mirror/hugo
1
0
Fork 0
mirror of https://github.com/gohugoio/hugo.git synced 2025-09-02 22:52:51 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge commit 'e48ffb763572814a3788780bb9653dfa2daeae22'

Browse Source
This commit is contained in:
Bjørn Erik Pedersen
2021-01-20 12:48:39 +01:00
parent 07ad283f68 e48ffb7635
commit a1a9f088b1
28 changed files with 9236 additions and 91 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
docs/content/en/news/0.79.1-relnotes/index.md
View File

@@ -1,19 +1,22 @@
---
date: 2020-12-19
title: "Hugo 0.79.1: A couple of Bug Fixes"
description: "This version fixes a couple of bugs introduced in 0.79.0."
title: "Hugo 0.79.1: One Security Patch for Hugo on Windows"
description: "Disallow running of e.g. Pandoc in the current directory."
categories: ["Releases"]
images:
- images/blog/hugo-bug-poster.png
---
Hugo depends on Go's `os/exec` for certain features, e.g. for rendering of Pandoc documents if these binaries are found in the system `%PATH%` on Windows. However, if a malicious file with the same name (`exe` or `bat`) was found in the current working directory at the time of running `hugo`, the malicious command would be invoked instead of the system one.
This is a bug-fix release with one important fix.
* Improve LookPath [4a8267d6](https://github.com/gohugoio/hugo/commit/4a8267d64a40564aced0695bca05249da17b0eab) [@bep](https://github.com/bep)
Windows users who ran `hugo` inside untrusted Hugo sites were affected.
The origin of this issue comes from Go, see https://github.com/golang/go/issues/38736
We have fixed this in Hugo by [using](https://github.com/gohugoio/hugo/commit/4a8267d64a40564aced0695bca05249da17b0eab) a patched version of `exec.LookPath` from https://github.com/cli/safeexec (thanks to [@mislav](https://github.com/mislav) for the implementation).
Thanks to [@Ry0taK](https://github.com/Ry0taK) for the bug report.