feat(filters): add sha256 and hmac_sha256 filters for cryptographic operations by VladimirFilonov · Pull Request #889 · harttle/liquidjs

VladimirFilonov · 2026-04-27T08:08:13Z

Summary

Adds two Shopify filters — sha256 and hmac_sha256 to LiquidJS core. Both are part of the Shopify Liquid filter set but are not currently implemented in LiquidJS.

Closes #884.

Changes

New filters: sha256 and hmac_sha256, output as lowercase hex digest.
Platform-specific implementation (mirrors the base64 split):
- Node: synchronous, uses node:crypto (createHash / createHmac).
- Browser: asynchronous, uses Web Crypto (crypto.subtle.digest, crypto.subtle.importKey + crypto.subtle.sign).
Rollup integration: a new browserCrypto replace block swaps ./crypto-impl for ../build/crypto-impl-browser in the browser bundles, alongside the existing browserBase64 block. 'crypto' is added to the Node bundles' external list.
Memory accounting: input length is reported via this.context.memoryLimit.use.

Implementation details

src/filters/crypto.ts — filter handlers (sha256, hmac_sha256).
src/filters/crypto-impl.ts — Node implementation (sync).
src/build/crypto-impl-browser.ts — browser implementation (async, returns Promise<string>).
src/filters/index.ts — registers the new filter module.
rollup.config.mjs — browserCrypto source replacement + crypto external.
test/integration/filters/crypto.spec.ts, src/build/crypto-impl-browser.spec.ts — tests.
docs/source/filters/{sha256,hmac_sha256}.md, docs/source/filters/overview.md — docs.

Shopify compatibility

Matches Shopify's exact output for sha256:
{{ 'Polyjuice' | sha256 }} → 44ac1d7a2936e30a5de07082fd65d6fe9b1fb658a1a98bfe65bc5959beac5dd0
Matches Shopify's exact output for hmac_sha256:
{{ 'Polyjuice' | hmac_sha256: 'Polina' }} → 8e0d5d65cff1242a4af66c8f4a32854fd5fb80edcc8aabe9b302b29c7c71dc20
Stringifies non-string input (numbers, booleans) and coerces undefined / null to the empty string, consistent with the existing base64_encode filter.

Notes

No new runtime dependency: node:crypto is built-in; crypto.subtle is on globalThis in supported browsers.
Browser bundles return a Promise<string> (Web Crypto is async-only), so synchronous rendering of these two filters is not supported in the browser. Node bundles return a string and work with parseAndRenderSync.
Web Crypto's importKey('raw', ...) rejects zero-length HMAC keys, so empty keys are unsupported in the browser; Node's createHmac accepts them and the Node integration test covers that edge case.

Testing

Unit tests for the browser implementation (Shopify reference vectors, empty string, unicode).
Integration tests covering the two Shopify reference outputs, undefined / null / numeric / boolean coercion, numeric HMAC keys, and empty input.

Breaking changes

None

harttle · 2026-05-03T04:03:36Z

@all-contributors please add @VladimirFilonov for code

allcontributors · 2026-05-03T04:03:46Z

@harttle

I've put up a pull request to add @VladimirFilonov! 🎉

# [10.26.0](v10.25.7...v10.26.0) (2026-05-14) ### Bug Fixes * **date:** cap strftime widths and account padding in memoryLimit ([#895](#895)) ([3129d46](3129d46)) * enforce renderLimit for empty renderTemplates calls ([#894](#894)) ([5b9c346](5b9c346)) * propagate ownPropertyOnly into Context.spawn() for {% render %} ([#893](#893)) ([dbbf628](dbbf628)) * **security:** block Object.prototype filter/tag lookups (RCE) ([#897](#897)) ([457fae0](457fae0)) * strip html newline tags ([#892](#892)) ([26ea285](26ea285)) * **strip_html:** rewrite as linear single-pass scan to avoid ReDoS ([#896](#896)) ([3616a74](3616a74)) ### Features * add sha256 and hmac_sha256 filters for cryptographic operations ([#889](#889)) ([1c816d4](1c816d4))

github-actions · 2026-05-14T14:24:24Z

🎉 This PR is included in version 10.26.0 🎉

The release is available on:

