SYP-SEC-001 · v2.1.0 · Published
Unescaped Liquid output in an HTML context
Identifies supported output contexts where a dynamic Liquid value requires explicit escaping.
Description
Identifies supported output contexts where a dynamic Liquid value requires explicit escaping.
Why it matters
Dynamic output rendered into the wrong HTML context can produce invalid markup or expose an injection path.
Detection
The Runtime parses Liquid output nodes, determines supported HTML contexts and checks whether the filter chain provides the expected escaping behavior.
Does not match
- Outputs with a compatible escape filter for the established HTML context
- Static text without a Liquid output node
- Script contexts the rule cannot safely classify as HTML text or attributes
Evidence
- Output expression and surrounding HTML context
- Applied Liquid filters
- File, line and rule version
Validation
The candidate is accepted only when the parser establishes a supported HTML output context and the Liquid filter chain lacks the compatible escaping behavior required by that context.
Examples
<div data-title="{{ product.title }}"><div data-title="{{ product.title | escape }}">Examples document the rule contract. A safer direction is not an automatic apply instruction and still requires review in the complete theme context.
Limitations
- Context detection is limited to structures the parser can establish statically.
- The rule does not replace a complete application security review.
- Values transformed by custom filters may require manual review.
References
Compatibility
Supported
- Shopify Liquid themes
- HTML text and supported attribute contexts
Not established
- JavaScript string escaping
- Sanitization performed by unknown custom filters
- Runtime values introduced outside the analyzed theme