liquid
liquid copied to clipboard
How to prevent denial of service caused by endless loop?
I have noticed that there is no upper limits on iterations which makes it easy for someone to brick an app by launching an infinite loop:
Liquid::Template.parse("{% for n in (1..100000) %}{% endfor %}").render
Is there a configuration to prevent this?
A timeout can be used to interrupt liquid rendering.