Bump liquid from 4.0.3 to 5.0.0 (#12150)

* Bump liquid from 4.0.3 to 5.0.0

Bumps [liquid](https://github.com/Shopify/liquid) from 4.0.3 to 5.0.0.
- [Release notes](https://github.com/Shopify/liquid/releases)
- [Changelog](https://github.com/Shopify/liquid/blob/master/History.md)
- [Commits](https://github.com/Shopify/liquid/compare/v4.0.3...v5.0.0)

Signed-off-by: dependabot[bot] <support@github.com>

* Convert ActiveSupport::SafeBuffer to string

* Disable echo and render tags

* Disable liquid tag

* Add issue link

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: rhymes <rhymes@hey.com>

.gitignore

@@ -94,3 +94,6 @@ cypress/screenshots
 
 # PostCSS error log
 postcss_error.log
+
+# ripgrep ignore file
+.rgignore

Gemfile

@@ -55,7 +55,7 @@ gem "jquery-rails", "~> 4.4" #  A gem to automate using jQuery with Rails
 gem "jsonapi-serializer", "~> 2.1" # Serializer for Ruby objects
 gem "kaminari", "~> 1.2" # A Scope & Engine based, clean, powerful, customizable and sophisticated paginator
 gem "katex", "~> 0.6.1" # This rubygem enables you to render TeX math to HTML using KaTeX. It uses ExecJS under the hood
-gem "liquid", "~> 4.0" # A secure, non-evaling end user template engine with aesthetic markup
+gem "liquid", "~> 5.0" # A secure, non-evaling end user template engine with aesthetic markup
 gem "mini_racer", "~> 0.3.1" # Minimal embedded v8
 gem "nokogiri", "~> 1.11" # HTML, XML, SAX, and Reader parser
 gem "octokit", "~> 4.20" # Simple wrapper for the GitHub API

Gemfile.lock

@@ -434,7 +434,7 @@ GEM
     libv8 (8.4.255.0-x86_64-darwin-19)
     libv8 (8.4.255.0-x86_64-darwin-20)
     libv8 (8.4.255.0-x86_64-linux)
-    liquid (4.0.3)
+    liquid (5.0.0)
     listen (3.4.1)
       rb-fsevent (~> 0.10, >= 0.10.3)
       rb-inotify (~> 0.9, >= 0.9.10)
@@ -910,7 +910,7 @@ DEPENDENCIES
   katex (~> 0.6.1)
   knapsack_pro (~> 2.11.0)
   launchy (~> 2.5)
-  liquid (~> 4.0)
+  liquid (~> 5.0)
   listen (~> 3.4)
   memory_profiler (~> 0.9)
   mini_racer (~> 0.3.1)

app/liquid_tags/null_tag.rb

@@ -4,8 +4,9 @@ class NullTag < Liquid::Block
   end
 end
 
-disabled_tags = %w[assign break capture case cycle decrement for if ifchanged include increment unless tablerow]
-
-disabled_tags.each do |tag|
+%w[
+  assign break capture case cycle decrement echo for
+  if ifchanged include increment render tablerow unless
+].each do |tag|
   Liquid::Template.register_tag(tag, NullTag)
 end

app/services/markdown_processor/parser.rb

@@ -25,7 +25,12 @@ module MarkdownProcessor
       sanitized_content = sanitize_rendered_markdown(html)
       begin
         liquid_tag_options = { source: @source, user: @user }
-        parsed_liquid = Liquid::Template.parse(sanitized_content, liquid_tag_options)
+
+        # NOTE: [@rhymes] liquid 5.0.0 does not support ActiveSupport::SafeBuffer,
+        # a String substitute, hence we force the conversion before passing it to Liquid::Template.
+        # See <https://github.com/Shopify/liquid/issues/1390>
+        parsed_liquid = Liquid::Template.parse(sanitized_content.to_str, liquid_tag_options)
+
         html = markdown.render(parsed_liquid.render)
       rescue Liquid::SyntaxError => e
         html = e.message

lib/liquid/block_body.rb

@@ -0,0 +1,15 @@
+# Disables {% liquid %} tag introduced in version 5.0
+# see <https://github.com/Shopify/liquid/blob/master/lib/liquid/block_body.rb>
+
+module LiquidBlockBodyExtensions
+  # parse_for_liquid_tag is a private method, thus we use prepend to patch it
+  def parse_for_liquid_tag(_tokenizer, _parse_context)
+    raise StandardError, "Liquid 'liquid' tag is disabled"
+  end
+end
+
+module Liquid
+  class BlockBody
+    prepend LiquidBlockBodyExtensions
+  end
+end

spec/lib/liquid/echo_spec.rb

@@ -0,0 +1,10 @@
+require "rails_helper"
+
+# Liquid::Echo internally uses Liquid::Variable which we disable,
+# but we want to make sure it always is disabled in turn
+
+RSpec.describe Liquid::Echo, type: :lib do
+  it "is disabled" do
+    expect { Liquid::Template.parse("{% echo something %}") }.to raise_error(StandardError)
+  end
+end

spec/lib/liquid/liquid_spec.rb

@@ -0,0 +1,7 @@
+require "rails_helper"
+
+RSpec.describe Liquid, type: :lib do
+  it "is disabled" do
+    expect { Liquid::Template.parse("{% liquid %}") }.to raise_error(StandardError)
+  end
+end

spec/lib/liquid/render_spec.rb

@@ -0,0 +1,12 @@
+require "rails_helper"
+
+# Liquid::Render is disabled by default
+# but we want to make sure it's always disabled in the future with an automatic test
+
+RSpec.describe Liquid::Render, type: :lib do
+  it "uses the blank file system and it's always disabled" do
+    expect(Liquid::Template.file_system).to be_a(Liquid::BlankFileSystem)
+
+    expect { Liquid::Template.parse('{% render "template_name" %}') }.to raise_error(StandardError)
+  end
+end