Fix invalid float with no leading integer #120
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
dylanahsmith
reviewed
Nov 6, 2020
| @@ -109,7 +109,7 @@ const char *lex_one(const char *start, const char *end, lexer_token_t *token) | |||
| } | |||
| } | |||
|
|
|||
| if (ISDIGIT(c) || c == '-') { | |||
| if (ISDIGIT(c) || (c == '-' && str + 1 < end && ISDIGIT(str[1]))) { | |||
There was a problem hiding this comment.
This will make the strict parser more strict, so could be a breaking change. We should instead use Liquid::Usage.increment to instrument this change to determine if it will break any code in practice. If we determine that it is relied upon, then I think we will need to make the corresponding strict parsing in the ruby liquid gem less strict instead.
There was a problem hiding this comment.
I opened #123 to instrument this usage.
Merged
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
When fuzzing with AFL there was an inconsistency in parsing floats. Liquid does not allow floats without a leading integer part, but liquid-c will allow a negative float without a leading integer part (e.g. liquid-c will parse
-.1as-0.1). I've added tests for this in liquid.