dan
/
jekyll
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #2563 from jekyll/fix-read-vuln

This commit is contained in:
Parker Moore 2014-07-01 20:14:45 -04:00
parent 03ae38a41e a66d96ce0a
commit f385fd9efd
3 changed files with 11 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
features/site_configuration.feature
View File

@ -273,3 +273,11 @@ Feature: Site configuration
And I should see "Whatever" in "_site/index.html" And I should see "Whatever" in "_site/index.html"
And the "_site/test.txt" file should exist And the "_site/test.txt" file should exist
And I should see "this is a test" in "_site/test.txt" And I should see "this is a test" in "_site/test.txt"
Scenario: arbitrary file reads via layouts
Given I have an "index.html" page with layout "page" that contains "FOO"
And I have a "_config.yml" file that contains "layouts: '../../../../../../../../../../../../../../usr/include'"
When I run jekyll build
Then the _site directory should exist
And I should see "FOO" in "_site/index.html"
And I should not see " " in "_site/index.html"

2
lib/jekyll/convertible.rb
View File

@ -43,7 +43,7 @@ module Jekyll
# Returns nothing. # Returns nothing.
def read_yaml(base, name, opts = {}) def read_yaml(base, name, opts = {})
begin begin
self.content = File.read(File.join(base, name), self.content = File.read(Jekyll.sanitized_path(base, name),
merged_file_read_opts(opts)) merged_file_read_opts(opts))
if content =~ /\A(---\s*\n.*?\n?)^((---|\.\.\.)\s*$\n?)/m if content =~ /\A(---\s*\n.*?\n?)^((---|\.\.\.)\s*$\n?)/m
self.content = $POSTMATCH self.content = $POSTMATCH

4
lib/jekyll/site.rb
View File

@ -195,7 +195,7 @@ module Jekyll
# #
# Returns nothing # Returns nothing
def read_data(dir) def read_data(dir)
base = File.join(source, dir) base = Jekyll.sanitized_path(source, dir)
read_data_to(base, self.data) read_data_to(base, self.data)
end end
@ -214,7 +214,7 @@ module Jekyll
end end
entries.each do |entry| entries.each do |entry|
path = File.join(dir, entry) path = Jekyll.sanitized_path(dir, entry)
next if File.symlink?(path) && safe next if File.symlink?(path) && safe
key = sanitize_filename(File.basename(entry, '.*')) key = sanitize_filename(File.basename(entry, '.*'))