fix: use realpath for fs.contains

test/e2e/parse-and-render.spec.ts

@@ -1,4 +1,7 @@
 import { Liquid } from '../..'
+import { mkdtempSync, writeFileSync, symlinkSync, rmSync } from 'fs'
+import { join } from 'path'
+import { tmpdir } from 'os'
 
 describe('.parseAndRender()', function () {
   var engine: Liquid, strictEngine: Liquid
@@ -57,4 +60,25 @@ describe('.parseAndRender()', function () {
     const html = await engine.parseAndRender(src)
     expect(html).toBe('true')
   })
+  describe('symlink outside root', function () {
+    let root: string, secret: string
+    beforeAll(function () {
+      root = mkdtempSync(join(tmpdir(), 'liquid-e2e-root-'))
+      secret = join(tmpdir(), `liquid-e2e-secret-${Date.now()}.liquid`)
+      writeFileSync(secret, 'SECRET_OUTSIDE')
+      symlinkSync(secret, join(root, 'link.liquid'))
+    })
+    afterAll(function () {
+      rmSync(root, { recursive: true, force: true })
+      rmSync(secret, { force: true })
+    })
+    it('should not render a symlink partial whose target is outside root', async function () {
+      const e = new Liquid({ root: [root], extname: '.liquid', relativeReference: false })
+      await expect(e.parseAndRender('{% render "link" %}')).rejects.toThrow(/ENOENT|Failed to lookup/)
+    })
+    it('should not render a symlink partial via parseAndRenderSync', function () {
+      const e = new Liquid({ root: [root], extname: '.liquid', relativeReference: false })
+      expect(() => e.parseAndRenderSync('{% render "link" %}')).toThrow(/ENOENT|Failed to lookup/)
+    })
+  })
 })