blogs/hugo
1
0
Fork 0
mirror of https://github.com/gohugoio/hugo.git synced 2026-08-24 15:28:54 +00:00
Code Issues Packages Projects Releases Wiki Activity

Drop symlinks in parent directories

Browse Source 
Lstat only refrains from following the last element of a path, so a symlink
in an intermediate directory was still resolved, and reads could escape the
mount via e.g. resources.Get "symlinkdir/secret.txt".

Walk the directories up to the mount root and reject any that is a symlink.

Follow-up to cf9c8f93c and f8b5fa09a.
This commit is contained in:
Bjørn Erik Pedersen
2026-07-25 12:40:04 +02:00
parent 1b701b72ca
commit f228c87d41
4 changed files with 60 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
testscripts/commands/no_symlinks.txt
+15 -3
View File
@@ -18,6 +18,7 @@ stdout 'modstatictok'
! stdout 'modstaticsymlink'
stdout pageok
! stdout pagesymlink
! stdout rootdirfile
-- hugo.toml --
disableKinds = ["taxonomy", "term", "rss"]
@@ -30,15 +31,24 @@ Read me.
{{ with resources.Get "modassetsymlink.txt"}}FAIL {{ .Publish }}{{ else }}OK{{ end }}
{{ with resources.GetMatch "modassetsymlink.txt"}}FAIL {{ .Publish }}{{ else }}OK{{ end }}
{{ with resources.GetMatch "myassets/symlinkdir/**"}}FAIL {{ .Publish }}{{ else }}OK{{ end }}
{{ with resources.Get "myassets/symlinkdir/rootdirfile1.txt"}}FAIL {{ .Publish }}{{ else }}OK{{ end }}
Page: {{ .RelPermalink }}|{{ .Content }}|
{{/* os template package. */}}
{{ $symFilePath := "content/pagesymlink.md" }}
{{ with os.ReadDir "assets/myassets/symlinkdir" }}FAIL {{ len . }}{{ else }}OK{{ end }}
{{ with os.Stat $symFilePath }}FAIL{{ else }}OK{{ end }}
{{ with os.ReadFile $symFilePath }}FAIL{{ else }}OK{{ end }}
{{ with os.FileExists $symFilePath }}FAIL{{ else }}OK{{ end }}
{{ template "check-os-path" $symFilePath }}
{{ $symFilePath = "assets/myassets/symlinkdir/rootdirfile1.txt" }}
{{ template "check-os-path" $symFilePath }}
{{ $symFilePath = "assets/myassets/symlinkdir/subdir/rootdirfile3.txt" }}
{{ template "check-os-path" $symFilePath }}
{{ define "check-os-path" }}
{{ with os.Stat . }}FAIL{{ else }}OK{{ end }}
{{ with os.ReadFile . }}FAIL{{ else }}OK{{ end }}
{{ with os.FileExists . }}FAIL{{ else }}OK{{ end }}
{{ end }}
-- content/pageok.md --
-- themes/mytheme/assets/modassetok.txt --
@@ -53,5 +63,7 @@ My file.
Rootdirfile1 content.
-- rootdir/rootdirfile2.txt --
Rootdirfile2 content.
-- rootdir/subdir/rootdirfile3.txt --
Rootdirfile3 content.