liquid icon indicating copy to clipboard operation
liquid copied to clipboard

Include doesn't allow nested template name with length of 1 symbol

Open nvborisenko opened this issue 2 years ago • 2 comments

Continuation of https://github.com/dotliquid/dotliquid/issues/472

I want to include nested template via {% include 'B' %}, I have _B.liquid file near with my caller template.

Error: Liquid error: Error - Illegal template name 'B'

If I change B to BB, it starts to work.

nvborisenko avatar Mar 30 '22 08:03 nvborisenko

Looks like it has worked that way since the first git commit to this repo (https://github.com/Shopify/liquid/commit/1d647361e1a39ee09f1bd2d62701925c0128c578) and it doesn't really seem intentional. It seems like the validation is mostly there to prevent a directory traversal vulnerability, so I'm fine with changing it.

dylanahsmith avatar Apr 06 '22 00:04 dylanahsmith

DotLiquid changed the regex as follows:

^(?![\\\/\.])(?:[^<>:;,?""*|\x00-\x1F\/\\]+|[\/\\](?!\.))+(?<!\/)$

Test cases that don't match:

\root\file
/root/file
folder/
root/.hidden
.hidden
../test

Test cases that match:

root/file.txt
root\file.txt
folder/file
folder\file
file
a
a/b
-abc
a-bc

See the discussion on https://github.com/dotliquid/dotliquid/issues/472

microalps avatar May 05 '22 20:05 microalps