Labyricorn/liquidjs
1
0
Fork 0
mirror of https://github.com/harttle/liquidjs.git synced 2026-09-16 21:00:40 -07:00
Code Issues Packages Projects Releases Wiki Activity

fix: use realpath for fs.contains (#867)

Browse Source 
* fix: use realpath for fs.contains

* chore: reset file mode changes

Made-with: Cursor

* fix: Windows compat for contains/containsSync and toLiquidAsync arg order

Made-with: Cursor
This commit is contained in:
Yang Jun
2026-04-06 14:40:35 +08:00
committed by GitHub
parent abc058be0f
commit 529dd67eeb
12 changed files with 195 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/e2e/parse-and-render.spec.ts
+25
View File
@@ -1,4 +1,7 @@
import { Liquid } from '../..'
import { mkdtempSync, writeFileSync, symlinkSync, rmSync } from 'fs'
import { join } from 'path'
import { tmpdir } from 'os'
describe('.parseAndRender()', function () {
var engine: Liquid, strictEngine: Liquid
@@ -57,4 +60,26 @@ describe('.parseAndRender()', function () {
const html = await engine.parseAndRender(src)
expect(html).toBe('true')
})
const canSymlink = process.platform !== 'win32'
;(canSymlink ? describe : describe.skip)('symlink outside root', function () {
let root: string, secret: string
beforeAll(function () {
root = mkdtempSync(join(tmpdir(), 'liquid-e2e-root-'))
secret = join(tmpdir(), `liquid-e2e-secret-${Date.now()}.liquid`)
writeFileSync(secret, 'SECRET_OUTSIDE')
symlinkSync(secret, join(root, 'link.liquid'))
})
afterAll(function () {
rmSync(root, { recursive: true, force: true })
rmSync(secret, { force: true })
})
it('should not render a symlink partial whose target is outside root', async function () {
const e = new Liquid({ root: [root], extname: '.liquid', relativeReference: false })
await expect(e.parseAndRender('{% render "link" %}')).rejects.toThrow(/ENOENT|Failed to lookup/)
})
it('should not render a symlink partial via parseAndRenderSync', function () {
const e = new Liquid({ root: [root], extname: '.liquid', relativeReference: false })
expect(() => e.parseAndRenderSync('{% render "link" %}')).toThrow(/ENOENT|Failed to lookup/)
})
})
})