Relative partials and access control

[harttle]

Hi guys, thank you for stick with LiquidJS. We recently released v9.28 with streaming and relative includes, but it exposes multiple bugs (mainly on root option, fs option, render/layout/include tags) at the same time. After some investigation I find it difficult to keep all the promised features in #412 #419 #395 without breaking or non-intuitive change. So here's a summary of these features/bugs and what I'm planning to do:

Current State Summary

Features we need/want to implement:

• reference another file by relative pathname, like {% include "../paritals/footer.liquid %}
• access control to avoid arbitrary file reading like {% include "../../../../../etc/passwd" %}
• separated root for partials and layouts, apart from existing root option
• predictable root passed to fs.resolve(root, file, ext)

Problems:

• we need to know whether a resolved file is within root, currently there's no such capability on fs interface/option

Options and plan

Option1: add an optional fs.contains (Maybe I'm planning to do this)

• Pros: access control won't break anyone haven't tune in this option.
• Cons: It's wierd to have a contains method in FileSystem.

Option2: use existing fs.resolve to normalize root, partials, layout option, add a fs.sep option.

• Pros: the fs interface is more clean and more intuitive.
• Cons:
  • second argument file now could be undefiend in fs.resolve(root: string, file: string, ext: string).
  • first argument in fs.resolve(root: string, ...) will be a normalized/resolved root instead of the root option specified when creating Liquid instance.
  • the contains logic implementing Access Control will be hardcoded as file.startsWith(root + fs.sep), maybe confusing for someone come up with a filesystem implementation not aligh with this assumption.

What you think? I need to know what's your opinion. Please feel free to post your ideas.

[harttle]

Just to mention, master from 9.28 to 9.28.2 is broken on partials and layouts. If you get a LookupError, try 9.28.3 for the latest fix.