liquid 5.13.0 → 5.14.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 23eed44a196b2949d25540274ac7bf9c721f8f620c55f2e0740ff864dbf83488
-  data.tar.gz: 561903b058863a29e6f8af0ac12fdda0c7941501b617f9445cb1aa5b7160cb97
+  metadata.gz: 160a429434128c743e92aa594ff0c0da4442ff24eaafec960b3d3bc877bd623d
+  data.tar.gz: 86b6682d426999c6f1528c3898671414f0f96ebf955498535e30171c639e380f
 SHA512:
-  metadata.gz: b085504dfad17c6a0de0c152f5500eb6fe27efc588fad25b4e7ed40a3c4287642b92fb5e83f912c54534541d15e218d8721b7245d2819432d8b00f81d801a337
-  data.tar.gz: 5d8fec9349651ea1fc4799604c3bbceae5373f9dab9c161029496479bc23f2d3450dab4ac0e36842ced63b1e92ee2d659d7ea937b8ee6edfc2efa5b51da23758
+  metadata.gz: 8f9fb1adebc5974b7f4e0eca38947335b359cb30fc6c6ae4058516573d760695c5ab8ef2cbf1f4cc2226d23d8a27126faf407b5da7ccc244a0b976491f0a3328
+  data.tar.gz: d7d200ba0a5b62d4e86bcf197f7f7a06ed2b448c25e73e196787164892b517b24d3fc4fa3f6296d03945f06755d8004590b8dc1bd0df13743ba4f8ba805e2939

data/History.md

@@ -1,5 +1,9 @@
 # Liquid Change Log
 
+## 5.14.0
+
+* Avoid materializing integer ranges in `for` and `tablerow` loops, and account for each visited range item [Ian Ker-Seymer]
+
 ## 5.13.0
 
 * Add TruffleRuby in CI [Benoit Daloze]

