lib/liquid/expression.rb in liquid-5.1.0 vs lib/liquid/expression.rb in liquid-5.2.0

- old
+ new

@@ -8,32 +8,33 @@ 'false' => false, 'blank' => '', 'empty' => '' }.freeze - SINGLE_QUOTED_STRING = /\A\s*'(.*)'\s*\z/m - DOUBLE_QUOTED_STRING = /\A\s*"(.*)"\s*\z/m - INTEGERS_REGEX = /\A\s*(-?\d+)\s*\z/ - FLOATS_REGEX = /\A\s*(-?\d[\d\.]+)\s*\z/ + INTEGERS_REGEX = /\A(-?\d+)\z/ + FLOATS_REGEX = /\A(-?\d[\d\.]+)\z/ # Use an atomic group (?>...) to avoid pathological backtracing from # malicious input as described in https://github.com/Shopify/liquid/issues/1357 - RANGES_REGEX = /\A\s*\(\s*(?>(\S+)\s*\.\.)\s*(\S+)\s*\)\s*\z/ + RANGES_REGEX = /\A\(\s*(?>(\S+)\s*\.\.)\s*(\S+)\s*\)\z/ def self.parse(markup) + return nil unless markup + + markup = markup.strip + if (markup.start_with?('"') && markup.end_with?('"')) || + (markup.start_with?("'") && markup.end_with?("'")) + return markup[1..-2] + end + case markup - when nil - nil - when SINGLE_QUOTED_STRING, DOUBLE_QUOTED_STRING - Regexp.last_match(1) when INTEGERS_REGEX Regexp.last_match(1).to_i when RANGES_REGEX RangeLookup.parse(Regexp.last_match(1), Regexp.last_match(2)) when FLOATS_REGEX Regexp.last_match(1).to_f else - markup = markup.strip if LITERALS.key?(markup) LITERALS[markup] else VariableLookup.parse(markup) end