liquid 4.0.0 → 5.10.0

data/lib/liquid/expression.rb

@@ -1,43 +1,126 @@
+# frozen_string_literal: true
+
 module Liquid
   class Expression
-    class MethodLiteral
-      attr_reader :method_name, :to_s
+    LITERALS = {
+      nil => nil,
+      'nil' => nil,
+      'null' => nil,
+      '' => nil,
+      'true' => true,
+      'false' => false,
+      'blank' => '',
+      'empty' => '',
+      # in lax mode, minus sign can be a VariableLookup
+      # For simplicity and performace, we treat it like a literal
+      '-' => VariableLookup.parse("-", nil).freeze,
+    }.freeze
+
+    DOT = ".".ord
+    ZERO = "0".ord
+    NINE = "9".ord
+    DASH = "-".ord
+
+    # Use an atomic group (?>...) to avoid pathological backtracing from
+    # malicious input as described in https://github.com/Shopify/liquid/issues/1357
+    RANGES_REGEX = /\A\(\s*(?>(\S+)\s*\.\.)\s*(\S+)\s*\)\z/
+    INTEGER_REGEX = /\A(-?\d+)\z/
+    FLOAT_REGEX = /\A(-?\d+)\.\d+\z/
 
-      def initialize(method_name, to_s)
-        @method_name = method_name
-        @to_s = to_s
+    class << self
+      def safe_parse(parser, ss = StringScanner.new(""), cache = nil)
+        parse(parser.expression, ss, cache)
       end
 
-      def to_liquid
-        to_s
+      def parse(markup, ss = StringScanner.new(""), cache = nil)
+        return unless markup
+
+        markup = markup.strip # markup can be a frozen string
+
+        if (markup.start_with?('"') && markup.end_with?('"')) ||
+          (markup.start_with?("'") && markup.end_with?("'"))
+          return markup[1..-2]
+        elsif LITERALS.key?(markup)
+          return LITERALS[markup]
+        end
+
+        # Cache only exists during parsing
+        if cache
+          return cache[markup] if cache.key?(markup)
+
+          cache[markup] = inner_parse(markup, ss, cache).freeze
+        else
+          inner_parse(markup, ss, nil).freeze
+        end
       end
-    end
 
-    LITERALS = {
-      nil => nil, 'nil'.freeze => nil, 'null'.freeze => nil, ''.freeze => nil,
-      'true'.freeze  => true,
-      'false'.freeze => false,
-      'blank'.freeze => MethodLiteral.new(:blank?, '').freeze,
-      'empty'.freeze => MethodLiteral.new(:empty?, '').freeze
-    }
-
-    def self.parse(markup)
-      if LITERALS.key?(markup)
-        LITERALS[markup]
-      else
+      def inner_parse(markup, ss, cache)
+        if (markup.start_with?("(") && markup.end_with?(")")) && markup =~ RANGES_REGEX
+          return RangeLookup.parse(
+            Regexp.last_match(1),
+            Regexp.last_match(2),
+            ss,
+            cache,
+          )
+        end
+
+        if (num = parse_number(markup, ss))
+          num
+        else
+          VariableLookup.parse(markup, ss, cache)
+        end
+      end
+
+      def parse_number(markup, ss)
+        # check if the markup is simple integer or float
         case markup
-        when /\A'(.*)'\z/m # Single quoted strings
-          $1
-        when /\A"(.*)"\z/m # Double quoted strings
-          $1
-        when /\A(-?\d+)\z/ # Integer and floats
-          $1.to_i
-        when /\A\((\S+)\.\.(\S+)\)\z/ # Ranges
-          RangeLookup.parse($1, $2)
-        when /\A(-?\d[\d\.]+)\z/ # Floats
-          $1.to_f
+        when INTEGER_REGEX
+          return Integer(markup, 10)
+        when FLOAT_REGEX
+          return markup.to_f
+        end
+
+        ss.string = markup
+        # the first byte must be a digit or  a dash
+        byte = ss.scan_byte
+
+        return false if byte != DASH && (byte < ZERO || byte > NINE)
+
+        if byte == DASH
+          peek_byte = ss.peek_byte
+
+          # if it starts with a dash, the next byte must be a digit
+          return false if peek_byte.nil? || !(peek_byte >= ZERO && peek_byte <= NINE)
+        end
+
+        # The markup could be a float with multiple dots
+        first_dot_pos = nil
+        num_end_pos = nil
+
+        while (byte = ss.scan_byte)
+          return false if byte != DOT && (byte < ZERO || byte > NINE)
+
+          # we found our number and now we are just scanning the rest of the string
+          next if num_end_pos
+
+          if byte == DOT
+            if first_dot_pos.nil?
+              first_dot_pos = ss.pos
+            else
+              # we found another dot, so we know that the number ends here
+              num_end_pos = ss.pos - 1
+            end
+          end
+        end
+
+        num_end_pos = markup.length if ss.eos?
+
+        if num_end_pos
+          # number ends with a number "123.123"
+          markup.byteslice(0, num_end_pos).to_f
         else
-          VariableLookup.parse(markup)
+          # number ends with a dot "123."
+          markup.byteslice(0, first_dot_pos).to_f
         end
       end
     end