Your semantic-release bot 📦🚀

…hmac_sha256 filters (#269989) ## Summary Adopts Shopify-compatible `sha256` and `hmac_sha256` Liquid filters for Workflows by upgrading [liquidjs to 10.26.0](https://github.com/harttle/liquidjs/releases/tag/v10.26.0) ([harttle/liquidjs#889](harttle/liquidjs#889)). Filter behavior comes from liquidjs core—no custom server-side implementations. - **Execution (server):** Built-in filters work via `createWorkflowLiquidEngine()` with existing `renderSync` / `evalValueSync` (Node `crypto`). - **Editor autocomplete:** Added `sha256` and `hmac_sha256` entries with Shopify reference examples. - **Hover preview (browser):** Switched `evaluateExpression` to async `evalValue` so crypto filters resolve correctly in the browser bundle (Web Crypto is async-only). Hover only shows evaluated filter output when viewing an execution on the **Executions** tab and hovering on the filter segment inside `{{ }}`. ## Changes | Area | Change | |------|--------| | `package.json` / `yarn.lock` | `liquidjs` `10.25.7` → `10.26.0` | | `liquid_completions.ts` | Autocomplete for `sha256`, `hmac_sha256` | | `templating_engine.test.ts` | Server tests (Shopify reference vectors) | | `liquid_parse_cache.test.ts` | Parse/validation tests for built-in crypto filters | | `evaluate_expression.ts` | `evalValueSync` → `await evalValue` for browser crypto | | `unified_hover_provider.ts` | `await evaluateExpression(...)` | | `evaluate_expression.test.ts` | Async tests + crypto filter coverage | **Not changed:** `templating_engine.ts`, `liquid_parse_cache.ts` — no `registerFilter` stubs needed for built-in filters. ## Examples: ```yaml name: Crypto filters enabled: true triggers: - type: manual inputs: - name: message type: string default: "hello world" consts: secret: "secret" steps: - name: hmac_sha256 type: console with: message: "{{ inputs.message | hmac_sha256: consts.secret }}" - name: sha256 type: console with: message: "{{ inputs.message | sha256 }}" ``` --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

…hmac_sha256 filters (elastic#269989) ## Summary Adopts Shopify-compatible `sha256` and `hmac_sha256` Liquid filters for Workflows by upgrading [liquidjs to 10.26.0](https://github.com/harttle/liquidjs/releases/tag/v10.26.0) ([harttle/liquidjs#889](harttle/liquidjs#889)). Filter behavior comes from liquidjs core—no custom server-side implementations. - **Execution (server):** Built-in filters work via `createWorkflowLiquidEngine()` with existing `renderSync` / `evalValueSync` (Node `crypto`). - **Editor autocomplete:** Added `sha256` and `hmac_sha256` entries with Shopify reference examples. - **Hover preview (browser):** Switched `evaluateExpression` to async `evalValue` so crypto filters resolve correctly in the browser bundle (Web Crypto is async-only). Hover only shows evaluated filter output when viewing an execution on the **Executions** tab and hovering on the filter segment inside `{{ }}`. ## Changes | Area | Change | |------|--------| | `package.json` / `yarn.lock` | `liquidjs` `10.25.7` → `10.26.0` | | `liquid_completions.ts` | Autocomplete for `sha256`, `hmac_sha256` | | `templating_engine.test.ts` | Server tests (Shopify reference vectors) | | `liquid_parse_cache.test.ts` | Parse/validation tests for built-in crypto filters | | `evaluate_expression.ts` | `evalValueSync` → `await evalValue` for browser crypto | | `unified_hover_provider.ts` | `await evaluateExpression(...)` | | `evaluate_expression.test.ts` | Async tests + crypto filter coverage | **Not changed:** `templating_engine.ts`, `liquid_parse_cache.ts` — no `registerFilter` stubs needed for built-in filters. ## Examples: ```yaml name: Crypto filters enabled: true triggers: - type: manual inputs: - name: message type: string default: "hello world" consts: secret: "secret" steps: - name: hmac_sha256 type: console with: message: "{{ inputs.message | hmac_sha256: consts.secret }}" - name: sha256 type: console with: message: "{{ inputs.message | sha256 }}" ``` --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

