Accessing an upload field without a property in a template crashes

richard · December 30, 2022, 7:26am

See this topic https://coop.pavilion.tech/t/custom-wizard-support/1360

Template does

{%-if "w{step_1_field_3}" == "" -%}

where step_1_field_3 is an upload field.

Crashes here in lib/custom_wizard/mapper.rb line 257

if opts[:template] && CustomWizard::Subscription.subscribed?
  template = Liquid::Template.parse(string)
  string = template.render(data)
end

Changing it to

{%-if "w{step_1_field_3.id}" == "" -%}

resolves this.

I have tried to force an error in other ways, but couldn’t find those.

I guess a quick fallback safeguard for this would just be a matter of

template = Liquid::Template.parse(string) rescue "There is an error in your template"

although it would be better if we were able to do a check for this at the moment the wizard is being saved by the admin.

richard · February 3, 2023, 1:54pm

@angus could you add a check or an exception handler so that it doesn’t error 500 ?

angus · March 21, 2023, 4:22pm

There is actually already a check for liquid formatting when the template is saved

github.com

paviliondev/discourse-custom-wizard/blob/main/lib/custom_wizard/validators/template.rb#L134


      
              active_time = Time.parse(new_time.present? ? new_time : current_time).utc
            rescue ArgumentError
              invalid_time = true
            end
          
            if invalid_time || active_time.blank? || active_time < Time.now.utc
              errors.add :base, I18n.t("wizard.validation.after_time")
            end
          end
          
          def validate_liquid_template(object, type)
            %w[
              description
              raw_description
              placeholder
              preview_template
              post_template
            ].each do |field|
              if template = object[field]
                result = is_liquid_template_valid?(template)

The issue here is the interpolation of the object into the output. For review