fix(security): allow partial recursion when renderLimit is finite

Only reject render/include cycles when renderLimit is unlimited (default Infinity). With a finite time budget, recursion is bounded by renderLimit checks in renderTemplates.

Co-authored-by: Cursor <[email protected]>

src/tags/render.ts

@@ -181,7 +181,9 @@ export function * renderFilePath (file: ParsedFileName, ctx: Context, liquid: Li
 
 export function pushPartialStack (ctx: Context, filepath: string, tag: 'render' | 'include') {
   const stack: string[] = ctx.getRegister('partialStack', [])
-  if (stack.includes(filepath)) throw new Error(`${tag} tag cannot be nested`)
+  if (ctx.renderLimit.isUnlimited() && stack.includes(filepath)) {
+    throw new Error(`${tag} tag cannot be nested`)
+  }
   stack.push(filepath)
 }
 

src/util/limiter.ts

@@ -19,4 +19,7 @@ export class Limiter {
       assert(+count <= this.limit, this.message)
     }
   }
+  isUnlimited () {
+    return !Number.isFinite(this.limit)
+  }
 }