feat: relativeReference for render/include/layout, #395

- `relativeReference` is enabled by default, set to `false` to disable
- Referenced files are still constrained within root/partias/layouts
- fix: relative filenames are not constrained (which allows arbitrary filesystem read)

Example Usage:

{% render "../foo/bar.html" %}

Note:

../foo/bar.html' should also be within `partials` (or `root` if `partials` not set)

test/integration/builtin/tags/include.ts

@@ -19,6 +19,14 @@ describe('tags/include', function () {
     const html = await liquid.renderFile('/current.html')
     return expect(html).to.equal('barfoobar')
   })
+  it('should support relative reference', async function () {
+    mock({
+      '/foo/bar/current.html': 'bar{% include "../coo/foo.html" %}bar',
+      '/foo/coo/foo.html': 'foo'
+    })
+    const html = await liquid.renderFile('/foo/bar/current.html')
+    return expect(html).to.equal('barfoobar')
+  })
   it('should support template string', async function () {
     mock({
       '/current.html': 'bar{% include "bar/{{name}}" %}bar',

test/integration/builtin/tags/layout.ts

@@ -179,6 +179,16 @@ describe('tags/layout', function () {
     return expect(html).to.equal('blackredA')
   })
 
+  it('should support relative reference', async function () {
+    mock({
+      '/foo/bar/parent.html': '{{color}}{%block%}{%endblock%}',
+      '/foo/bar/main.html': '{% layout ./parent.html color:"black"%}{%block%}A{%endblock%}'
+    })
+    const staticLiquid = new Liquid({ root: '/', dynamicPartials: false })
+    const html = await staticLiquid.renderFile('/foo/bar/main.html')
+    return expect(html).to.equal('blackA')
+  })
+
   describe('static partial', function () {
     it('should support filename with extension', async function () {
       mock({

test/integration/builtin/tags/render.ts

@@ -26,7 +26,7 @@ describe('tags/render', function () {
       '/current.html': 'bar{% render "foo.html" %}bar',
       '/partials/foo.html': 'foo'
     })
-    const liquid = new Liquid({ partials: '/partials' })
+    const liquid = new Liquid({ partials: '/partials', root: '/' })
     const html = await liquid.renderFile('/current.html')
     expect(html).to.equal('barfoobar')
   })
@@ -223,6 +223,31 @@ describe('tags/render', function () {
     const html = await liquid.renderFile('personInfo.html', ctx)
     expect(html).to.equal('This is a person <p>Joe Shmoe<br/>City: Dallas</p>')
   })
+  it('should support relative reference', async function () {
+    mock({
+      '/foo/coo/parent.html': 'X{% render ../bar/child.html, color:"red" %}Y',
+      '/foo/bar/child.html': 'child with {{color}}'
+    })
+    const staticLiquid = new Liquid({ dynamicPartials: false, root: '/foo' })
+    const html = await staticLiquid.renderFile('coo/parent.html')
+    expect(html).to.equal('Xchild with redY')
+  })
+  it('should disable relative reference if specified', () => {
+    mock({
+      '/foo/coo/parent.html': 'X{% render ../bar/child.html, color:"red" %}Y',
+      '/foo/bar/child.html': 'child with {{color}}'
+    })
+    const staticLiquid = new Liquid({ dynamicPartials: false, root: '/foo', relativeReference: false })
+    return expect(staticLiquid.renderFile('coo/parent.html')).to.be.rejectedWith(/Failed to lookup/)
+  })
+  it('should throw not found if relative reference out of root', () => {
+    mock({
+      '/foo/parent.html': 'X{% render ../bar/child.html, color:"red" %}Y',
+      '/bar/child.html': 'child with {{color}}'
+    })
+    const staticLiquid = new Liquid({ dynamicPartials: false, root: '/foo', partials: '/foo' })
+    return expect(staticLiquid.renderFile('parent.html')).to.be.rejectedWith(/Failed to lookup "..\/bar\/child.html"/)
+  })
 
   describe('static partial', function () {
     it('should support filename with extention', async function () {