harttle / liquidjs / 24082708294

100%

push

github

fix: sort and sort_natural filters bypass ownPropertyOnly (#869)

Use _getFromScope for property access in sort/sort_natural filters to respect the ownPropertyOnly security option, preventing prototype chain traversal that could leak sensitive inherited properties.

Also extract shared sortBy helper, add orderedCompare with nil handling consistent with caseInsensitiveCompare and Ruby Liquid.

Made-with: Cursor

1118 of 1129 branches covered (99.03%)

Branch coverage included in aggregate %.

17 of 17 new or added lines in 2 files covered. (100.0%)

2942 of 2950 relevant lines covered (99.73%)

20655.88 hits per line