blogs/hugo
1
0
Fork 0
mirror of https://github.com/gohugoio/hugo.git synced 2026-08-24 07:18:54 +00:00
Code Issues Packages Projects Releases Wiki Activity

Harden Node tool execution with --permission flag

Browse Source 
Add security.node.permissions config to run Node tools (PostCSS, Babel,
TailwindCSS) under Node's permission model, restricting file system access
to the working directory by default.

The binary resolution is simplified to node_modules/.bin → PATH (npx removed).
For both locations, the actual JS entry point is resolved via symlinks (macOS/Linux)
or by parsing npm wrapper scripts (Windows .cmd), then executed as
"node --permission --allow-fs-read=<path> --allow-fs-write=<path> <script>".

Users can opt out by removing "node" from security.exec.allow.

Closes #7287
This commit is contained in:
Bjørn Erik Pedersen
2026-04-11 12:41:48 +02:00
parent f5fce935e7
commit a54c398b93
16 changed files with 972 additions and 147 deletions
Download Patch File Download Diff File Expand all files Collapse all files
markup/asciidocext/asciidoc_integration_test.go
+1 -1
View File
@@ -264,7 +264,7 @@ defaultContentLanguageInSubdir = DEFAULT_CONTENT_LANGUAGE_IN_SUBDIR
dir = 'DIAGRAM_CACHEDIR'
[security.exec]
allow = ['^((dart-)?sass|git|go|npx|postcss|tailwindcss|asciidoctor)$']`
allow = ['^((dart-)?sass|git|go|node|postcss|tailwindcss|asciidoctor)$']`
func validatePublishedSite_1(b *hugolib.IntegrationTestBuilder) {
for _, file := range []publishedContentFile{