don't allow invalid syntax inside comment tag

Shopify · Dec 14, 2023 · 3c5ad7d · 3c5ad7d
1 parent c658bf9
commit 3c5ad7d
Show file tree

Hide file tree

Showing 2 changed files with 33 additions and 19 deletions.
diff --git a/lib/liquid/tags/comment.rb b/lib/liquid/tags/comment.rb
@@ -49,15 +49,9 @@ def parse_body(body, tokenizer)
             next if tag_name_match.nil?
 
             tag_name_match[1]
-          elsif token =~ BlockBody::FullToken && Regexp.last_match(2) == "comment" || Regexp.last_match(2) == "endcomment"
-            # aggressively match comment tag or comment tag delimiter
-            Regexp.last_match(2)
           else
-            tag_name_match = BlockBody::FullTokenPossiblyInvalid.match(token)
-
-            next if tag_name_match.nil?
-
-            tag_name_match[2]
+            token =~ BlockBody::FullToken
+            Regexp.last_match(2)
           end
 
           case tag_name

diff --git a/test/unit/tags/comment_tag_unit_test.rb b/test/unit/tags/comment_tag_unit_test.rb
@@ -31,25 +31,45 @@ def test_does_not_parse_nodes_inside_a_comment
     LIQUID
   end
 
-  def test_allows_incomplete_tags_inside_a_comment
-    assert_template_result("", <<~LIQUID.chomp)
+  def test_allows_unclosed_tags
+    assert_template_result('', <<~LIQUID.chomp)
       {% comment %}
-        {% assign foo = "1"
+        {% if true %}
       {% endcomment %}
     LIQUID
+  end
 
-    assert_template_result("", <<~LIQUID.chomp)
+  def test_block_body_must_be_valid
+    assert_template_result('', <<~LIQUID.chomp)
       {% comment %}
-        {% comment %}
-          {% invalid
-        {% endcomment %}
+        {% assign a = 123 {% comment %}
       {% endcomment %}
     LIQUID
 
-    assert_template_result("", <<~LIQUID.chomp)
-      {% comment %}
-      {% {{ {%- endcomment %}
-    LIQUID
+    assert_raises(Liquid::SyntaxError) do
+      assert_template_result("", <<~LIQUID.chomp)
+        {% comment %}
+          {% assign foo = "1"
+        {% endcomment %}
+      LIQUID
+    end
+
+    assert_raises(Liquid::SyntaxError) do
+      assert_template_result("", <<~LIQUID.chomp)
+        {% comment %}
+          {% comment %}
+            {% invalid
+          {% endcomment %}
+        {% endcomment %}
+      LIQUID
+    end
+
+    assert_raises(Liquid::SyntaxError) do
+      assert_template_result("", <<~LIQUID.chomp)
+        {% comment %}
+        {% {{ {%- endcomment %}
+      LIQUID
+    end
   end
 
   def test_child_comment_tags_need_to_be_closed