From 02f86731a31f50bd92e4b545331dedb31ed566f0 Mon Sep 17 00:00:00 2001
From: Enrique Avina <enriqueavina11@gmail.com>
Date: Wed, 30 Sep 2026 01:09:08 -0400
Subject: [PATCH] Throw instead of crashing on a pipe with no preceding
 expression (#351)

{{ | upper }} makes Parser::parse_expression call arguments.back() on an empty vector, which is undefined behavior and aborts under hardened standard libraries. Throw 'too few arguments' (matching add_operator) when there is no expression before the '|'.
---
 include/inja/parser.hpp      | 3 +++
 single_include/inja/inja.hpp | 3 +++
 test/test-renderer.cpp       | 3 +++
 3 files changed, 9 insertions(+)

diff --git a/include/inja/parser.hpp b/include/inja/parser.hpp
index 8882dfe..5074e93 100644
--- a/include/inja/parser.hpp
+++ b/include/inja/parser.hpp
@@ -360,6 +360,9 @@ class Parser {
         }
         auto func = std::make_shared<FunctionNode>(tok.text, tok.text.data() - tmpl.content.c_str());
         // add first parameter as last value from arguments
+        if (arguments.empty()) {
+          throw_parser_error("too few arguments");
+        }
         func->number_args += 1;
         func->arguments.emplace_back(arguments.back());
         arguments.pop_back();
diff --git a/single_include/inja/inja.hpp b/single_include/inja/inja.hpp
index 1a36521..f2c3cdd 100644
--- a/single_include/inja/inja.hpp
+++ b/single_include/inja/inja.hpp
@@ -1816,6 +1816,9 @@ class Parser {
         }
         auto func = std::make_shared<FunctionNode>(tok.text, tok.text.data() - tmpl.content.c_str());
         // add first parameter as last value from arguments
+        if (arguments.empty()) {
+          throw_parser_error("too few arguments");
+        }
         func->number_args += 1;
         func->arguments.emplace_back(arguments.back());
         arguments.pop_back();
diff --git a/test/test-renderer.cpp b/test/test-renderer.cpp
index af0f35e..98e0a23 100644
--- a/test/test-renderer.cpp
+++ b/test/test-renderer.cpp
@@ -159,6 +159,9 @@ Yeah!
     CHECK(env.render("{{ brother.name | upper }}", data) == "CHRIS");
     CHECK(env.render("{{ brother.name | upper | lower }}", data) == "chris");
     CHECK(env.render("{{ [\"C\", \"A\", \"B\"] | sort | join(\",\") }}", data) == "A,B,C");
+
+    CHECK_THROWS_WITH(env.render("{{ | upper }}", data), "[inja.exception.parser_error] (at 1:6) too few arguments");
+    CHECK_THROWS_WITH(env.render("{{ upper(| lower) }}", data), "[inja.exception.parser_error] (at 1:12) too few arguments");
   }
 }