feat: relativeReference for render/include/layout, #395

- `relativeReference` is enabled by default, set to `false` to disable
- Referenced files are still constrained within root/partias/layouts
- fix: relative filenames are not constrained (which allows arbitrary filesystem read)

Example Usage:

{% render "../foo/bar.html" %}

Note:

../foo/bar.html' should also be within `partials` (or `root` if `partials` not set)

test/unit/fs/loader.ts

@@ -0,0 +1,16 @@
+import { expect, use } from 'chai'
+import * as fs from '../../../src/fs/node'
+import * as chaiAsPromised from 'chai-as-promised'
+import { Loader } from '../../../src/fs/loader'
+
+use(chaiAsPromised)
+
+describe('fs/loader', function () {
+  describe('.candidates()', function () {
+    it('should break once found', async function () {
+      const loader = new Loader({ relativeReference: true, fs, extname: '' } as any)
+      const candidates = [...loader.candidates('./foo/bar', ['/root', '/root/foo'], '/root/current')]
+      expect(candidates.join()).to.equal('/root/foo/bar')
+    })
+  })
+})

test/unit/fs/node.ts

@@ -5,7 +5,7 @@ import * as chaiAsPromised from 'chai-as-promised'
 
 use(chaiAsPromised)
 
-describe('fs', function () {
+describe('fs/node', function () {
   describe('.resolve()', function () {
     it('should resolve based on root', async function () {
       const filepath = fs.resolve('/foo', 'bar.html', '.liquid')