Yang JunandCursor a7efcc8f96 fix(security): reject render/include partial recursion ...

Detect cyclic partial rendering via a shared partialStack register (same pattern as CVE-2026-41311 block tag fix). Self-referential or circular {% render %} and {% include %} now throw immediately instead of hanging or OOM.

Co-authored-by: Cursor <[email protected]>

2026-06-14 22:56:36 +08:00

..

demo

test: refactor test:demo script into demo/*/test.sh

2024-08-29 01:30:25 +08:00

e2e

fix(security): reject render/include partial recursion

2026-06-14 22:56:36 +08:00

integration

fix(security): reject render/include partial recursion

2026-06-14 22:56:36 +08:00

stub

fix: use realpath for fs.contains (#867)

2026-04-06 14:40:35 +08:00

.eslintrc.json

chore: split Github Actions workflows

2023-06-05 23:32:35 +08:00

tsconfig.json

fix: path traversal vulnerability, #851 (#855)

2026-03-08 02:36:09 +08:00