRING, DOUBLE_QUOTED_STRING
+        Regexp.last_match(1)
+      when INTEGERS_REGEX
+        Regexp.last_match(1).to_i
+      when RANGES_REGEX
+        RangeLookup.parse(Regexp.last_match(1), Regexp.last_match(2))
+      when FLOATS_REGEX
+        Regexp.last_match(1).to_f
       else
-        case markup
-        when /\A'(.*)'\z/m # Single quoted strings
-          $1
-        when /\A"(.*)"\z/m # Double quoted strings
-          $1
-        when /\A(-?\d+)\z/ # Integer and floats
-          $1.to_i
-        when /\A\((\S+)\.\.(\S+)\)\z/ # Ranges
-          RangeLookup.parse($1, $2)
-        when /\A(-?\d[\d\.]+)\z/ # Floats
-          $1.to_f
+        markup = markup.strip
+        if LITERALS.key?(markup)
+          LITERALS[markup]
         else
           VariableLookup.parse(markup)
         end

data/lib/liquid/extensions.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'time'
 require 'date'
 
@@ -7,6 +9,12 @@ class String # :nodoc:
   end
 end
 
+class Symbol # :nodoc:
+  def to_liquid
+    to_s
+  end
+end
+
 class Array # :nodoc:
   def to_liquid
     self

data/lib/liquid/file_system.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Liquid
   # A Liquid file system is a way to let your templates retrieve other templates for use with the include tag.
   #
@@ -44,8 +46,8 @@ module Liquid
   class LocalFileSystem
     attr_accessor :root
 
-    def initialize(root, pattern = "_%s.liquid".freeze)
-      @root = root
+    def initialize(root, pattern = "_%s.liquid")
+      @root    = root
       @pattern = pattern
     end
 
@@ -57,9 +59,9 @@ module Liquid
     end
 
     def full_path(template_path)
-      raise FileSystemError, "Illegal template name '#{template_path}'" unless template_path =~ /\A[^.\/][a-zA-Z0-9_\/]+\z/
+      raise FileSystemError, "Illegal template name '#{template_path}'" unless %r{\A[^./][a-zA-Z0-9_/]+\z}.match?(template_path)
 
-      full_path = if template_path.include?('/'.freeze)
+      full_path = if template_path.include?('/')
         File.join(root, File.dirname(template_path), @pattern % File.basename(template_path))
       else
         File.join(root, @pattern % template_path)

data/lib/liquid/forloop_drop.rb

@@ -1,13 +1,20 @@
+# frozen_string_literal: true
+
 module Liquid
   class ForloopDrop < Drop
     def initialize(name, length, parentloop)
-      @name = name
-      @length = length
+      @name       = name
+      @length     = length
       @parentloop = parentloop
-      @index = 0
+      @index      = 0
     end
 
-    attr_reader :name, :length, :parentloop
+    attr_reader :length, :parentloop
+
+    def name
+      Usage.increment('forloop_drop_name')
+      @name
+    end
 
     def index
       @index + 1

data/lib/liquid/i18n.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'yaml'
 
 module Liquid
@@ -26,13 +28,13 @@ module Liquid
     def interpolate(name, vars)
       name.gsub(/%\{(\w+)\}/) do
         # raise TranslationError, "Undefined key #{$1} for interpolation in translation #{name}"  unless vars[$1.to_sym]
-        "#{vars[$1.to_sym]}"
+        (vars[Regexp.last_match(1).to_sym]).to_s
       end
     end
 
     def deep_fetch_translation(name)
-      name.split('.'.freeze).reduce(locale) do |level, cur|
-        level[cur] or raise TranslationError, "Translation for #{name} does not exist in locale #{path}"
+      name.split('.').reduce(locale) do |level, cur|
+        level[cur] || raise(TranslationError, "Translation for #{name} does not exist in locale #{path}")
       end
     end
   end