data/lib/liquid/extensions.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'time'
 require 'date'
 
@@ -7,6 +9,12 @@ class String # :nodoc:
   end
 end
 
+class Symbol # :nodoc:
+  def to_liquid
+    to_s
+  end
+end
+
 class Array # :nodoc:
   def to_liquid
     self

data/lib/liquid/file_system.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Liquid
   # A Liquid file system is a way to let your templates retrieve other templates for use with the include tag.
   #
@@ -44,8 +46,8 @@ module Liquid
   class LocalFileSystem
     attr_accessor :root
 
-    def initialize(root, pattern = "_%s.liquid".freeze)
-      @root = root
+    def initialize(root, pattern = "_%s.liquid")
+      @root    = root
       @pattern = pattern
     end
 
@@ -57,9 +59,9 @@ module Liquid
     end
 
     def full_path(template_path)
-      raise FileSystemError, "Illegal template name '#{template_path}'" unless template_path =~ /\A[^.\/][a-zA-Z0-9_\/]+\z/
+      raise FileSystemError, "Illegal template name '#{template_path}'" unless %r{\A[^./][a-zA-Z0-9_/]+\z}.match?(template_path)
 
-      full_path = if template_path.include?('/'.freeze)
+      full_path = if template_path.include?('/')
         File.join(root, File.dirname(template_path), @pattern % File.basename(template_path))
       else
         File.join(root, @pattern % template_path)

data/lib/liquid/forloop_drop.rb

@@ -1,34 +1,81 @@
+# frozen_string_literal: true
+
 module Liquid
+  # @liquid_public_docs
+  # @liquid_type object
+  # @liquid_name forloop
+  # @liquid_summary
+  #   Information about a parent [`for` loop](/docs/api/liquid/tags/for).
   class ForloopDrop < Drop
     def initialize(name, length, parentloop)
-      @name = name
-      @length = length
+      @name       = name
+      @length     = length
       @parentloop = parentloop
-      @index = 0
+      @index      = 0
     end
 
-    attr_reader :name, :length, :parentloop
+    # @liquid_public_docs
+    # @liquid_name length
+    # @liquid_summary
+    #   The total number of iterations in the loop.
+    # @liquid_return [number]
+    attr_reader :length
+
+    # @liquid_public_docs
+    # @liquid_name parentloop
+    # @liquid_summary
+    #   The parent `forloop` object.
+    # @liquid_description
+    #   If the current `for` loop isn't nested inside another `for` loop, then `nil` is returned.
+    # @liquid_return [forloop]
+    attr_reader :parentloop
+
+    attr_reader :name
 
+    # @liquid_public_docs
+    # @liquid_summary
+    #   The 1-based index of the current iteration.
+    # @liquid_return [number]
     def index
       @index + 1
     end
 
+    # @liquid_public_docs
+    # @liquid_summary
+    #   The 0-based index of the current iteration.
+    # @liquid_return [number]
     def index0
       @index
     end
 
+    # @liquid_public_docs
+    # @liquid_summary
+    #   The 1-based index of the current iteration, in reverse order.
+    # @liquid_return [number]
     def rindex
       @length - @index
     end
 
+    # @liquid_public_docs
+    # @liquid_summary
+    #   The 0-based index of the current iteration, in reverse order.
+    # @liquid_return [number]
     def rindex0
       @length - @index - 1
     end
 
+    # @liquid_public_docs
+    # @liquid_summary
+    #   Returns `true` if the current iteration is the first. Returns `false` if not.
+    # @liquid_return [boolean]
     def first
       @index == 0
     end
 
