version: bump to 0.97.2

we're now doing some extra work to sanitize paths in include keys.

src/template.sh

@@ -31,20 +31,22 @@ function render() {
 			# below check prevents the loop loading itself as a template.
 			# this is possibly not enough to prevent all recursions, but
 			# i see it as a last-ditch measure. so it'll do here.
-			if [[ "$file" == "$tplfile" ]]; then
-				subtemplate+="s${_tpl_ctrl}\{\{\#$key\}\}${_tpl_ctrl}I cowardly refuse to endlessly recurse\!${_tpl_ctrl}g;"
-			# elif [[ -f "$key" ]]; then
-			else
 			local i
 			local IFS=''
 
+			_old_tplfile="$tplfile"
 			_template_find_absolute_path "$key"
+			if [[ "$(realpath "$tplfile")" == "$_old_tplfile" ]]; then
+				subtemplate+="s${_tpl_ctrl}\{\{\#$key\}\}${_tpl_ctrl}I cowardly refuse to endlessly recurse\!${_tpl_ctrl}g;"
+				continue
+			fi
+			# don't even try to include files below httpsh's root
+			[[ "$(realpath "$tplfile")" != "$(dirname "$(realpath "${cfg[namespace]}")")"* ]] && continue
 			local input="$(tr -d "${_tpl_ctrl}${_tpl_newline}" < "$tplfile" | sed 's/\&/<2F>UwU<77>/g')"
 			garbage+="$input"$'\n'
 			input="$(tr $'\n' "${_tpl_newline}" <<< "$input")" # for another hack
 			subtemplate+="s${_tpl_ctrl}\{\{\#$key\}\}${_tpl_ctrl}${input}${_tpl_ctrl};"
 			_template_find_special_uri "$(cat "$tplfile")"
-			fi
 		done <<< "$(grep -Poh '{{#\K(.*?)(?=}})' <<< "$template")"
 
 		buf+="${subtemplate}"
@@ -138,8 +140,10 @@ function render() {
 #
 # _template_find_absolute_path(name) -> $tplfile
 _template_find_absolute_path() {
-	if [[ ! "${template_relative_paths}" || "$1" == /dev/stdin || "$1" == "/dev/fd/"* ]]; then
+	if [[ "$1" == /dev/stdin || "$1" == "/dev/fd/"* ]]; then
 		tplfile="$1"
+	elif [[ ! "${template_relative_paths}" ]]; then
+		tplfile="${cfg[namespace]}/$1"
 	else
 		for (( i=0; i<${#template_relative_paths[@]}; i++ )); do
 			if [[ -f "${template_relative_paths[i]}/$1" ]]; then

src/version.sh

@@ -1,2 +1,2 @@
 #!/usr/bin/env bash
-HTTPSH_VERSION=0.97.1
+HTTPSH_VERSION=0.97.2