Skip to content

Commit 9367b8b

Browse files
committed
Add Liquid::Box for secure sandboxed template execution
Introduces Liquid::Box which wraps Ruby 4.0's Ruby::Box for secure template execution. On Ruby < 4.0, provides a polyfill with security warnings. Key features: - Detects Ruby::Box availability at load time - Loads safe libraries (CGI, Base64, BigDecimal) into sandbox - Neuters dangerous methods (file IO, process control, eval, etc.) - Preserves user constants defined before lock! - Provides setup_gem_load_paths! to enable gem requires in box Security model: It is safe to expose side-effect-free, non-IO methods that don't leak objects with dangerous methods. The sandbox blocks capabilities, not data.
1 parent 5cdbce7 commit 9367b8b

File tree

2 files changed

+494
-0
lines changed

2 files changed

+494
-0
lines changed

lib/liquid.rb

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -89,3 +89,4 @@ module Liquid
8989
require 'liquid/usage'
9090
require 'liquid/registers'
9191
require 'liquid/template_factory'
92+
require 'liquid/box'

0 commit comments

Comments
 (0)