+    # @liquid_public_docs
+    # @liquid_summary
+    #   Returns `true` if the current iteration is the last. Returns `false` if not.
+    # @liquid_return [boolean]
     def last
       @index == @length - 1
     end

data/lib/liquid/i18n.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'yaml'
 
 module Liquid
@@ -26,13 +28,13 @@ module Liquid
     def interpolate(name, vars)
       name.gsub(/%\{(\w+)\}/) do
         # raise TranslationError, "Undefined key #{$1} for interpolation in translation #{name}"  unless vars[$1.to_sym]
-        "#{vars[$1.to_sym]}"
+        (vars[Regexp.last_match(1).to_sym]).to_s
       end
     end
 
     def deep_fetch_translation(name)
-      name.split('.'.freeze).reduce(locale) do |level, cur|
-        level[cur] or raise TranslationError, "Translation for #{name} does not exist in locale #{path}"
+      name.split('.').reduce(locale) do |level, cur|
+        level[cur] || raise(TranslationError, "Translation for #{name} does not exist in locale #{path}")
       end
     end
   end

data/lib/liquid/interrupts.rb

@@ -1,10 +1,12 @@
+# frozen_string_literal: true
+
 module Liquid
   # An interrupt is any command that breaks processing of a block (ex: a for loop).
   class Interrupt
     attr_reader :message
 
     def initialize(message = nil)
-      @message = message || "interrupt".freeze
+      @message = message || "interrupt"
     end
   end
 

data/lib/liquid/lexer.rb

@@ -1,53 +1,179 @@
-require "strscan"
+# frozen_string_literal: true
+
 module Liquid
   class Lexer
-    SPECIALS = {
-      '|'.freeze => :pipe,
-      '.'.freeze => :dot,
-      ':'.freeze => :colon,
-      ','.freeze => :comma,
-      '['.freeze => :open_square,
-      ']'.freeze => :close_square,
-      '('.freeze => :open_round,
-      ')'.freeze => :close_round,
-      '?'.freeze => :question,
-      '-'.freeze => :dash
-    }
-    IDENTIFIER = /[a-zA-Z_][\w-]*\??/
-    SINGLE_STRING_LITERAL = /'[^\']*'/
+    CLOSE_ROUND = [:close_round, ")"].freeze
+    CLOSE_SQUARE = [:close_square, "]"].freeze
+    COLON = [:colon, ":"].freeze
+    COMMA = [:comma, ","].freeze
+    COMPARISION_NOT_EQUAL = [:comparison, "!="].freeze
+    COMPARISON_CONTAINS = [:comparison, "contains"].freeze
+    COMPARISON_EQUAL = [:comparison, "=="].freeze
+    COMPARISON_GREATER_THAN = [:comparison, ">"].freeze
+    COMPARISON_GREATER_THAN_OR_EQUAL = [:comparison, ">="].freeze
+    COMPARISON_LESS_THAN = [:comparison, "<"].freeze
+    COMPARISON_LESS_THAN_OR_EQUAL = [:comparison, "<="].freeze
+    COMPARISON_NOT_EQUAL_ALT = [:comparison, "<>"].freeze
+    DASH = [:dash, "-"].freeze
+    DOT = [:dot, "."].freeze
+    DOTDOT = [:dotdot, ".."].freeze
+    DOT_ORD = ".".ord
     DOUBLE_STRING_LITERAL = /"[^\"]*"/
-    NUMBER_LITERAL = /-?\d+(\.\d+)?/
-    DOTDOT = /\.\./
-    COMPARISON_OPERATOR = /==|!=|<>|<=?|>=?|contains/
+    EOS = [:end_of_string].freeze
+    IDENTIFIER            = /[a-zA-Z_][\w-]*\??/
+    NUMBER_LITERAL        = /-?\d+(\.\d+)?/
+    OPEN_ROUND = [:open_round, "("].freeze
+    OPEN_SQUARE = [:open_square, "["].freeze
+    PIPE = [:pipe, "|"].freeze
+    QUESTION = [:question, "?"].freeze
+    RUBY_WHITESPACE = [" ", "\t", "\r", "\n", "\f"].freeze
+    SINGLE_STRING_LITERAL = /'[^\']*'/
+    WHITESPACE_OR_NOTHING = /\s*/
 
-    def initialize(input)
-      @ss = StringScanner.new(input.rstrip)
+    SINGLE_COMPARISON_TOKENS = [].tap do |table|
+      table["<".ord] = COMPARISON_LESS_THAN
+      table[">".ord] = COMPARISON_GREATER_THAN
+      table.freeze
     end
 