data/README.md

@@ -149,6 +149,13 @@ template.render!({ 'x' => 1}, { strict_variables: true })
 #=> Liquid::UndefinedVariable: Liquid error: undefined variable y
 ```
 
+### Resource limits
+
+`render_score_limit` and `cumulative_render_score_limit` account for each item visited by
+integer-range `for` and `tablerow` loops, including loops with empty bodies. This bounds range
+iteration work when a score limit is configured; `render_length_limit` only bounds generated
+output and does not by itself limit CPU work for output-free loops.
+
 ### Usage tracking
 
 To help track usages of a feature or code path in production, we have released opt-in usage tracking. To enable this, we provide an empty `Liquid:: Usage.increment` method which you can customize to your needs. The feature is well suited to https://github.com/Shopify/statsd-instrument. However, the choice of implementation is up to you.

data/lib/liquid/block_body.rb

@@ -99,7 +99,9 @@ module Liquid
         context.handle_error(exc, line_number)
       else
         error_message = context.handle_error(exc, line_number)
-        unless blank_tag # conditional for backwards compatibility
+        error_mode = context.registers.static[:template_error_mode]
+        suppress_error_text = blank_tag && error_mode != :strict2 && error_mode != :rigid
+        unless suppress_error_text # blank-tag suppression is kept for backwards compatibility outside strict2
           output << error_message
         end
       end

data/lib/liquid/range_slice.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+module Liquid
+  class RangeSlice
+    attr_reader :length
+
+    def initialize(range, from, to, resource_limits)
+      range_length = range.end - range.begin
+      range_length += 1 unless range.exclude_end?
+      range_length = 0 if range_length.negative?
+
+      start = [from, 0].max
+      finish = [to || range_length, range_length].min
+
+      @first = range.begin + start
+      @length = [finish - start, 0].max
+      @direction = 1
+      @resource_limits = resource_limits
+    end
+
+    def empty?
+      @length.zero?
+    end
+
+    def each
+      return enum_for(:each) unless block_given?
+
+      value = @first
+      @length.times do
+        @resource_limits.increment_render_score(1)
+        yield value
+        value += @direction
+      end
+    end
+
+    def reverse!
+      unless empty?
+        @first += @direction * (@length - 1)
+        @direction = -@direction
+      end
+      self
+    end
+  end
+end

data/lib/liquid/tags/for.rb

@@ -130,7 +130,6 @@ module Liquid
       end
 
       collection = context.evaluate(@collection_name)
-      collection = collection.to_a if collection.is_a?(Range)
 
       limit_value = context.evaluate(@limit)
       to = if limit_value.nil?
@@ -139,7 +138,9 @@ module Liquid
         Utils.to_integer(limit_value) + from
       end
 
-      segment = Utils.slice_collection(collection, from, to)
+      segment = Utils.slice_collection_for_iteration(
+        collection, from, to, context.resource_limits, use_range_to_a: true
+      )
       segment.reverse! if @reversed
 
       offsets[@name] = from + segment.length

data/lib/liquid/tags/table_row.rb

@@ -85,12 +85,13 @@ module Liquid
       from = @attributes.key?('offset') ? to_integer(context.evaluate(@attributes['offset'])) : 0
       to = @attributes.key?('limit') ? from + to_integer(context.evaluate(@attributes['limit'])) : nil
 
-      collection = Utils.slice_collection(collection, from, to)
+      collection = Utils.slice_collection_for_iteration(collection, from, to, context.resource_limits, allow_endless: true)
       length     = collection.length
 
       cols = @attributes.key?('cols') ? to_integer(context.evaluate(@attributes['cols'])) : length
 
       output << "<tr class=\"row1\">\n"
+      context.resource_limits.increment_write_score(output)
       context.stack do
         tablerowloop = Liquid::TablerowloopDrop.new(length, cols)
         context['tablerowloop'] = tablerowloop
@@ -101,6 +102,7 @@ module Liquid
           output << "<td class=\"col#{tablerowloop.col}\">"
           super
           output << '</td>'
+          context.resource_limits.increment_write_score(output)
 
           # Handle any interrupts if they exist.
           if context.interrupt?
@@ -110,6 +112,7 @@ module Liquid
 
           if tablerowloop.col_last && !tablerowloop.last
             output << "</tr>\n<tr class=\"row#{tablerowloop.row + 1}\">"
+            context.resource_limits.increment_write_score(output)
           end
 
           tablerowloop.send(:increment!)
@@ -117,6 +120,7 @@ module Liquid
       end
 
       output << "</tr>\n"
+      context.resource_limits.increment_write_score(output)
       output
     end
 

data/lib/liquid/template.rb

@@ -189,12 +189,20 @@ module Liquid
 
       context.template_name ||= name
 
+      previous_error_mode = context.registers.static[:template_error_mode]
+      context.registers.static[:template_error_mode] = @error_mode
+
       begin
         # render the nodelist.
         @root.render_to_output_buffer(context, output || +'')
       rescue Liquid::MemoryError => e
