Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix tags in comment #1345

Merged
merged 1 commit into from Nov 1, 2022
+12 −2
Merged

Fix tags in comment #1345

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
12 changes: 10 additions & 2 deletions lib/liquid/block_body.rb
View file
Open in desktop
Expand Up @@ -109,14 +109,22 @@ def self.rescue_render_node(context, output, line_number, exc, blank_tag)
end
end

private def parse_for_document(tokenizer, parse_context)
private def handle_invalid_tag_token(token, parse_context)
if token.end_with?('%}')
yield token, token
else
BlockBody.raise_missing_tag_terminator(token, parse_context)
end
end

private def parse_for_document(tokenizer, parse_context, &block)
while (token = tokenizer.shift)
next if token.empty?
case
when token.start_with?(TAGSTART)
whitespace_handler(token, parse_context)
unless token =~ FullToken
BlockBody.raise_missing_tag_terminator(token, parse_context)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

liquid-c still calls this if the invalid tag token isn't terminated with %}.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That is true. Should we just change liquid-c to be consistent with liquid (and call BlockBody.raise_missing_tag_terminator instead of yield)? Should we also change how comments are handled because I think everything inside a comment block should be escaped?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This doesn't have to be one or the other. We can just check for if token.end_with?('%}') to only call BlockBody.raise_missing_tag_terminator only if the tag terminator is actually missing, which avoids breaking backwards compatibility with liquid templates and provides the more appropriate error message.

Should we also change how comments are handled because I think everything inside a comment block should be escaped?

We have explicitly allowed tags with an invalid tag name (#256) so it seems very likely that this is relied upon.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

But the problem is that for a tag that looks like {% comment %}{% " %}{% endcomment %} is not matched on FullToken (and token.end_with?('%}') is true for {% " %}) in liquid so BlockBody.raise_missing_tag_terminator is called. But in liquid-c, it's yielded back to the caller (from the part you linked in the comment above).

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Exactly, so you want to fix that problem, but not introduce another inconsistency when the tag terminator is actually missing. That's why I am recommending adding an if token.end_with?('%}') conditional here.

For example, Liquid::Template.parse('{% foo') should result in the syntax error Liquid syntax error: Tag '{%' was not properly terminated with regexp: /\%\}/ and not Liquid syntax error: Unknown tag '{%' as the current change would change it to without liquid-c. We could also use a test for the error messages for in this case, rather than just asserting that it results in a syntax error.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

An I see, that makes sense. Thanks for clarifying!

return handle_invalid_tag_token(token, parse_context, &block)
end
tag_name = Regexp.last_match(2)
markup = Regexp.last_match(4)
Expand Down
2 changes: 2 additions & 0 deletions test/integration/tags/standard_tag_test.rb
View file
Open in desktop
Expand Up @@ -36,6 +36,8 @@ def test_has_a_block_which_does_nothing
assert_template_result('', '{%comment%}{% endif %}{%endcomment%}')
assert_template_result('', '{% comment %}{% endwhatever %}{% endcomment %}')
assert_template_result('', '{% comment %}{% raw %} {{%%%%}} }} { {% endcomment %} {% comment {% endraw %} {% endcomment %}')
assert_template_result('', '{% comment %}{% " %}{% endcomment %}')
assert_template_result('', '{% comment %}{%%}{% endcomment %}')

assert_template_result('foobar', 'foo{%comment%}comment{%endcomment%}bar')
assert_template_result('foobar', 'foo{% comment %}comment{% endcomment %}bar')
Expand Down