fix: enforce string-type pattern in replace, fixes #243

src/builtin/filters/string.ts

@@ -29,19 +29,19 @@ export function upcase (str: string) {
 }
 
 export function remove (v: string, arg: string) {
-  return stringify(v).split(arg).join('')
+  return stringify(v).split(String(arg)).join('')
 }
 
 export function removeFirst (v: string, l: string) {
-  return stringify(v).replace(l, '')
+  return stringify(v).replace(String(l), '')
 }
 
 export function rstrip (str: string) {
   return stringify(str).replace(/\s+$/, '')
 }
 
 export function split (v: string, arg: string) {
-  return stringify(v).split(arg)
+  return stringify(v).split(String(arg))
 }
 
 export function strip (v: string) {
@@ -58,11 +58,11 @@ export function capitalize (str: string) {
 }
 
 export function replace (v: string, pattern: string, replacement: string) {
-  return stringify(v).split(pattern).join(replacement)
+  return stringify(v).split(String(pattern)).join(replacement)
 }
 
 export function replaceFirst (v: string, arg1: string, arg2: string) {
-  return stringify(v).replace(arg1, arg2)
+  return stringify(v).replace(String(arg1), arg2)
 }
 
 export function truncate (v: string, l = 50, o = '...') {

test/e2e/issues.ts

@@ -23,4 +23,17 @@ describe('Issues', function () {
     const html = engine.parseAndRenderSync('{{ ["complex key"] }}', { 'complex key': 'foo' })
     expect(html).to.equal('foo')
   })
+  it('#243 Potential for ReDoS through string replace function', async () => {
+    const engine = new Liquid()
+    const INPUT = 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa!'
+    const BROKEN_REGEX = /([a-z]+)+$/
+
+    // string filters vulnerable to regexp parameter: split, replace, replace_first, remove_first
+    const parameters = { input: INPUT, regex: BROKEN_REGEX }
+    const template = `{{ input | replace:regex,'' }}`
+    const html = engine.parseAndRenderSync(template, parameters)
+
+    // should stringify the regexp rather than execute it
+    expect(html).to.equal(INPUT)
+  })
 })