         context.handle_error(e)
       ensure
+        if previous_error_mode
+          context.registers.static[:template_error_mode] = previous_error_mode
+        else
+          context.registers.static.delete(:template_error_mode)
+        end
         @errors = context.errors
       end
     end
@@ -226,6 +234,7 @@ module Liquid
       end
 
       @warnings = parse_context.warnings
+      @error_mode = parse_context.error_mode
       parse_context
     end
 

data/lib/liquid/utils.rb

@@ -13,6 +13,26 @@ module Liquid
       end
     end
 
+    # This is intentionally separate from slice_collection, whose Array-returning
+    # behavior is used outside of the iteration tags.
+    def self.slice_collection_for_iteration(
+      collection, from, to, resource_limits, allow_endless: false, use_range_to_a: false
+    )
+      if integer_range?(collection)
+        RangeSlice.new(collection, from, to, resource_limits)
+      elsif collection.is_a?(Range)
+        if use_range_to_a && range_method_overridden?(collection, :to_a)
+          # For historically honored custom Range#to_a. Charge the resulting
+          # selection before buffering it, just as for a custom #each.
+          slice_collection_for_iteration_using_each(collection.to_a, from, to, resource_limits)
+        else
+          slice_range_using_each(collection, from, to, resource_limits, allow_endless: allow_endless)
+        end
+      else
+        slice_collection(collection, from, to)
+      end
+    end
+
     def self.slice_collection_using_each(collection, from, to)
       segments = []
       index    = 0
@@ -38,6 +58,55 @@ module Liquid
       segments
     end
 
+    # Arithmetic slicing must not bypass a Range subclass's custom #each.
+    def self.integer_range?(collection)
+      collection.instance_of?(Range) && collection.begin.is_a?(Integer) && collection.end.is_a?(Integer)
+    end
+    private_class_method :integer_range?
+
+    # Preserve support for Ruby-supplied string ranges and custom Range#each.
+    # Their selected length cannot be inferred from integer bounds, but the tags
+    # need it before rendering for loop metadata, continuation offsets, and columns.
+    # Buffer the selection so we do not have to replay a potentially custom iterator.
+    def self.slice_range_using_each(collection, from, to, resource_limits, allow_endless:)
+      # TableRow historically accepted an endless subclass when its custom #each
+      # was finite, while For historically raised through Range#to_a.
+      if collection.end.nil? && !(allow_endless && (!to.nil? || range_method_overridden?(collection, :each)))
+        raise RangeError, "cannot convert endless range to an array"
+      end
+      if collection.begin.nil? && !range_method_overridden?(collection, :each)
+        raise TypeError, "can't iterate from NilClass"
+      end
+
+      slice_collection_for_iteration_using_each(collection, from, to, resource_limits)
+    end
+    private_class_method :slice_range_using_each
+
+    # Custom Range#each can make a nominally beginless range finite; standard
+    # beginless ranges were rejected before reaching this budgeted traversal.
+    def self.slice_collection_for_iteration_using_each(collection, from, to, resource_limits)
+      return [] if to && to <= from
+
+      segments = []
+      index = 0
+      collection.each do |item|
+        break if to && to <= index
+
+        # Charge preparation, including skipped offsets, before buffering; checking
+        # only while rendering the buffered values would leave this work unbudgeted.
+        resource_limits.increment_render_score(1)
+        segments << item if from <= index
+        index += 1
+      end
+      segments
+    end
+    private_class_method :slice_collection_for_iteration_using_each
+
+    def self.range_method_overridden?(collection, method_name)
+      collection.method(method_name).owner != Range.instance_method(method_name).owner
+    end
+    private_class_method :range_method_overridden?
+
     def self.to_integer(num)
       return num if num.is_a?(Integer)
       num = num.to_s

data/lib/liquid/version.rb

@@ -2,5 +2,5 @@
 # frozen_string_literal: true
 
 module Liquid
-  VERSION = "5.13.0"
+  VERSION = "5.14.0"
 end

data/lib/liquid.rb

@@ -83,6 +83,7 @@ require 'liquid/resource_limits'
 require 'liquid/expression'
 require 'liquid/template'
 require 'liquid/condition'
+require 'liquid/range_slice'
 require 'liquid/utils'
 require 'liquid/tokenizer'
 require 'liquid/parse_context'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: liquid
 version: !ruby/object:Gem::Version
-  version: 5.13.0
+  version: 5.14.0
 platform: ruby
 authors:
 - Tobias Lütke
@@ -103,6 +103,7 @@ files:
 - lib/liquid/profiler.rb
 - lib/liquid/profiler/hooks.rb
 - lib/liquid/range_lookup.rb
+- lib/liquid/range_slice.rb
 - lib/liquid/registers.rb
 - lib/liquid/resource_limits.rb
 - lib/liquid/self_drop.rb
@@ -160,7 +161,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 1.3.7
 requirements: []
-rubygems_version: 4.0.14
+rubygems_version: 4.0.21
 specification_version: 4
 summary: A secure, non-evaling end user template engine with aesthetic markup.
 test_files: []