…hmac_sha256 filters (#269989) ## Summary Adopts Shopify-compatible `sha256` and `hmac_sha256` Liquid filters for Workflows by upgrading [liquidjs to 10.26.0](https://github.com/harttle/liquidjs/releases/tag/v10.26.0) ([harttle/liquidjs#889](harttle/liquidjs#889)). Filter behavior comes from liquidjs core—no custom server-side implementations. - **Execution (server):** Built-in filters work via `createWorkflowLiquidEngine()` with existing `renderSync` / `evalValueSync` (Node `crypto`). - **Editor autocomplete:** Added `sha256` and `hmac_sha256` entries with Shopify reference examples. - **Hover preview (browser):** Switched `evaluateExpression` to async `evalValue` so crypto filters resolve correctly in the browser bundle (Web Crypto is async-only). Hover only shows evaluated filter output when viewing an execution on the **Executions** tab and hovering on the filter segment inside `{{ }}`. ## Changes | Area | Change | |------|--------| | `package.json` / `yarn.lock` | `liquidjs` `10.25.7` → `10.26.0` | | `liquid_completions.ts` | Autocomplete for `sha256`, `hmac_sha256` | | `templating_engine.test.ts` | Server tests (Shopify reference vectors) | | `liquid_parse_cache.test.ts` | Parse/validation tests for built-in crypto filters | | `evaluate_expression.ts` | `evalValueSync` → `await evalValue` for browser crypto | | `unified_hover_provider.ts` | `await evaluateExpression(...)` | | `evaluate_expression.test.ts` | Async tests + crypto filter coverage | **Not changed:** `templating_engine.ts`, `liquid_parse_cache.ts` — no `registerFilter` stubs needed for built-in filters. ## Examples: ```yaml name: Crypto filters enabled: true triggers: - type: manual inputs: - name: message type: string default: "hello world" consts: secret: "secret" steps: - name: hmac_sha256 type: console with: message: "{{ inputs.message | hmac_sha256: consts.secret }}" - name: sha256 type: console with: message: "{{ inputs.message | sha256 }}" ``` --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

add sha256 and hmac_sha256 filters for cryptographic operations

fd5dc2b

VladimirFilonov mentioned this pull request Apr 27, 2026

feat(filter): Add Shopify filters 'sha256' and 'hmac_sha256' #884

Closed

harttle merged commit 1c816d4 into harttle:master May 3, 2026
14 checks passed

allcontributors Bot mentioned this pull request May 3, 2026

docs: add VladimirFilonov as a contributor for code #891

Merged

github-actions Bot added the released label May 14, 2026

VladimirFilonov mentioned this pull request May 19, 2026

[One Workflow] Update liquidjs to version 10.26.0 and add sha256 and hmac_sha256 filters elastic/kibana#269989

Merged

This was referenced May 29, 2026

[One Workflow] Update liquidjs to version 10.26.0 and add sha256 and hmac_sha256 filters (#269989) elastic/kibana#271967

Merged

[One Workflow] Update liquidjs to version 10.26.0 elastic/kibana#271972

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(filters): add sha256 and hmac_sha256 filters for cryptographic operations#889

feat(filters): add sha256 and hmac_sha256 filters for cryptographic operations#889
harttle merged 1 commit into
harttle:masterfrom
VladimirFilonov:feature/884-add-sha256-and-hmac_sha256

VladimirFilonov commented Apr 27, 2026

Uh oh!

Uh oh!

harttle commented May 3, 2026

Uh oh!

allcontributors Bot commented May 3, 2026

Uh oh!

github-actions Bot commented May 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

VladimirFilonov commented Apr 27, 2026

Summary

Changes

Implementation details

Shopify compatibility

Notes

Testing

Breaking changes

Uh oh!

Uh oh!

harttle commented May 3, 2026

Uh oh!

allcontributors Bot commented May 3, 2026

Uh oh!

github-actions Bot commented May 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants