docs: path traversal vulnerabilities when customizing FS

docs/source/tutorials/render-file.md

@@ -88,6 +88,9 @@ var engine = new Liquid({
         exists () {
             return true
         },
+        contains () {
+            return true
+        },
         resolve(root, file, ext) {
             return file
         }
@@ -95,6 +98,8 @@ var engine = new Liquid({
 });
 ```
 
+{% note warn Path Traversal Vulnerability %}The default value of <code>contains()</code> always returns true. That means when specifying an abstract file system, you'll need to provide a proper <code>contains()</code> to avoid expose such vulnerabilities.{% endnote %}
+
 [fs]: ../api/interfaces/liquid_options_.liquidoptions.html#Optional-fs
 [ifs]: https://github.com/harttle/liquidjs/blob/master/src/fs/ifs.ts
 [fs-node]: https://github.com/harttle/liquidjs/blob/master/src/fs/node.ts

src/fs/fs.ts

@@ -9,7 +9,7 @@ export interface FS {
   readFileSync: (filepath: string) => string;
   /** resolve a file against directory, for given `ext` option */
   resolve: (dir: string, file: string, ext: string) => string;
-  /** check if file is contained in `root`, always return `true` by default */
+  /** check if file is contained in `root`, always return `true` by default. Warning: not setting this could expose path traversal vulnerabilities. */
   contains?: (root: string, file: string) => boolean;
   /** defaults to "/" */
   sep?: string;