Fix restrictLayoutsTo containment checks for absolute paths

lib/hbs.js

@@ -100,7 +100,14 @@ ExpressHbs.prototype.cacheLayout = function(layoutFile, useCache, cb) {
   var self = this;
 
   if (this.restrictLayoutsTo) {
-    if (!layoutFile.startsWith(this.restrictLayoutsTo)) {
+    var restrictLayoutsTo = path.resolve(this.restrictLayoutsTo);
+    var resolvedLayoutFile = path.resolve(layoutFile);
+    var relativeLayoutPath = path.relative(restrictLayoutsTo, resolvedLayoutFile);
+    var isOutsideRestrictedDir = relativeLayoutPath === '..' ||
+      relativeLayoutPath.startsWith('..' + path.sep) ||
+      path.isAbsolute(relativeLayoutPath);
+
+    if (isOutsideRestrictedDir) {
       var err = new Error('Cannot read ' + layoutFile + ' it does not reside in ' + this.restrictLayoutsTo);
       return cb(err, null);
     }

test/layoutSpecs.js

@@ -88,6 +88,20 @@ describe('layouts', function() {
       });
     });
 
+    it ('should allow absolute layout path when restrictLayoutsTo is relative', function(done) {
+      var render = hbs.create().express3({
+        restrictLayoutsTo: path.relative(process.cwd(), dirname)
+      });
+      var locals = createLocals('express3', dirname, {
+        layout: path.resolve(path.join(dirname, 'layouts/default'))
+      });
+
+      render(dirname + '/aside.hbs', locals, function(err, html) {
+        assert.equal('<dld>aside</dld>', stripWs(html));
+        done();
+      });
+    });
+
     it('should error when using a layout outside of the restrictLayoutsTo', function(done) {
       var render = hbs.create().express3({
         restrictLayoutsTo: path.resolve(path.join(__dirname, '../'))
@@ -102,6 +116,22 @@ describe('layouts', function() {
       });
     });
 
+    it('should error when layout path only matches restrictLayoutsTo as a prefix', function(done) {
+      var render = hbs.create().express3({
+        restrictLayoutsTo: dirname
+      });
+      var locals = createLocals('express3', dirname, {
+        layout: path.resolve(path.join(__dirname, 'views/disableLayoutDirectiveEvil/layouts/default'))
+      });
+
+      render(dirname + '/aside.hbs', locals, function(err, html) {
+        if (!err) {
+          return done(new Error('We expect an error when reading'));
+        }
+        return done();
+      });
+    });
+
     it ('should not process template-specified layout when options.layout is falsy', function(done) {
       var render = hbs.create().express3({
         restrictLayoutsTo: dirname

test/views/disableLayoutDirectiveEvil/layouts/default.hbs

@@ -0,0 +1 @@
+<evil>{{{body}}}</evil>