comark/cast/path-outside-root · Keep cast paths under the root

A cast can't be read from outside the plugin's root, so a src that climbs out with ../, or a symlink that leads out, renders nothing. Otherwise a document could print any file the build can read, such as a key in the home folder, into the page.

Incorrect

::cast{src="../../.ssh/id_ed25519"}
::

lint-comark example.mdexample.md:1:1 comark/cast/path-outside-root::cast 1 "../../.ssh/id_ed25519": the path leaves the root.Move the file under the root or widen root.✖ 1 problem

Correct

::cast{src="deploy.cast"}
::

lint-comark example.md✔ No problems