data/lib/liquid/interrupts.rb

@@ -1,10 +1,12 @@
+# frozen_string_literal: true
+
 module Liquid
   # An interrupt is any command that breaks processing of a block (ex: a for loop).
   class Interrupt
     attr_reader :message
 
     def initialize(message = nil)
-      @message = message || "interrupt".freeze
+      @message = message || "interrupt"
     end
   end
 

data/lib/liquid/lexer.rb

@@ -1,44 +1,53 @@
+# frozen_string_literal: true
+
 require "strscan"
 module Liquid
   class Lexer
     SPECIALS = {
-      '|'.freeze => :pipe,
-      '.'.freeze => :dot,
-      ':'.freeze => :colon,
-      ','.freeze => :comma,
-      '['.freeze => :open_square,
-      ']'.freeze => :close_square,
-      '('.freeze => :open_round,
-      ')'.freeze => :close_round,
-      '?'.freeze => :question,
-      '-'.freeze => :dash
-    }
-    IDENTIFIER = /[a-zA-Z_][\w-]*\??/
+      '|' => :pipe,
+      '.' => :dot,
+      ':' => :colon,
+      ',' => :comma,
+      '[' => :open_square,
+      ']' => :close_square,
+      '(' => :open_round,
+      ')' => :close_round,
+      '?' => :question,
+      '-' => :dash,
+    }.freeze
+    IDENTIFIER            = /[a-zA-Z_][\w-]*\??/
     SINGLE_STRING_LITERAL = /'[^\']*'/
     DOUBLE_STRING_LITERAL = /"[^\"]*"/
-    NUMBER_LITERAL = /-?\d+(\.\d+)?/
-    DOTDOT = /\.\./
-    COMPARISON_OPERATOR = /==|!=|<>|<=?|>=?|contains/
+    NUMBER_LITERAL        = /-?\d+(\.\d+)?/
+    DOTDOT                = /\.\./
+    COMPARISON_OPERATOR   = /==|!=|<>|<=?|>=?|contains(?=\s)/
+    WHITESPACE_OR_NOTHING = /\s*/
 
     def initialize(input)
-      @ss = StringScanner.new(input.rstrip)
+      @ss = StringScanner.new(input)
     end
 
     def tokenize
       @output = []
 
       until @ss.eos?
-        @ss.skip(/\s*/)
-        tok = case
-        when t = @ss.scan(COMPARISON_OPERATOR) then [:comparison, t]
-        when t = @ss.scan(SINGLE_STRING_LITERAL) then [:string, t]
-        when t = @ss.scan(DOUBLE_STRING_LITERAL) then [:string, t]
-        when t = @ss.scan(NUMBER_LITERAL) then [:number, t]
-        when t = @ss.scan(IDENTIFIER) then [:id, t]
-        when t = @ss.scan(DOTDOT) then [:dotdot, t]
+        @ss.skip(WHITESPACE_OR_NOTHING)
+        break if @ss.eos?
+        tok      = if (t = @ss.scan(COMPARISON_OPERATOR))
+          [:comparison, t]
+        elsif (t = @ss.scan(SINGLE_STRING_LITERAL))
+          [:string, t]
+        elsif (t = @ss.scan(DOUBLE_STRING_LITERAL))
+          [:string, t]
+        elsif (t = @ss.scan(NUMBER_LITERAL))
+          [:number, t]
+        elsif (t = @ss.scan(IDENTIFIER))
+          [:id, t]
+        elsif (t = @ss.scan(DOTDOT))
+          [:dotdot, t]
         else
-          c = @ss.getch
-          if s = SPECIALS[c]
+          c     = @ss.getch
+          if (s = SPECIALS[c])
             [s, c]
           else
             raise SyntaxError, "Unexpected character #{c}"

