mirrors/hugo
1
0
Fork 0
mirror of https://github.com/gohugoio/hugo.git synced 2025-04-27 06:00:25 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Block symlink dir traversal for /static

Browse source 
This is in line with how it behaved before, but it was lifted a little for the project mount for Hugo Modules,
but that could create hard-to-detect loops.
This commit is contained in:
Bjørn Erik Pedersen 2019-07-25 00:12:40 +02:00
parent 87a07282a2
commit e5f2299741
24 changed files with 320 additions and 130 deletions
Download patch file Download diff file Expand all files Collapse all files

32
hugolib/hugo_modules_test.go
View file

@ -443,6 +443,7 @@ weight = 2
`
b := newTestSitesBuilder(t).WithNothingAdded().WithWorkingDir(workDir)
b.WithLogger(loggers.NewErrorLogger())
b.Fs = fs
b.WithConfigFile("toml", config)
@ -457,35 +458,46 @@ weight = 2
bfs := b.H.BaseFs
for _, componentFs := range []afero.Fs{
for i, componentFs := range []afero.Fs{
bfs.Static[""].Fs,
bfs.Archetypes.Fs,
bfs.Content.Fs,
bfs.Data.Fs,
bfs.Assets.Fs,
bfs.Static[""].Fs,
bfs.I18n.Fs} {
for i, id := range []string{"mod", "project"} {
if i != 0 {
continue
}
for j, id := range []string{"mod", "project"} {
statCheck := func(fs afero.Fs, filename string, isDir bool) {
shouldFail := j == 0
if !shouldFail && i == 0 {
// Static dirs only supports symlinks for files
shouldFail = isDir
}
statCheck := func(fs afero.Fs, filename string) {
shouldFail := i == 0
_, err := fs.Stat(filepath.FromSlash(filename))
if err != nil {
if strings.HasSuffix(filename, "toml") && strings.Contains(err.Error(), "files not supported") {
if i > 0 && strings.HasSuffix(filename, "toml") && strings.Contains(err.Error(), "files not supported") {
// OK
return
}
}
if shouldFail {
assert.Error(err)
assert.Equal(hugofs.ErrPermissionSymlink, err)
assert.Equal(hugofs.ErrPermissionSymlink, err, filename)
} else {
assert.NoError(err)
assert.NoError(err, filename)
}
}
statCheck(componentFs, fmt.Sprintf("realsym%s", id))
statCheck(componentFs, fmt.Sprintf("real/datasym%s.toml", id))
statCheck(componentFs, fmt.Sprintf("realsym%s", id), true)
statCheck(componentFs, fmt.Sprintf("real/datasym%s.toml", id), false)
}
}