dan
/
jekyll
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

patch symlink vuln and properly test 

Signed-off-by: Parker Moore <parkrmoore@gmail.com>
This commit is contained in:
Ben Balter 2014-01-06 23:02:01 -05:00 committed by Parker Moore
parent 4e318cd192
commit a799e41b70
2 changed files with 12 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
lib/jekyll/tags/include.rb
View File

@ -96,13 +96,12 @@ eos
def render(context)
dir = File.join(context.registers[:site].source, INCLUDES_DIR)
validate_dir(dir, context.registers[:site].safe)
file = render_variable(context) || @file
validate_file_name(file)
path = File.join(dir, file)
validate_file(path, context.registers[:site].safe)
validate_path(path, context.registers[:site].safe)
begin
partial = Liquid::Template.parse(source(path, context))
@ -116,17 +115,11 @@ eos
end
end
def validate_dir(dir, safe)
if File.symlink?(dir) && safe
raise IOError.new "Includes directory '#{dir}' cannot be a symlink"
end
end
def validate_file(file, safe)
if !File.exists?(file)
raise IOError.new "Included file '#{file}' not found"
elsif File.symlink?(file) && safe
raise IOError.new "The included file '#{file}' should not be a symlink"
def validate_path(path, safe)
if !File.exist?(path)
raise IOError.new "Included file '#{path}' not found"
elsif path != File.realpath(path) && safe
raise IOError.new "The included file '#{path}' should not be a symlink"
end
end

7
test/test_tags.rb
View File

@ -366,7 +366,9 @@ CONTENT
context "with symlink'd include" do
setup do
should "not allow symlink includes" do
File.open("/tmp/pages-test", 'w') { |file| file.write("SYMLINK TEST") }
assert_raise IOError do
content = <<CONTENT
---
title: Include symlink
@ -377,9 +379,6 @@ title: Include symlink
CONTENT
create_post(content, {'permalink' => 'pretty', 'source' => source_dir, 'destination' => dest_dir, 'read_posts' => true, 'safe' => true })
end
should "not allow symlink includes" do
File.open("/tmp/pages-test", 'w') { |file| file.write("SYMLINK TEST") }
assert_no_match /SYMLINK TEST/, @result
end
end