Labyricorn/liquidjs
1
0
Fork 0
mirror of https://github.com/harttle/liquidjs.git synced 2026-09-18 05:50:43 -07:00
Code Issues Packages Projects Releases Wiki Activity

fix: enforce root containment for renderFile/parseFile lookups

Browse Source 
Made-with: Cursor
This commit is contained in:
Yang Jun
2026-04-07 23:06:18 +08:00
parent db4348507e
commit 484ba7f078
5 changed files with 31 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/integration/liquid/liquid.spec.ts
+18 -1
View File
@@ -109,6 +109,7 @@ describe('Liquid', function () {
})
})
describe('#renderFile', function () {
afterEach(restore)
it('should throw with lookup list when file not exist', function () {
const engine = new Liquid({
root: ['/boo', '/root/'],
@@ -116,6 +117,22 @@ describe('Liquid', function () {
})
return expect(engine.renderFile('/not/exist.html')).rejects.toThrow(/Failed to lookup "\/not\/exist.html" in "\/boo,\/root\/"/)
})
it('should reject absolute paths outside root', async function () {
mock({
'/safe/foo.html': 'safe',
'/etc/secret': 'SECRET'
})
const engine = new Liquid({ root: ['/safe'] })
await expect(engine.renderFile('/etc/secret')).rejects.toThrow(/Failed to lookup/)
})
it('should reject absolute paths outside root (sync)', function () {
mock({
'/safe/foo.html': 'safe',
'/etc/secret': 'SECRET'
})
const engine = new Liquid({ root: ['/safe'] })
expect(() => engine.renderFileSync('/etc/secret')).toThrow(/Failed to lookup/)
})
})
describe('#parseFile', function () {
it('should throw with lookup list when file not exist', function () {
@@ -127,7 +144,7 @@ describe('Liquid', function () {
})
it('should fallback to require.resolve in Node.js', async function () {
const engine = new Liquid({
root: ['/root/'],
root: [process.cwd()],
extname: '.html'
})
const tpls = await engine.parseFileSync('jest')