-    def tokenize
-      @output = []
-
-      until @ss.eos?
-        @ss.skip(/\s*/)
-        tok = case
-        when t = @ss.scan(COMPARISON_OPERATOR) then [:comparison, t]
-        when t = @ss.scan(SINGLE_STRING_LITERAL) then [:string, t]
-        when t = @ss.scan(DOUBLE_STRING_LITERAL) then [:string, t]
-        when t = @ss.scan(NUMBER_LITERAL) then [:number, t]
-        when t = @ss.scan(IDENTIFIER) then [:id, t]
-        when t = @ss.scan(DOTDOT) then [:dotdot, t]
-        else
-          c = @ss.getch
-          if s = SPECIALS[c]
-            [s, c]
+    TWO_CHARS_COMPARISON_JUMP_TABLE = [].tap do |table|
+      table["=".ord] = [].tap do |sub_table|
+        sub_table["=".ord] = COMPARISON_EQUAL
+        sub_table.freeze
+      end
+      table["!".ord] = [].tap do |sub_table|
+        sub_table["=".ord] = COMPARISION_NOT_EQUAL
+        sub_table.freeze
+      end
+      table.freeze
+    end
+
+    COMPARISON_JUMP_TABLE = [].tap do |table|
+      table["<".ord] = [].tap do |sub_table|
+        sub_table["=".ord] = COMPARISON_LESS_THAN_OR_EQUAL
+        sub_table[">".ord] = COMPARISON_NOT_EQUAL_ALT
+        sub_table.freeze
+      end
+      table[">".ord] = [].tap do |sub_table|
+        sub_table["=".ord] = COMPARISON_GREATER_THAN_OR_EQUAL
+        sub_table.freeze
+      end
+      table.freeze
+    end
+
+    NEXT_MATCHER_JUMP_TABLE = [].tap do |table|
+      "a".upto("z") do |c|
+        table[c.ord] = [:id, IDENTIFIER].freeze
+        table[c.upcase.ord] = [:id, IDENTIFIER].freeze
+      end
+      table["_".ord] = [:id, IDENTIFIER].freeze
+
+      "0".upto("9") do |c|
+        table[c.ord] = [:number, NUMBER_LITERAL].freeze
+      end
+      table["-".ord] = [:number, NUMBER_LITERAL].freeze
+
+      table["'".ord] = [:string, SINGLE_STRING_LITERAL].freeze
+      table["\"".ord] = [:string, DOUBLE_STRING_LITERAL].freeze
+      table.freeze
+    end
+
+    SPECIAL_TABLE = [].tap do |table|
+      table["|".ord] = PIPE
+      table[".".ord] = DOT
+      table[":".ord] = COLON
+      table[",".ord] = COMMA
+      table["[".ord] = OPEN_SQUARE
+      table["]".ord] = CLOSE_SQUARE
+      table["(".ord] = OPEN_ROUND
+      table[")".ord] = CLOSE_ROUND
+      table["?".ord] = QUESTION
+      table["-".ord] = DASH
+    end
+
+    NUMBER_TABLE = [].tap do |table|
+      "0".upto("9") do |c|
+        table[c.ord] = true
+      end
+      table.freeze
+    end
+
+    # rubocop:disable Metrics/BlockNesting
+    class << self
+      def tokenize(ss)
+        output = []
+
+        until ss.eos?
+          ss.skip(WHITESPACE_OR_NOTHING)
+
+          break if ss.eos?
+
+          start_pos = ss.pos
+          peeked = ss.peek_byte
+
+          if (special = SPECIAL_TABLE[peeked])
+            ss.scan_byte
+            # Special case for ".."
+            if special == DOT && ss.peek_byte == DOT_ORD
+              ss.scan_byte
+              output << DOTDOT
+            elsif special == DASH
+              # Special case for negative numbers
+              if (peeked_byte = ss.peek_byte) && NUMBER_TABLE[peeked_byte]
+                ss.pos -= 1
+                output << [:number, ss.scan(NUMBER_LITERAL)]
+              else
+                output << special
+              end
+            else
+              output << special
+            end
+          elsif (sub_table = TWO_CHARS_COMPARISON_JUMP_TABLE[peeked])
+            ss.scan_byte
+            if (peeked_byte = ss.peek_byte) && (found = sub_table[peeked_byte])
+              output << found
+              ss.scan_byte
+            else
+              raise_syntax_error(start_pos, ss)
+            end
+          elsif (sub_table = COMPARISON_JUMP_TABLE[peeked])
+            ss.scan_byte
+            if (peeked_byte = ss.peek_byte) && (found = sub_table[peeked_byte])
+              output << found
+              ss.scan_byte
+            else
+              output << SINGLE_COMPARISON_TOKENS[peeked]
+            end
           else
-            raise SyntaxError, "Unexpected character #{c}"
+            type, pattern = NEXT_MATCHER_JUMP_TABLE[peeked]
+
+            if type && (t = ss.scan(pattern))
+              # Special case for "contains"
+              output << if type == :id && t == "contains" && output.last&.first != :dot
+                COMPARISON_CONTAINS
+              else
+                [type, t]
+              end
+            else
+              raise_syntax_error(start_pos, ss)
+            end
           end
         end
-        @output << tok
+        # rubocop:enable Metrics/BlockNesting
+        output << EOS
+      rescue ::ArgumentError => e
+        if e.message == "invalid byte sequence in #{ss.string.encoding}"
+          raise SyntaxError, "Invalid byte sequence in #{ss.string.encoding}"
+        else
+          raise
+        end
       end
 
