Bjørn Erik Pedersen 79f030be5b config/security: Add "! " negation to Whitelist, harden default http.urls ...

Whitelist now treats any pattern prefixed with "! " (the same negation
prefix used by hglob/predicate) as a deny rule. Deny matches take
precedence over allow, and a whitelist made up exclusively of deny
rules implicitly allows everything it does not deny.

The default security.http.urls now reads:

    urls = ['(?i)^https?://[a-z]', '! (?i)localhost', '! @']

i.e. allow URLs whose host starts with a letter (the common
"https://example.com" shape), deny anything that looks like localhost,
and deny URLs with userinfo to foil "http://user@127.0.0.1/" bypasses.
Public IP literals are collateral blocks; users who need them (or their
own private hosts) override security.http.urls as before, mixing allow
and deny rules with the same "! " prefix, e.g.

    [security.http]
    urls = ['.*', '! ^https?://evil\.example\.com']

Fixes #14792

2026-04-22 20:15:19 +02:00

..

doctree

all: Run go fix ./...

2026-03-07 18:30:42 +01:00

filesystems

Harden Node tool execution with --permission flag

2026-04-22 15:47:34 +02:00

pagesfromdata

resources/page: Fix shared reader in Source.ValueAsOpenReadSeekCloser

2026-03-28 21:32:28 +01:00

paths

Add roles and versions as new dimensions (in addition to language)

2025-11-05 20:39:25 +01:00

roles

Add range matchers for site matrix vector store filtering

2026-01-22 12:03:02 +01:00

segments

Rename common/maps to common/hmaps (#14384)

2026-01-16 11:47:46 +01:00

sitesmatrix

Fix filename dimension identifiers (_role_X_, _version_X_) to replace mount config

2026-04-15 20:34:34 +02:00

testdata

Allow whitelisting mediaTypes used in resources.GetRemote

2023-05-20 20:16:45 +02:00

testsite

Add support for CODEOWNERS

2022-02-23 22:43:19 +01:00

versions

Allow v1,v2 etc. style version names while still supporting full semver in queries

2026-01-23 18:53:32 +01:00

404_test.go

Fix panic when 404 is backed by a content file

2025-12-20 13:42:21 +01:00

alias_test.go

hugolib: Don't render default site redirect for non-primary isHTML output formats

2026-02-08 17:35:32 +01:00

alias.go

For multiple dimensions setups, fix alias handling and multihost publish path

2026-01-10 15:34:51 +01:00

breaking_changes_test.go

all: Rework page store, add a dynacache, improve partial rebuilds, and some general spring cleaning

2024-01-27 16:28:14 +01:00

cascade_test.go

Rename deprecated cascade._target to cascade.target in tests

2026-04-07 13:58:06 +02:00

codeowners.go

Create a struct with all of Hugo's config options

2023-05-16 18:01:29 +02:00

collections.go

Add roles and versions as new dimensions (in addition to language)

2025-11-05 20:39:25 +01:00

config_legacy1_test.go

testing: Replace legacy config.toml with hugo.toml in most tests

2025-11-27 12:08:08 +01:00

config_test.go

all: Replace NewIntegrationTestBuilder with Test/TestE/TestRunning

2026-04-03 21:17:45 +02:00

config.go

resources/page: Deprecate cascade._target in favor of cascade.target

2026-02-12 13:50:37 +01:00

configdir_test.go

testing: Port integration tests to new templates structure

2025-11-27 12:00:15 +01:00

content_factory.go

hugolib: Use new build key in content placeholder

2025-04-27 13:18:43 +02:00

content_map_page_assembler.go

Replace the concurrent map with an identical upstream version

2026-04-20 18:33:59 +02:00

content_map_page_contentnode.go

hugolib: Fix automatic section pages not replaced by sites.complements

2026-02-20 21:23:20 +01:00

content_map_page_contentnodeshifter.go

hugolib: Fix automatic section pages not replaced by sites.complements

2026-02-20 21:23:20 +01:00

content_map_page.go

Fix it so we never auto-fallback to page resources in other roles/versions

2026-04-14 16:33:38 +02:00

content_map_test.go

all: Replace NewIntegrationTestBuilder with Test/TestE/TestRunning

2026-04-03 21:17:45 +02:00

content_map.go

Fix it so we never auto-fallback to page resources in other roles/versions

2026-04-14 16:33:38 +02:00

content_render_hooks_test.go

testing: Port integration tests to new templates structure

2025-11-27 12:00:15 +01:00

datafiles_test.go

Replace deprecated site.Data with hugo.Data in tests

2026-03-21 19:09:14 +01:00

dates_test.go

Replace deprecated site.Data with hugo.Data in tests

2026-03-21 19:09:14 +01:00

disableKinds_test.go

config: Skip taxonomy entries with empty keys or values

2026-02-23 12:22:39 +01:00

embedded_templates_test.go

Fix recently introduced partial rendering bug

2026-01-26 22:45:16 +01:00

fileInfo_test.go

tests: Convert from testify to quicktest

2019-08-12 13:26:32 +02:00

fileInfo.go

Add roles and versions as new dimensions (in addition to language)

