feat: relativeReference for render/include/layout, #395

- `relativeReference` is enabled by default, set to `false` to disable
- Referenced files are still constrained within root/partias/layouts
- fix: relative filenames are not constrained (which allows arbitrary filesystem read)

Example Usage:

{% render "../foo/bar.html" %}

Note:

../foo/bar.html' should also be within `partials` (or `root` if `partials` not set)
This commit is contained in:
Harttle
2021-10-06 17:36:37 +08:00
parent 24a19c092a
commit a3455ebd0b
15 changed files with 160 additions and 31 deletions
+18
View File
@@ -174,5 +174,23 @@ describe('LiquidOptions#cache', function () {
const y = await engine.renderFile('foo')
expect(y).to.equal('foo')
})
it('should cache relative referenced files properly', async function () {
const engine = new Liquid({
root: '/root/',
extname: '.html',
cache: true
})
mock({
'/root/foo.html': '{% render "./bar" %}',
'/root/bar.html': 'bar1',
'/root/another/foo.html': '{% render "./bar" %}',
'/root/another/bar.html': 'bar2'
})
const foo1 = await engine.renderFile('foo')
expect(foo1).to.equal('bar1')
const foo2 = await engine.renderFile('another/foo')
expect(foo2).to.equal('bar2')
})
})
})