From 68a31c8eb29671184d3dd34a6d936e7057ff1f5f Mon Sep 17 00:00:00 2001 From: Ashwin Maroli Date: Mon, 24 Jun 2019 03:45:25 +0530 Subject: [PATCH] Don't read symlinks in site.include in safe mode (#7711) Merge pull request 7711 --- lib/jekyll/reader.rb | 3 +++ 1 file changed, 3 insertions(+) diff --git a/lib/jekyll/reader.rb b/lib/jekyll/reader.rb index 18730ab3..797e4291 100644 --- a/lib/jekyll/reader.rb +++ b/lib/jekyll/reader.rb @@ -161,11 +161,14 @@ module Jekyll end def read_included_excludes + entry_filter = EntryFilter.new(site) + site.include.each do |entry| next if entry == ".htaccess" entry_path = site.in_source_dir(entry) next if File.directory?(entry_path) + next if entry_filter.symlink?(entry_path) read_included_file(entry_path) if File.file?(entry_path) end