fix: use realpath for fs.contains (#867)

* fix: use realpath for fs.contains

* chore: reset file mode changes

Made-with: Cursor

* fix: Windows compat for contains/containsSync and toLiquidAsync arg order

Made-with: Cursor

test/e2e/parse-and-render.spec.ts

@@ -1,4 +1,7 @@
 import { Liquid } from '../..'
+import { mkdtempSync, writeFileSync, symlinkSync, rmSync } from 'fs'
+import { join } from 'path'
+import { tmpdir } from 'os'
 
 describe('.parseAndRender()', function () {
   var engine: Liquid, strictEngine: Liquid
@@ -57,4 +60,26 @@ describe('.parseAndRender()', function () {
     const html = await engine.parseAndRender(src)
     expect(html).toBe('true')
   })
+  const canSymlink = process.platform !== 'win32'
+  ;(canSymlink ? describe : describe.skip)('symlink outside root', function () {
+    let root: string, secret: string
+    beforeAll(function () {
+      root = mkdtempSync(join(tmpdir(), 'liquid-e2e-root-'))
+      secret = join(tmpdir(), `liquid-e2e-secret-${Date.now()}.liquid`)
+      writeFileSync(secret, 'SECRET_OUTSIDE')
+      symlinkSync(secret, join(root, 'link.liquid'))
+    })
+    afterAll(function () {
+      rmSync(root, { recursive: true, force: true })
+      rmSync(secret, { force: true })
+    })
+    it('should not render a symlink partial whose target is outside root', async function () {
+      const e = new Liquid({ root: [root], extname: '.liquid', relativeReference: false })
+      await expect(e.parseAndRender('{% render "link" %}')).rejects.toThrow(/ENOENT|Failed to lookup/)
+    })
+    it('should not render a symlink partial via parseAndRenderSync', function () {
+      const e = new Liquid({ root: [root], extname: '.liquid', relativeReference: false })
+      expect(() => e.parseAndRenderSync('{% render "link" %}')).toThrow(/ENOENT|Failed to lookup/)
+    })
+  })
 })

test/stub/mockfs.ts

@@ -1,6 +1,6 @@
 import { isString, forOwn } from '../../src/util/underscore'
 import * as fs from '../../src/fs/fs-impl'
-import { resolve } from 'path'
+import { resolve, sep } from 'path'
 
 interface FileDescriptor {
   mode: string;
@@ -8,7 +8,7 @@ interface FileDescriptor {
 }
 
 let files: { [path: string]: FileDescriptor } = {}
-const { readFile, exists, readFileSync, existsSync } = fs
+const { readFile, exists, readFileSync, existsSync, contains, containsSync } = fs
 
 export function mock (options: { [path: string]: (string | FileDescriptor) }) {
   forOwn(options, (val, key) => {
@@ -30,6 +30,16 @@ export function mock (options: { [path: string]: (string | FileDescriptor) }) {
   };
   (fs as any).existsSync = function (path: string) {
     return !!files[path]
+  };
+  (fs as any).contains = async (root: string, file: string) => {
+    root = resolve(root)
+    if (!root.endsWith(sep)) root += sep
+    return file.startsWith(root)
+  };
+  (fs as any).containsSync = (root: string, file: string) => {
+    root = resolve(root)
+    if (!root.endsWith(sep)) root += sep
+    return file.startsWith(root)
   }
 }
 
@@ -38,5 +48,7 @@ export function restore () {
   (fs as any).readFileSync = readFileSync;
   (fs as any).existsSync = existsSync;
   (fs as any).readFile = readFile;
-  (fs as any).exists = exists
+  (fs as any).exists = exists;
+  (fs as any).contains = contains;
+  (fs as any).containsSync = containsSync
 }