2025-11-05 20:39:25 +01:00

frontmatter_test.go

all: Replace NewIntegrationTestBuilder with Test/TestE/TestRunning

2026-04-03 21:17:45 +02:00

gitinfo_github_test.go

Handle GitInfo for modules where Origin is not set when running go list

2026-02-25 14:26:50 +01:00

gitinfo.go

Handle GitInfo for modules where Origin is not set when running go list

2026-02-25 14:26:50 +01:00

hugo_modules_test.go

Replace deprecated site.Data with hugo.Data in tests

2026-03-21 19:09:14 +01:00

hugo_sites_build_errors_test.go

all: Run go fix ./...

2026-03-07 18:30:42 +01:00

hugo_sites_build_test.go

all: Run go fix ./...

2026-03-07 18:30:42 +01:00

hugo_sites_build.go

Replace deprecated site.Data with hugo.Data in tests

2026-03-21 19:09:14 +01:00

hugo_sites_multihost_test.go

Replace deprecated :filename with :contentbasename in the permalinks test

2026-03-18 08:47:26 +01:00

hugo_sites.go

Replace the concurrent map with an identical upstream version

2026-04-20 18:33:59 +02:00

hugo_smoke_test.go

Rename deprecated cascade._target to cascade.target in tests

2026-04-07 13:58:06 +02:00

hugolib_integration_test.go

all: Replace NewIntegrationTestBuilder with Test/TestE/TestRunning

2026-04-03 21:17:45 +02:00

integrationtest_builder.go

Harden Node tool execution with --permission flag

2026-04-22 15:47:34 +02:00

language_content_dir_test.go

Fix auto-creation of root sections in multilingual sites

2026-04-07 13:58:06 +02:00

language_test.go

Move to new locales library and upgrade CLDR from v36.1 to v48.1

2026-03-08 21:43:37 +01:00

menu_test.go

Fix menu pageRef resolution in multidimensional setups

2026-02-25 17:35:20 +01:00

minify_publisher_test.go

testing: Port integration tests to new templates structure

2025-11-27 12:00:15 +01:00

mount_filters_test.go

Replace deprecated site.Data with hugo.Data in tests

2026-03-21 19:09:14 +01:00

page__common.go

Move common/hugo/HugoInfo to resources/page

2026-02-17 19:10:47 +01:00

page__content.go

Fix RenderShortcodes leaking context markers when indented

2026-04-07 22:05:42 +02:00

page__data.go

Add roles and versions as new dimensions (in addition to language)

2025-11-05 20:39:25 +01:00

page__fragments_test.go

all: Replace NewIntegrationTestBuilder with Test/TestE/TestRunning

2026-04-03 21:17:45 +02:00

page__menus.go

Add roles and versions as new dimensions (in addition to language)

2025-11-05 20:39:25 +01:00

page__meta_test.go

testing: Port integration tests to new templates structure

2025-11-27 12:00:15 +01:00

page__meta.go

hugolib: Allow regular pages to cascade to self

2026-03-15 10:17:45 +01:00

page__new.go

Add roles and versions as new dimensions (in addition to language)

2025-11-05 20:39:25 +01:00

page__output.go

Make Page.Aliases more useful in multidimensional setups (note)

2026-01-23 18:52:35 +01:00

page__paginator.go

all: Rework page store, add a dynacache, improve partial rebuilds, and some general spring cleaning

2024-01-27 16:28:14 +01:00

page__paths.go

Add slice-based permalinks config with PageMatcher target

2026-04-19 19:45:45 +02:00

page__per_output.go

Fix some recently introduced Position issues

2026-04-04 14:53:20 +02:00

page__position.go

Remove items deprecated <= v0.136.0 (note)

2026-02-12 19:33:58 +01:00

page__ref.go

Add roles and versions as new dimensions (in addition to language)

2025-11-05 20:39:25 +01:00

page__tree.go

Speedup and simplify page assembly for deeper content trees

2025-11-25 11:37:05 +01:00

page_kinds.go

Move all Kind constants to its own package

2023-07-28 15:14:23 +02:00

page_permalink_test.go

testing: Port integration tests to new templates structure

2025-11-27 12:00:15 +01:00

page_test.go

all: Replace NewIntegrationTestBuilder with Test/TestE/TestRunning

2026-04-03 21:17:45 +02:00

page_unwrap_test.go

all: gofmt -w -r 'interface{} -> any' .

