fix(security): allow partial recursion when renderLimit is finite

Only reject render/include cycles when renderLimit is unlimited (default Infinity). With a finite time budget, recursion is bounded by renderLimit checks in renderTemplates.

Co-authored-by: Cursor <[email protected]>

test/integration/tags/include.spec.ts

@@ -311,6 +311,13 @@ describe('tags/include', function () {
       })
       return expect(liquid.renderFile('/a.html')).rejects.toThrow(/include tag cannot be nested/)
     })
+    it('should allow self-referential {% include %} when renderLimit is finite', function () {
+      mock({
+        '/self.html': 'A{% include "self.html" %}B'
+      })
+      const limited = new Liquid({ root: '/', renderLimit: 0.01 })
+      return expect(limited.renderFile('/self.html')).rejects.toThrow(/template render limit exceeded/)
+    })
     it('should allow legitimate nested {% include %} chain', async function () {
       mock({
         '/a.html': 'A{% include "b.html" %}',

test/integration/tags/render.spec.ts

@@ -407,6 +407,10 @@ describe('tags/render', function () {
       })
       await expect(liquid.renderFile('/a.html')).rejects.toThrow(/render tag cannot be nested/)
     })
+    it('should allow self-referential {% render %} when renderLimit is finite', async function () {
+      const liquid = new Liquid({ templates: { self: '{% render "self" %}' }, renderLimit: 0.01 })
+      await expect(liquid.parseAndRender('{% render "self" %}')).rejects.toThrow(/template render limit exceeded/)
+    })
     it('should allow legitimate nested {% render %} chain', async function () {
       mock({
         '/a.html': 'A{% render "b.html" %}',