Skip to content

Avoid assigning Liquid context to arbitrary variables - #2137

Open
efegokdemir wants to merge 1 commit into
Shopify:mainfrom
efegokdemir:efe/liquid-context-collision-1930
Open

efegokdemir wants to merge 1 commit into
Shopify:mainfrom
efegokdemir:efe/liquid-context-collision-1930

Conversation

@efegokdemir

Copy link
Copy Markdown

Liquid needs the rendering context before to_liquid for context-aware drops. Assigning it to any object that exposes context= can call an unrelated application setter, such as a read-only Active Record attribute, and make rendering fail. Limit the assignment to Liquid::Drop instances that expose the writer, and add a regression test. Fixes #1930.

rake test passed in lax, strict and strict2 modes: the base suite ran 1,063 tests/2,542 assertions and the integration suite 803/1,917 per mode. RuboCop 1.82.1 with rubocop-shopify 2.18.0 passed all 160 files; git diff --check passed. bundle exec rake was not run because Bundler stalled while fetching the Shopify/liquid-spec Git dependency.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Setting the context of a liquid variable can cause a namespace collision

1 participant