-      @output << [:end_of_string]
+      def raise_syntax_error(start_pos, ss)
+        ss.pos = start_pos
+        # the character could be a UTF-8 character, use getch to get all the bytes
+        raise SyntaxError, "Unexpected character #{ss.getch}"
+      end
     end
   end
 end

data/lib/liquid/locales/en.yml

@@ -2,25 +2,35 @@
   errors:
     syntax:
       tag_unexpected_args: "Syntax Error in '%{tag}' - Valid syntax: %{tag}"
+      block_tag_unexpected_args: "Syntax Error in '%{tag}' - Valid syntax: {% %{tag} %}{% end%{tag} %}"
       assign: "Syntax Error in 'assign' - Valid syntax: assign [var] = [source]"
       capture: "Syntax Error in 'capture' - Valid syntax: capture [var]"
+      snippet: "Syntax Error in 'snippet' - Valid syntax: snippet [var]"
       case: "Syntax Error in 'case' - Valid syntax: case [condition]"
       case_invalid_when: "Syntax Error in tag 'case' - Valid when condition: {% when [condition] [or condition2...] %}"
       case_invalid_else: "Syntax Error in tag 'case' - Valid else condition: {% else %} (no parameters) "
       cycle: "Syntax Error in 'cycle' - Valid syntax: cycle [name :] var [, var2, var3 ...]"
+      doc_invalid_nested: "Syntax Error in 'doc' - Nested doc tags are not allowed"
       for: "Syntax Error in 'for loop' - Valid syntax: for [item] in [collection]"
       for_invalid_in: "For loops require an 'in' clause"
       for_invalid_attribute: "Invalid attribute in for loop. Valid attributes are limit and offset"
       if: "Syntax Error in tag 'if' - Valid syntax: if [expression]"
       include: "Error in tag 'include' - Valid syntax: include '[template]' (with|for) [object|collection]"
-      unknown_tag: "Unknown tag '%{tag}'"
-      invalid_delimiter: "'end' is not a valid delimiter for %{block_name} tags. use %{block_delimiter}"
+      inline_comment_invalid: "Syntax error in tag '#' - Each line of comments must be prefixed by the '#' character"
+      invalid_delimiter: "'%{tag}' is not a valid delimiter for %{block_name} tags. use %{block_delimiter}"
+      invalid_template_encoding: "Invalid template encoding"
+      render: "Syntax error in tag 'render' - Template name must be a quoted string"
+      render_invalid_template_name: "Syntax error in tag 'render' - Expected a string or identifier, found %{found}"
+      table_row: "Syntax Error in 'table_row loop' - Valid syntax: table_row [item] in [collection] cols=3"
+      table_row_invalid_attribute: "Invalid attribute '%{attribute}' in tablerow loop. Valid attributes are cols, limit, offset, and range"
+      tag_never_closed: "'%{block_name}' tag was never closed"
+      tag_termination: "Tag '%{token}' was not properly terminated with regexp: %{tag_end}"
       unexpected_else: "%{block_name} tag does not expect 'else' tag"
       unexpected_outer_tag: "Unexpected outer '%{tag}' tag"
-      tag_termination: "Tag '%{token}' was not properly terminated with regexp: %{tag_end}"
+      unknown_tag: "Unknown tag '%{tag}'"
       variable_termination: "Variable '%{token}' was not properly terminated with regexp: %{tag_end}"
-      tag_never_closed: "'%{block_name}' tag was never closed"
-      meta_syntax_error: "Liquid syntax error: #{e.message}"
-      table_row: "Syntax Error in 'table_row loop' - Valid syntax: table_row [item] in [collection] cols=3"
     argument:
       include: "Argument error in tag 'include' - Illegal template name"
+      render: "Argument error in tag 'render' - Dynamically chosen templates are not allowed"
+    disabled:
+      tag: "usage is not allowed in this context"