data/lib/liquid/locales/en.yml

@@ -14,13 +14,15 @@
       if: "Syntax Error in tag 'if' - Valid syntax: if [expression]"
       include: "Error in tag 'include' - Valid syntax: include '[template]' (with|for) [object|collection]"
       unknown_tag: "Unknown tag '%{tag}'"
-      invalid_delimiter: "'end' is not a valid delimiter for %{block_name} tags. use %{block_delimiter}"
+      invalid_delimiter: "'%{tag}' is not a valid delimiter for %{block_name} tags. use %{block_delimiter}"
       unexpected_else: "%{block_name} tag does not expect 'else' tag"
       unexpected_outer_tag: "Unexpected outer '%{tag}' tag"
       tag_termination: "Tag '%{token}' was not properly terminated with regexp: %{tag_end}"
       variable_termination: "Variable '%{token}' was not properly terminated with regexp: %{tag_end}"
       tag_never_closed: "'%{block_name}' tag was never closed"
-      meta_syntax_error: "Liquid syntax error: #{e.message}"
       table_row: "Syntax Error in 'table_row loop' - Valid syntax: table_row [item] in [collection] cols=3"
+      render: "Syntax error in tag 'render' - Template name must be a quoted string"
     argument:
       include: "Argument error in tag 'include' - Illegal template name"
+    disabled:
+      tag: "usage is not allowed in this context"

data/lib/liquid/parse_context.rb

@@ -1,12 +1,17 @@
+# frozen_string_literal: true
+
 module Liquid
   class ParseContext
-    attr_accessor :locale, :line_number, :trim_whitespace
+    attr_accessor :locale, :line_number, :trim_whitespace, :depth
     attr_reader :partial, :warnings, :error_mode
 
     def initialize(options = {})
       @template_options = options ? options.dup : {}
-      @locale = @template_options[:locale] ||= I18n.new
+
+      @locale   = @template_options[:locale] ||= I18n.new
       @warnings = []
+
+      self.depth   = 0
       self.partial = false
     end
 
@@ -14,11 +19,23 @@ module Liquid
       @options[option_key]
     end
 
+    def new_block_body
+      Liquid::BlockBody.new
+    end
+
+    def new_tokenizer(markup, start_line_number: nil, for_liquid_tag: false)
+      Tokenizer.new(markup, line_number: start_line_number, for_liquid_tag: for_liquid_tag)
+    end
+
+    def parse_expression(markup)
+      Expression.parse(markup)
+    end
+
     def partial=(value)
       @partial = value
       @options = value ? partial_options : @template_options
+
       @error_mode = @options[:error_mode] || Template.error_mode
-      value
     end
 
     def partial_options
@@ -27,7 +44,7 @@ module Liquid
         if dont_pass == true
           { locale: locale }
         elsif dont_pass.is_a?(Array)
-          @template_options.reject { |k, v| dont_pass.include?(k) }
+          @template_options.reject { |k, _v| dont_pass.include?(k) }
         else
           @template_options
         end

data/lib/liquid/parse_tree_visitor.rb

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+module Liquid
+  class ParseTreeVisitor
+    def self.for(node, callbacks = Hash.new(proc {}))
+      if defined?(node.class::ParseTreeVisitor)
+        node.class::ParseTreeVisitor
+      else
+        self
+      end.new(node, callbacks)
+    end
+
+    def initialize(node, callbacks)
+      @node      = node
+      @callbacks = callbacks
+    end
+
+    def add_callback_for(*classes, &block)
+      callback = block
+      callback = ->(node, _) { yield node } if block.arity.abs == 1
+      callback = ->(_, _) { yield } if block.arity.zero?
+      classes.each { |klass| @callbacks[klass] = callback }
+      self
+    end
+
+    def visit(context = nil)
+      children.map do |node|
+        item, new_context = @callbacks[node.class].call(node, context)
+        [
+          item,
+          ParseTreeVisitor.for(node, @callbacks).visit(new_context || context),
+        ]
+      end
+    end
+
+    protected
+
+    def children
+      @node.respond_to?(:nodelist) ? Array(@node.nodelist) : []
+    end
+  end
+end