Skip to content

feat(v11)!: restrict size/first/last magic keys to arrays and strings#915

Closed
harttle wants to merge 3 commits into
masterfrom
fix/own-property-only-magic-keys
Closed

feat(v11)!: restrict size/first/last magic keys to arrays and strings#915
harttle wants to merge 3 commits into
masterfrom
fix/own-property-only-magic-keys

Conversation

@harttle

@harttle harttle commented Jun 19, 2026

Copy link
Copy Markdown
Owner

Summary

Draft / WIP — planned breaking change for v11. Related to #916.

  • Restrict Liquid magic semantics for size, first, and last to arrays and strings only
  • Plain objects no longer get Object.keys count for .size or obj['first'] / obj['last'] magic fallbacks
  • Map/Set .size is no longer resolved via magic (still accessible as a normal property when ownPropertyOnly: false)
  • Own properties named size/first/last on objects remain accessible via regular property lookup
  • Replaces the earlier ownPropertyOnly guard approach with simpler, safer semantics

Breaking changes

Value type Before (v10) After (v11)
Plain object {} .size -> key count .size -> undefined
Plain object {} .first/.last -> obj['first']/obj['last'] .first/.last -> undefined (unless own property)
Array / string magic works unchanged
Map / Set magic .size undefined with default ownPropertyOnly; native .size when ownPropertyOnly: false

Test plan

  • npm run build
  • jest src/context/context.spec.ts
  • jest test/e2e/issues.spec.ts

Fixes #916

Development link: This keyword ties PR #915 to issue #916 in the Development sidebar. The issue will automatically close when this PR is merged into master. This PR is draft / WIP for v11; do not merge until the v11 breaking change is intended to ship.

readSize, readFirst, and readLast bypassed the ownPropertyOnly guard by
reading inherited properties from the prototype chain. Pass the flag through
and only allow prototype size lookups when ownPropertyOnly is false.

Co-authored-by: Cursor <cursoragent@cursor.com>
@coveralls

coveralls commented Jun 19, 2026

Copy link
Copy Markdown

Coverage Report for CI Build 27838558883

Coverage remained the same at 99.543%

Details

  • Coverage remained the same as the base build.
  • Patch coverage: 6 of 6 lines across 1 file are fully covered (100%).
  • No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.


Coverage Stats

Coverage Status
Relevant Lines: 3016
Covered Lines: 3009
Line Coverage: 99.77%
Relevant Branches: 1145
Covered Branches: 1133
Branch Coverage: 98.95%
Branches in Coverage %: Yes
Coverage Strength: 22306.67 hits per line

💛 - Coveralls

Co-authored-by: Cursor <cursoragent@cursor.com>
Replace ownPropertyOnly guards with simpler v11 semantics: magic
property resolution applies only to arrays and strings. Plain objects
no longer get Object.keys size or first/last fallbacks.

Related to #916

Co-authored-by: Cursor <cursoragent@cursor.com>
@harttle harttle marked this pull request as draft June 19, 2026 16:57
@harttle harttle changed the title fix(security): respect ownPropertyOnly for size/first/last magic keys feat(v11)!: restrict size/first/last magic keys to arrays and strings Jun 19, 2026
@harttle harttle added this to v11 Jun 19, 2026
@harttle harttle closed this Jul 6, 2026
@github-project-automation github-project-automation Bot moved this to Done in v11 Jul 6, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

v11: restrict size/first/last magic properties to arrays and strings

2 participants