fix: path traversal vulnerability, #851 (#855)

* Fix Path Traversal fallback

* Update loader.ts

Fixed nested

* Update loader.ts

padding fix

* refactor: reuse root enforcing

* docs: update test case and docs

---------

Co-authored-by: MorielHarush <[email protected]>

demo/esm/index.mjs

@@ -8,7 +8,7 @@ const engine = new Liquid({
   // layout files for `{% layout %}`
   layouts: process.cwd() + '/layouts',
   // partial files for `{% include %}` and `{% render %}`
-  partials: process.cwd() + '/partials'
+  partials: [process.cwd() + '/partials', 'node_modules']
 })
 
 const ctx = {

demo/esm/test.sh

@@ -1,3 +1,3 @@
-set -ex
+set -e
 
 npm start | grep 'LiquidJS Demo'

demo/express/test.sh

@@ -1,4 +1,4 @@
-set -x
+set -e
 
 LOG_FILE=$(mktemp)
 npm start > $LOG_FILE 2>&1 &

demo/nodejs/test.sh

@@ -1,3 +1,3 @@
-set -ex
+set -e
 
 npm start | grep 'NodeJS Demo for LiquidJS'

demo/template/test.sh

@@ -1,3 +1,3 @@
-set -ex
+set -e
 
 npm start | grep '\[11:8] {{ todo }}'

demo/typescript/test.sh

@@ -1,3 +1,3 @@
-set -ex
+set -e
 
 npm run build && npm start | grep 'TypeScript Demo for LiquidJS'

demo/webpack/test.sh

@@ -1,4 +1,4 @@
-set -ex
+set -e
 
 npm run build
 npm start | grep 'Webpack Demo for LiquidJS'