mirror of
https://github.com/gohugoio/hugo.git
synced 2026-08-24 15:28:54 +00:00
Bjørn Erik Pedersen
f228c87d41
Lstat only refrains from following the last element of a path, so a symlink in an intermediate directory was still resolved, and reads could escape the mount via e.g. resources.Get "symlinkdir/secret.txt". Walk the directories up to the mount root and reject any that is a symlink. Follow-up tocf9c8f93candf8b5fa09a.
70 lines
2.0 KiB
Plaintext
70 lines
2.0 KiB
Plaintext
[windows] skip
|
|
|
|
ln ./rootfile.txt ./themes/mytheme/assets/modassetsymlink.txt
|
|
ln ./rootfile.txt ./themes/mytheme/static/modstaticsymlink.txt
|
|
ln ./README.md ./content/pagesymlink.md
|
|
ln ./rootdir ./assets/myassets/symlinkdir
|
|
|
|
hugo
|
|
|
|
grep 'OK' public/index.html
|
|
! grep 'FAIL' public/index.html
|
|
|
|
tree public
|
|
|
|
stdout modassetok
|
|
! stdout modassetsymlink
|
|
stdout 'modstatictok'
|
|
! stdout 'modstaticsymlink'
|
|
stdout pageok
|
|
! stdout pagesymlink
|
|
! stdout rootdirfile
|
|
|
|
-- hugo.toml --
|
|
disableKinds = ["taxonomy", "term", "rss"]
|
|
[[module.imports]]
|
|
path = 'mytheme'
|
|
-- README.md --
|
|
Read me.
|
|
-- layouts/all.html --
|
|
{{ with resources.Get "modassetok.txt"}}OK {{ .Publish }}{{ else }}FAIL{{ end }}
|
|
{{ with resources.Get "modassetsymlink.txt"}}FAIL {{ .Publish }}{{ else }}OK{{ end }}
|
|
{{ with resources.GetMatch "modassetsymlink.txt"}}FAIL {{ .Publish }}{{ else }}OK{{ end }}
|
|
{{ with resources.GetMatch "myassets/symlinkdir/**"}}FAIL {{ .Publish }}{{ else }}OK{{ end }}
|
|
{{ with resources.Get "myassets/symlinkdir/rootdirfile1.txt"}}FAIL {{ .Publish }}{{ else }}OK{{ end }}
|
|
Page: {{ .RelPermalink }}|{{ .Content }}|
|
|
|
|
{{/* os template package. */}}
|
|
{{ $symFilePath := "content/pagesymlink.md" }}
|
|
|
|
{{ with os.ReadDir "assets/myassets/symlinkdir" }}FAIL {{ len . }}{{ else }}OK{{ end }}
|
|
{{ template "check-os-path" $symFilePath }}
|
|
{{ $symFilePath = "assets/myassets/symlinkdir/rootdirfile1.txt" }}
|
|
{{ template "check-os-path" $symFilePath }}
|
|
{{ $symFilePath = "assets/myassets/symlinkdir/subdir/rootdirfile3.txt" }}
|
|
{{ template "check-os-path" $symFilePath }}
|
|
|
|
{{ define "check-os-path" }}
|
|
{{ with os.Stat . }}FAIL{{ else }}OK{{ end }}
|
|
{{ with os.ReadFile . }}FAIL{{ else }}OK{{ end }}
|
|
{{ with os.FileExists . }}FAIL{{ else }}OK{{ end }}
|
|
{{ end }}
|
|
|
|
-- content/pageok.md --
|
|
-- themes/mytheme/assets/modassetok.txt --
|
|
Content.
|
|
-- themes/mytheme/static/modstatictok.txt --
|
|
Content.
|
|
-- rootfile.txt --
|
|
Root Content.
|
|
-- assets/myassets/myfile.txt --
|
|
My file.
|
|
-- rootdir/rootdirfile1.txt --
|
|
Rootdirfile1 content.
|
|
-- rootdir/rootdirfile2.txt --
|
|
Rootdirfile2 content.
|
|
-- rootdir/subdir/rootdirfile3.txt --
|
|
Rootdirfile3 content.
|
|
|
|
|