'May not bypass ALLOWED_INCLUDE_ROOTS with relative paths
e.g. if ALLOWED_INCLUDE_ROOTS = ("/var/www",), it should not be
possible to do {% ssi "/var/www/../../etc/passwd" %}'

def test_relative_include_exploit(self):

    disallowed_paths = [os.path.join(self.ssi_dir, u'..', u'ssi_include.html'), os.path.join(self.ssi_dir, u'..', u'second', u'test.html')]
    with override_settings(ALLOWED_INCLUDE_ROOTS=(self.ssi_dir,)):
        for path in disallowed_paths:
            self.assertEqual(self.render_ssi(path), u'')
