Skip to content

Commit

Permalink
3.6.x: security: fix include bypass of EntryFilter#filter symlink…
Browse files Browse the repository at this point in the history
… check (#7229)

Merge pull request 7229
  • Loading branch information
parkr authored and jekyllbot committed Sep 19, 2018
1 parent 0b83d76 commit caddaeb
Show file tree
Hide file tree
Showing 4 changed files with 69 additions and 8 deletions.
9 changes: 6 additions & 3 deletions lib/jekyll/entry_filter.rb
Original file line number Diff line number Diff line change
Expand Up @@ -31,9 +31,12 @@ def relative_to_source(entry)

def filter(entries)
entries.reject do |e|
unless included?(e)
special?(e) || backup?(e) || excluded?(e) || symlink?(e)
end
# Reject this entry if it is a symlink.
next true if symlink?(e)
# Do not reject this entry if it is included.
next false if included?(e)
# Reject this entry if it is special, a backup file, or excluded.
special?(e) || backup?(e) || excluded?(e)
end
end

Expand Down
1 change: 1 addition & 0 deletions test/source/symlink-test/symlinked-file-outside-source
21 changes: 16 additions & 5 deletions test/test_entry_filter.rb
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@
class TestEntryFilter < JekyllUnitTest
context "Filtering entries" do
setup do
@site = Site.new(site_configuration)
@site = fixture_site
end

should "filter entries" do
Expand Down Expand Up @@ -87,7 +87,7 @@ class TestEntryFilter < JekyllUnitTest
# no support for symlinks on Windows
skip_if_windows "Jekyll does not currently support symlinks on Windows."

site = Site.new(site_configuration("safe" => true))
site = fixture_site("safe" => true)
site.reader.read_directories("symlink-test")

assert_equal %w(main.scss symlinked-file).length, site.pages.length
Expand All @@ -99,11 +99,22 @@ class TestEntryFilter < JekyllUnitTest
# no support for symlinks on Windows
skip_if_windows "Jekyll does not currently support symlinks on Windows."

site = Site.new(site_configuration)
@site.reader.read_directories("symlink-test")
refute_equal [], @site.pages
refute_equal [], @site.static_files
end

should "include only safe symlinks in safe mode even when included" do
# no support for symlinks on Windows
skip_if_windows "Jekyll does not currently support symlinks on Windows."

site = fixture_site("safe" => true, "include" => ["symlinked-file-outside-source"])
site.reader.read_directories("symlink-test")
refute_equal [], site.pages
refute_equal [], site.static_files

# rubocop:disable Performance/FixedSize
assert_equal %w(main.scss symlinked-file).length, site.pages.length
refute_includes site.static_files.map(&:name), "symlinked-file-outside-source"
# rubocop:enable Performance/FixedSize
end
end

Expand Down
46 changes: 46 additions & 0 deletions test/test_layout_reader.rb
Original file line number Diff line number Diff line change
Expand Up @@ -31,5 +31,51 @@ class TestLayoutReader < JekyllUnitTest
assert_equal LayoutReader.new(@site).layout_directory, source_dir("blah/_layouts")
end
end

context "when a layout is a symlink" do
setup do
FileUtils.ln_sf("/etc/passwd", source_dir("_layouts", "symlink.html"))
@site = fixture_site(
"safe" => true,
"include" => ["symlink.html"]
)
end

teardown do
FileUtils.rm(source_dir("_layouts", "symlink.html"))
end

should "only read the layouts which are in the site" do
skip_if_windows "Jekyll does not currently support symlinks on Windows."

layouts = LayoutReader.new(@site).read

refute layouts.key?("symlink"), "Should not read the symlinked layout"
end
end

context "with a theme" do
setup do
FileUtils.ln_sf("/etc/passwd", theme_dir("_layouts", "theme-symlink.html"))
@site = fixture_site(
"include" => ["theme-symlink.html"],
"theme" => "test-theme",
"safe" => true
)
end

teardown do
FileUtils.rm(theme_dir("_layouts", "theme-symlink.html"))
end

should "not read a symlink'd theme" do
skip_if_windows "Jekyll does not currently support symlinks on Windows."

layouts = LayoutReader.new(@site).read

refute layouts.key?("theme-symlink"), \
"Should not read symlinked layout from theme"
end
end
end
end

0 comments on commit caddaeb

Please sign in to comment.