Fixes a critical bug where TemplateContext.LoopLimit was not properly enforced in nested loop scenarios, allowing templates to bypass iteration limits and potentially cause performance issues or infinite loops.

Problem

The original implementation used a single global _loopStep counter that was reset when entering/exiting any loop, causing nested loops to bypass the LoopLimit enforcement:

// BUGGY: Single global counter shared across all loops
private int _loopStep;

internal void EnterLoop(ScriptLoopStatementBase loop)
{
    _loopStep = 0;  // ❌ Resets counter for ALL loops
}

internal void ExitLoop(ScriptLoopStatementBase loop)
{
    _loopStep = 0;  // ❌ Resets counter when exiting ANY loop
}

Reproduction case:

{{~ for item in items ~}}          // 300 iterations
  {{~ for tag in item.tags ~}}     // 1 iteration each
    {{ tag }}
  {{~ end ~}}
{{~ end ~}}

With LoopLimit = 200, this should throw an exception but didn't.

Solution

Replaced the single global counter with a stack-based approach where each loop level maintains its own iteration counter:

// FIXED: Stack-based per-loop counters
private FastStack<int> _loopSteps;

internal void EnterLoop(ScriptLoopStatementBase loop)
{
    _loopSteps.Push(0);  // ✅ Push new counter for this loop
}

internal void ExitLoop(ScriptLoopStatementBase loop)
{
    _loopSteps.Pop();    // ✅ Pop this loop's counter
}

internal bool StepLoop(ScriptLoopStatementBase loop, LoopType loopType = LoopType.Default)
{
    // ✅ Increment only the current loop's counter
    var currentStepCount = _loopSteps.Pop() + 1;
    _loopSteps.Push(currentStepCount);
    
    if (loopLimit != 0 && currentStepCount > loopLimit)
    {
        throw new ScriptRuntimeException(/* ... */);
    }
}

Changes Made

Core Implementation (src/Scriban/TemplateContext.cs)

• Line 56: Changed private int _loopStep; → private FastStack<int> _loopSteps;
• Line 183: Added _loopSteps = new FastStack<int>(4); in constructor
• Line 1009: Changed _loopStep = 0; → _loopSteps.Push(0); in EnterLoop()
• Line 1035: Changed _loopStep = 0; → _loopSteps.Pop(); in ExitLoop()
• Lines 1059-1060: Implemented stack-based counter increment in StepLoop()

Test Coverage (src/Scriban.Tests/TestRuntime.cs)

• Added TestNestedLoopLimit() - Tests 3×3 nested loops with limit of 5
• Added TestNestedLoopLimitInnerLoopExceeds() - Tests inner loop exceeding limit
• Added TestNestedLoopLimitWithinBounds() - Tests nested loops within limits
• Added TestTripleNestedLoopLimit() - Tests triple nested loops
• Added TestNestedLoopLimitIndependentCounters() - Tests independent counters per level

Verification

Before Fix:

--- Test: Original reproduction case ---
BUG: Should have thrown TemplateEvaluationException
Loop limit: 200
Items processed: 300

After Fix:

--- Test: Original reproduction case ---
FIXED: <input>(305,5) : error : Exceeding number of iteration limit `200` for loop statement.

Impact

• ✅ Fixes Security Issue: Prevents potential DoS via nested loop bypass
• ✅ Maintains Compatibility: No breaking API changes
• ✅ Performance: Minimal overhead (just stack operations)
• ✅ Consistency: LoopLimit now works uniformly across all loop scenarios

Testing

All existing tests pass, plus new comprehensive test coverage for nested loop scenarios.

Breaking Changes

None. This is a bug fix that maintains full backward compatibility.

Fixes #615