Limit `include` access

Hi,

Recently we run into security issue with EJS include being able to access any file on the system. Which means, that any application running on common server could include files from home, root and and other personal data directories.

It’s possible to do something like this <%- include('/path/to/home/.ssh/id_rsa' %>, stealing private content from the server. This is quite a big breach, potentially leading to many problems.

I was investigating the possibilities of limiting EJS include for some specific fs scope, and seems like there’s no workaround for this, except special node environment set-up in isolated sandbox or forking EJS. I also tried to override include helper function, which is possible, but I couldn’t managed to implement scoping for nested includes. Also, legacy support for older include syntax is not possible to override from outside.

Potential solution for the problem is based on providing an additional option with defined sandbox directory path. This option could be then used to limit fs lookups, limiting access outside defined space.

[therobhrt]

@RyanZim I have my fork done (https://github.com/operatino/ejs/commit/3bb676f3e8b77eaa7f4ea774185c2ff2ed17b950), will do a PR as soon as I’ll have time.

[RyanZim]

@operatino, are you working on this?