Yang Jun and GitHub
f41c1fc02f
fix: enforce root containment for renderFile/parseFile lookups ( #870 )
...
Made-with: Cursor
2026-04-07 23:18:53 +08:00
Yang Jun and GitHub
529dd67eeb
fix: use realpath for fs.contains ( #867 )
...
* fix: use realpath for fs.contains
* chore: reset file mode changes
Made-with: Cursor
* fix: Windows compat for contains/containsSync and toLiquidAsync arg order
Made-with: Cursor
2026-04-06 14:40:35 +08:00
Harttle
94440a0653
chore: more strict mem limit for string filters
2026-03-22 22:10:39 +08:00
3cd024d652
fix: path traversal vulnerability, #851 ( #855 )
...
* Fix Path Traversal fallback
* Update loader.ts
Fixed nested
* Update loader.ts
padding fix
* refactor: reuse root enforcing
* docs: update test case and docs
---------
Co-authored-by: MorielHarush <[email protected]
2026-03-08 02:36:09 +08:00
Yang Jun
e5fbdfe434
fix: use cwd to resolve npm partials for Node.JS
2024-08-30 01:08:39 +08:00
Jun Yang and GitHub
e4aeb023fd
feat: locale support for date filter, #567 ( #723 )
2024-07-22 00:39:44 +08:00
Yang Jun
e443068cb9
feat: DoS prevention, #250
2024-07-09 22:51:11 +08:00
Yang Jun
fad00aa14e
test: edge cases for map fs
2024-07-09 22:51:11 +08:00
Harttle
df27ac6947
feat: support in-memory template mapping, inspired by @jg-rp #714
2024-07-08 02:25:25 +08:00
Harttle and Jun Yang
da93102c1c
chore: upgrade API doc to latest typedoc, fixes #593
2023-03-20 00:41:06 +08:00
Harttle and Jun Yang
c6cde9cd10
chore: migrate test cases from Chai to Jest
2023-03-20 00:41:06 +08:00
Jun Yang
92992689cd
refactor: Tag class support in registerTag()
2022-11-27 14:04:01 +08:00
Harttle
b377dad9e3
fix: lazy createRequire to allow exceptions being catched, fixes #497
2022-04-19 23:44:14 +08:00
Harttle
eec381ec72
fix: use createRequire for ESM, fixes #334
2022-04-18 00:43:17 +08:00
Harttle and Harttle
95fc705b5d
chore: upgrade typescript
2021-12-11 20:23:09 +08:00
Harttle and Harttle
6023d9ba10
docs: path traversal vulnerabilities when customizing FS
2021-12-11 12:31:08 +08:00
Harttle and Harttle
44f6b520d5
fix: always allow './' and '../' to be relative, even on windows
2021-11-06 03:36:39 +08:00
Harttle and Harttle
aebeae9e1b
fix: relative root (by default) yields LookupError, fixes #419 , #424 , also related to #395
2021-10-27 23:55:39 +08:00
Harttle and harttle
d4df3a0b53
refactor: make loader.shouldLoadRelative public
2021-10-16 12:30:09 +08:00
Harttle and harttle
9cfa43b8ae
fix: hardcoded '/' in normalized options.fs, fixes #412 , #408
...
Changes including:
- will not call fs.resolve when normalizing `fs`
- removed hardcoded `/`
- mandatory `fs.dirname` for relative reference
- mandatory `fs.sep`, defaults to '/'
2021-10-16 12:10:55 +08:00
Harttle
1de6adf308
test: cases for parse(<tpl>, <relative filepath>), #395
2021-10-10 20:37:26 +08:00
Harttle
822ba0be0f
fix: skip root check for renderFile()
2021-10-06 18:38:58 +08:00
Harttle
a3455ebd0b
feat: relativeReference for render/include/layout, #395
...
- `relativeReference` is enabled by default, set to `false` to disable
- Referenced files are still constrained within root/partias/layouts
- fix: relative filenames are not constrained (which allows arbitrary filesystem read)
Example Usage:
{% render "../foo/bar.html" %}
Note:
../foo/bar.html' should also be within `partials` (or `root` if `partials` not set)
2021-10-06 17:36:37 +08:00
Harttle
92bfc65e0b
fix: directory info in lookupError message, #395
2021-10-04 12:11:54 +08:00
harttle
b9ae479b65
feat: add layouts, partials apart from root, #395
2021-10-03 18:51:14 +08:00
harttle
6ea6881f08
feat: with & for in render tag, closes #195
2020-03-04 07:08:54 +08:00
harttle
2dd43559b5
feat: support require.resolve for lookup, see #168
2019-11-07 18:46:37 +08:00
harttle
7fb01ad69a
feat: renderSync, parseAndRenderSync and renderFileSync, see #48
2019-08-26 10:15:43 -05:00
harttle
88c89fe3b3
style: introduce @typescript-eslint/recommended
2019-07-06 14:33:34 +08:00
harttle
5b6100d12b
refactor: strictly typed
2019-02-23 00:49:54 +08:00
harttle
852c6ad453
refactor: remove mock-fs from dev dependency
2019-02-19 22:28:27 +08:00
