mirror/hugo
1
0
Fork 0
mirror of https://github.com/gohugoio/hugo.git synced 2025-08-28 22:19:59 +02:00
Code Issues Packages Projects Releases Wiki Activity

Block symlink dir traversal for /static

Browse Source 
This is in line with how it behaved before, but it was lifted a little for the project mount for Hugo Modules,
but that could create hard-to-detect loops.
This commit is contained in:
Bjørn Erik Pedersen
2019-07-25 00:12:40 +02:00
parent 87a07282a2
commit e5f2299741
24 changed files with 320 additions and 130 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
helpers/path_test.go
View File

@@ -60,7 +60,7 @@ func TestMakePath(t *testing.T) {
v.Set("removePathAccents", test.removeAccents)
l := langs.NewDefaultLanguage(v)
p, err := NewPathSpec(hugofs.NewMem(v), l)
p, err := NewPathSpec(hugofs.NewMem(v), l, nil)
require.NoError(t, err)
output := p.MakePath(test.input)
@@ -73,7 +73,7 @@ func TestMakePath(t *testing.T) {
func TestMakePathSanitized(t *testing.T) {
v := newTestCfg()
p, _ := NewPathSpec(hugofs.NewMem(v), v)
p, _ := NewPathSpec(hugofs.NewMem(v), v, nil)
tests := []struct {
input string
@@ -101,7 +101,7 @@ func TestMakePathSanitizedDisablePathToLower(t *testing.T) {
v.Set("disablePathToLower", true)
l := langs.NewDefaultLanguage(v)
p, _ := NewPathSpec(hugofs.NewMem(v), l)
p, _ := NewPathSpec(hugofs.NewMem(v), l, nil)
tests := []struct {
input string

9
helpers/pathspec.go
View File

@@ -16,6 +16,7 @@ package helpers
import (
"strings"
"github.com/gohugoio/hugo/common/loggers"
"github.com/gohugoio/hugo/config"
"github.com/gohugoio/hugo/hugofs"
"github.com/gohugoio/hugo/hugolib/filesystems"
@@ -37,13 +38,13 @@ type PathSpec struct {
}
// NewPathSpec creats a new PathSpec from the given filesystems and language.
func NewPathSpec(fs *hugofs.Fs, cfg config.Provider) (*PathSpec, error) {
return NewPathSpecWithBaseBaseFsProvided(fs, cfg, nil)
func NewPathSpec(fs *hugofs.Fs, cfg config.Provider, logger *loggers.Logger) (*PathSpec, error) {
return NewPathSpecWithBaseBaseFsProvided(fs, cfg, logger, nil)
}
// NewPathSpecWithBaseBaseFsProvided creats a new PathSpec from the given filesystems and language.
// If an existing BaseFs is provided, parts of that is reused.
func NewPathSpecWithBaseBaseFsProvided(fs *hugofs.Fs, cfg config.Provider, baseBaseFs *filesystems.BaseFs) (*PathSpec, error) {
func NewPathSpecWithBaseBaseFsProvided(fs *hugofs.Fs, cfg config.Provider, logger *loggers.Logger, baseBaseFs *filesystems.BaseFs) (*PathSpec, error) {
p, err := paths.New(fs, cfg)
if err != nil {
@@ -56,7 +57,7 @@ func NewPathSpecWithBaseBaseFsProvided(fs *hugofs.Fs, cfg config.Provider, baseB
filesystems.WithBaseFs(baseBaseFs),
}
}
bfs, err := filesystems.NewBase(p, options...)
bfs, err := filesystems.NewBase(p, logger, options...)
if err != nil {
return nil, err
}

2
helpers/pathspec_test.go
View File

@@ -42,7 +42,7 @@ func TestNewPathSpecFromConfig(t *testing.T) {
fs := hugofs.NewMem(v)
fs.Source.MkdirAll(filepath.FromSlash("thework/thethemes/thetheme"), 0777)
p, err := NewPathSpec(fs, l)
p, err := NewPathSpec(fs, l, nil)
require.NoError(t, err)
require.True(t, p.CanonifyURLs)

2
helpers/testhelpers_test.go
View File

@@ -10,7 +10,7 @@ import (
func newTestPathSpec(fs *hugofs.Fs, v *viper.Viper) *PathSpec {
l := langs.NewDefaultLanguage(v)
ps, _ := NewPathSpec(fs, l)
ps, _ := NewPathSpec(fs, l, nil)
return ps
}

8
helpers/url_test.go
View File

@@ -28,7 +28,7 @@ func TestURLize(t *testing.T) {
v := newTestCfg()
l := langs.NewDefaultLanguage(v)
p, _ := NewPathSpec(hugofs.NewMem(v), l)
p, _ := NewPathSpec(hugofs.NewMem(v), l, nil)
tests := []struct {
input string
@@ -90,7 +90,7 @@ func doTestAbsURL(t *testing.T, defaultInSubDir, addLanguage, multilingual bool,
v.Set("baseURL", test.baseURL)
v.Set("contentDir", "content")
l := langs.NewLanguage(lang, v)
p, _ := NewPathSpec(hugofs.NewMem(v), l)
p, _ := NewPathSpec(hugofs.NewMem(v), l, nil)
output := p.AbsURL(test.input, addLanguage)
expected := test.expected
@@ -168,7 +168,7 @@ func doTestRelURL(t *testing.T, defaultInSubDir, addLanguage, multilingual bool,
v.Set("baseURL", test.baseURL)
v.Set("canonifyURLs", test.canonify)
l := langs.NewLanguage(lang, v)
p, _ := NewPathSpec(hugofs.NewMem(v), l)
p, _ := NewPathSpec(hugofs.NewMem(v), l, nil)
output := p.RelURL(test.input, addLanguage)
@@ -256,7 +256,7 @@ func TestURLPrep(t *testing.T) {
v := newTestCfg()
v.Set("uglyURLs", d.ugly)
l := langs.NewDefaultLanguage(v)
p, _ := NewPathSpec(hugofs.NewMem(v), l)
p, _ := NewPathSpec(hugofs.NewMem(v), l, nil)
output := p.URLPrep(d.input)
if d.output != output {