2022-03-17 22:03:27 +01:00

page_unwrap.go

all: Rework page store, add a dynacache, improve partial rebuilds, and some general spring cleaning

2024-01-27 16:28:14 +01:00

page.go

resources: Re-publish on transformation cache hit

2026-03-15 18:32:41 +01:00

pagebundler_test.go

all: Replace NewIntegrationTestBuilder with Test/TestE/TestRunning

2026-04-03 21:17:45 +02:00

pagecollections_test.go

all: Replace NewIntegrationTestBuilder with Test/TestE/TestRunning

2026-04-03 21:17:45 +02:00

pagecollections.go

Add roles and versions as new dimensions (in addition to language)

2025-11-05 20:39:25 +01:00

pages_capture.go

Add roles and versions as new dimensions (in addition to language)

2025-11-05 20:39:25 +01:00

pages_language_merge_test.go

testing: Port integration tests to new templates structure

2025-11-27 12:00:15 +01:00

pages_test.go

all: Run go fix ./...

2026-03-07 18:30:42 +01:00

paginator_test.go

all: Run go fix ./...

2026-03-07 18:30:42 +01:00

params_test.go

Rename deprecated cascade._target to cascade.target in tests

2026-04-07 13:58:06 +02:00

permalinker.go

all: Format code with gofumpt

2020-12-03 13:12:58 +01:00

prune_resources.go

Create a struct with all of Hugo's config options

2023-05-16 18:01:29 +02:00

rebuild_test.go

Fix panic on edit of legacy mapped template names that's also a valid path in the new setup

2026-04-08 13:19:45 +02:00

rendershortcodes_test.go

Fix RenderShortcodes leaking context markers when indented

2026-04-07 22:05:42 +02:00

renderstring_test.go

all: Replace NewIntegrationTestBuilder with Test/TestE/TestRunning

2026-04-03 21:17:45 +02:00

resource_chain_test.go

config/security: Add "! " negation to Whitelist, harden default http.urls

2026-04-22 20:15:19 +02:00

robotstxt_test.go

testing: Rewrite all the old style integration tests to txtar style tests

2025-11-10 12:00:58 +01:00

rss_test.go

testing: Port integration tests to new templates structure

2025-11-27 12:00:15 +01:00

securitypolicies_test.go

config/security: Add "! " negation to Whitelist, harden default http.urls

2026-04-22 20:15:19 +02:00

shortcode_page.go

Fix some RenderShortcodes error cases

2024-11-03 13:33:31 +01:00

shortcode_test.go

performance: Misc allocation improvements

2025-11-18 19:17:15 +01:00

shortcode.go

Fix some recently introduced Position issues

2026-04-04 14:53:20 +02:00

site_render.go

resources: Re-publish on transformation cache hit

2026-03-15 18:32:41 +01:00

site_sections_test.go

testing: Port integration tests to new templates structure

2025-11-27 12:00:15 +01:00

site_sections.go

Add roles and versions as new dimensions (in addition to language)

2025-11-05 20:39:25 +01:00

site_sites_test.go

hugolib: Move site.Data to hugo.Data, deprecate Site.AllPages/BuildDrafts/Languages

2026-02-18 14:34:47 +01:00

site_stats_test.go

all: Run go fix ./...

2026-03-07 18:30:42 +01:00

site_test.go

all: Replace NewIntegrationTestBuilder with Test/TestE/TestRunning

2026-04-03 21:17:45 +02:00

site_url_test.go

testing: Port integration tests to new templates structure

2025-11-27 12:00:15 +01:00

site.go

Fix some recently introduced Position issues

2026-04-04 14:53:20 +02:00

siteJSONEncode_test.go

testing: Port integration tests to new templates structure

2025-11-27 12:00:15 +01:00

sitemap_test.go

testing: Port integration tests to new templates structure

2025-11-27 12:00:15 +01:00

taxonomy_test.go

all: Run go fix ./...

2026-03-07 18:30:42 +01:00

template_test.go

all: Replace NewIntegrationTestBuilder with Test/TestE/TestRunning

2026-04-03 21:17:45 +02:00