fix of #1450 (comment)

Former-commit-id: 2b8dfec7d43298bc9ace94595359867180634f04

go.mod

@@ -18,7 +18,7 @@ require (
 	github.com/iris-contrib/go.uuid v2.0.0+incompatible
 	github.com/iris-contrib/pongo2 v0.0.1
 	github.com/iris-contrib/schema v0.0.1
-	github.com/iris-contrib/jade v1.1.1
+	github.com/iris-contrib/jade v1.1.2
 	github.com/json-iterator/go v1.1.9
 	github.com/kataras/golog v0.0.10
 	github.com/kataras/neffos v0.0.14

view/pug.go

@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"io/ioutil"
 	"path"
+	"strings"
 
 	"github.com/iris-contrib/jade"
 )
@@ -22,28 +23,34 @@ import (
 // https://github.com/kataras/iris/tree/master/_examples/view/template_pug_3
 func Pug(directory, extension string) *HTMLEngine {
 	s := HTML(directory, extension)
+
 	s.middleware = func(name string, text []byte) (contents string, err error) {
+		name = path.Join(path.Clean(directory), name)
 		tmpl := jade.New(name)
-		// Fixes: https://github.com/kataras/iris/issues/1450
-		// by adding a custom ReadFunc inside the jade parser.
-		// And Also able to use relative paths on "extends" and "include" directives:
-		// e.g. instead of extends "templates/layout.pug" we use "layout.pug"
-		// so contents of templates are independent of their root location.
 		tmpl.ReadFunc = func(name string) ([]byte, error) {
-			name = path.Join(directory, name)
+			if !strings.HasPrefix(path.Clean(name), path.Clean(directory)) {
+				name = path.Join(directory, name)
+			}
+
 			if s.assetFn != nil {
 				return s.assetFn(name)
 			}
 			return ioutil.ReadFile(name)
 		}
 
-		tmpl, err = tmpl.Parse(text)
+		// Fixes: https://github.com/kataras/iris/issues/1450
+		// by adding a custom ReadFunc inside the jade parser.
+		// And Also able to use relative paths on "extends" and "include" directives:
+		// e.g. instead of extends "templates/layout.pug" we use "layout.pug"
+		// so contents of templates are independent of their root location.
+
+		exec, err := tmpl.Parse(text)
 		if err != nil {
 			return
 		}
 
 		b := new(bytes.Buffer)
-		tmpl.WriteIn(b)
+		exec.WriteIn(b)
 		return b.String(), nil
 	}
 	return s