harttle / liquidjs / 40555784537

99%

push

github

fix(security): apply outputEscape to {% cycle %} (#984)

* fix(security): apply outputEscape to {% cycle %}

Escape cycle candidates the same way as echo. Stricter than Shopify Liquid, which leaves cycle unescaped.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(security): honor | raw on cycle candidates under outputEscape

Parse cycle values as filtered values so | raw skips escaping, including named groups.

Co-authored-by: Cursor <cursoragent@cursor.com>

* refactor: keep original cycle group parse naming

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix: fingerprint cycle candidates from full filtered value text

Co-authored-by: Cursor <cursoragent@cursor.com>

---------

Co-authored-by: Cursor <cursoragent@cursor.com>

1188 of 1208 branches covered (98.34%)

Branch coverage included in aggregate %.

16 of 16 new or added lines in 2 files covered. (100.0%)

3113 of 3119 relevant lines covered (99.81%)

19589.33 hits per line