dan
/
jekyll
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

patch symlink vuln and properly test 

Signed-off-by: Parker Moore <parkrmoore@gmail.com>
This commit is contained in:
Ben Balter 2014-01-06 23:02:01 -05:00 committed by Parker Moore
parent 4e318cd192
commit a799e41b70
2 changed files with 12 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
lib/jekyll/tags/include.rb
View File

@ -96,13 +96,12 @@ eos
def render(context) def render(context)
dir = File.join(context.registers[:site].source, INCLUDES_DIR) dir = File.join(context.registers[:site].source, INCLUDES_DIR)
validate_dir(dir, context.registers[:site].safe)
file = render_variable(context) || @file file = render_variable(context) || @file
validate_file_name(file) validate_file_name(file)
path = File.join(dir, file) path = File.join(dir, file)
validate_file(path, context.registers[:site].safe) validate_path(path, context.registers[:site].safe)
begin begin
partial = Liquid::Template.parse(source(path, context)) partial = Liquid::Template.parse(source(path, context))
@ -116,17 +115,11 @@ eos
end end
end end
def validate_dir(dir, safe) def validate_path(path, safe)
if File.symlink?(dir) && safe if !File.exist?(path)
raise IOError.new "Includes directory '#{dir}' cannot be a symlink" raise IOError.new "Included file '#{path}' not found"
end elsif path != File.realpath(path) && safe
end raise IOError.new "The included file '#{path}' should not be a symlink"
def validate_file(file, safe)
if !File.exists?(file)
raise IOError.new "Included file '#{file}' not found"
elsif File.symlink?(file) && safe
raise IOError.new "The included file '#{file}' should not be a symlink"
end end
end end

7
test/test_tags.rb
View File

@ -366,7 +366,9 @@ CONTENT
context "with symlink'd include" do context "with symlink'd include" do
setup do should "not allow symlink includes" do
File.open("/tmp/pages-test", 'w') { |file| file.write("SYMLINK TEST") }
assert_raise IOError do
content = <<CONTENT content = <<CONTENT
--- ---
title: Include symlink title: Include symlink
@ -377,9 +379,6 @@ title: Include symlink
CONTENT CONTENT
create_post(content, {'permalink' => 'pretty', 'source' => source_dir, 'destination' => dest_dir, 'read_posts' => true, 'safe' => true }) create_post(content, {'permalink' => 'pretty', 'source' => source_dir, 'destination' => dest_dir, 'read_posts' => true, 'safe' => true })
end end
should "not allow symlink includes" do
File.open("/tmp/pages-test", 'w') { |file| file.write("SYMLINK TEST") }
assert_no_match /SYMLINK TEST/, @result assert_no_match /SYMLINK TEST/, @result
end end
end end