mirror/hugo
1
0
Fork 0
mirror of https://github.com/gohugoio/hugo.git synced 2025-08-30 22:39:58 +02:00
Code Issues Packages Projects Releases Wiki Activity

Block symlink dir traversal for /static

Browse Source 
This is in line with how it behaved before, but it was lifted a little for the project mount for Hugo Modules,
but that could create hard-to-detect loops.
This commit is contained in:
Bjørn Erik Pedersen
2019-07-25 00:12:40 +02:00
parent 87a07282a2
commit e5f2299741
24 changed files with 320 additions and 130 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
hugofs/decorators.go
View File

@@ -90,19 +90,14 @@ func NewBaseFileDecorator(fs afero.Fs) afero.Fs {
isSymlink := isSymlink(fi)
if isSymlink {
meta[metaKeyOriginalFilename] = filename
link, err := filepath.EvalSymlinks(filename)
var link string
var err error
link, fi, err = evalSymlinks(fs, filename)
if err != nil {
return nil, err
}
fi, err = fs.Stat(link)
if err != nil {
return nil, err
}
filename = link
meta[metaKeyIsSymlink] = true
}
opener := func() (afero.File, error) {
@@ -117,6 +112,20 @@ func NewBaseFileDecorator(fs afero.Fs) afero.Fs {
return ffs
}
func evalSymlinks(fs afero.Fs, filename string) (string, os.FileInfo, error) {
link, err := filepath.EvalSymlinks(filename)
if err != nil {
return "", nil, err
}
fi, err := fs.Stat(link)
if err != nil {
return "", nil, err
}
return link, fi, nil
}
type baseFileDecoratorFs struct {
afero.Fs
decorate func(fi os.FileInfo, filename string) (os.FileInfo, error)