3cd024d652
fix: path traversal vulnerability, #851 ( #855 )
...
* Fix Path Traversal fallback
* Update loader.ts
Fixed nested
* Update loader.ts
padding fix
* refactor: reuse root enforcing
* docs: update test case and docs
---------
Co-authored-by: MorielHarush <[email protected]
2026-03-08 02:36:09 +08:00
Jun Yang and GitHub
e4aeb023fd
feat: locale support for date filter, #567 ( #723 )
2024-07-22 00:39:44 +08:00
Jun Yang
92992689cd
refactor: Tag class support in registerTag()
2022-11-27 14:04:01 +08:00
Harttle and Harttle
95fc705b5d
chore: upgrade typescript
2021-12-11 20:23:09 +08:00
Harttle and Harttle
44f6b520d5
fix: always allow './' and '../' to be relative, even on windows
2021-11-06 03:36:39 +08:00
Harttle and Harttle
aebeae9e1b
fix: relative root (by default) yields LookupError, fixes #419 , #424 , also related to #395
2021-10-27 23:55:39 +08:00
Harttle and harttle
d4df3a0b53
refactor: make loader.shouldLoadRelative public
2021-10-16 12:30:09 +08:00
Harttle and harttle
9cfa43b8ae
fix: hardcoded '/' in normalized options.fs, fixes #412 , #408
...
Changes including:
- will not call fs.resolve when normalizing `fs`
- removed hardcoded `/`
- mandatory `fs.dirname` for relative reference
- mandatory `fs.sep`, defaults to '/'
2021-10-16 12:10:55 +08:00
Harttle
1de6adf308
test: cases for parse(<tpl>, <relative filepath>), #395
2021-10-10 20:37:26 +08:00
Harttle
822ba0be0f
fix: skip root check for renderFile()
2021-10-06 18:38:58 +08:00
Harttle
a3455ebd0b
feat: relativeReference for render/include/layout, #395
...
- `relativeReference` is enabled by default, set to `false` to disable
- Referenced files are still constrained within root/partias/layouts
- fix: relative filenames are not constrained (which allows arbitrary filesystem read)
Example Usage:
{% render "../foo/bar.html" %}
Note:
../foo/bar.html' should also be within `partials` (or `root` if `partials` not set)
2021-10-06 17:36:37 +08:00
Harttle
92bfc65e0b
fix: directory info in lookupError message, #395
2021-10-04 12:11:54 +08:00
harttle
b9ae479b65
feat: add layouts, partials apart from root, #395
2021-10-03 18:51:14 +08:00
