Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

A gem-based plugin whitelist for safe mode #1657

Merged
merged 12 commits into from Dec 8, 2013
Merged

A gem-based plugin whitelist for safe mode #1657

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
480e350
A start at a gem-based plugin whitelist for Pages.
parkr Oct 23, 2013
a4b9bab
Add --whitelist flag and internal logic
parkr Oct 25, 2013
615d49e
Remove Site.whitelist attribute.
parkr Oct 25, 2013
6187861
Add test code for 'whitelist' option.
parkr Dec 6, 2013
be5966a
Remove option from CLI
parkr Dec 6, 2013
8d898da
Add "jekyll_test_plugin_malicious" as gem dep
parkr Dec 6, 2013
5c9f9a4
The whitelist should be an array (not a file)
parkr Dec 6, 2013
249b13a
Hm, shouldn't need that call to 'rescue' in Site#whitelist
parkr Dec 6, 2013
f0fbc8f
Refactor conditions for allowing plugins into a new method: Site#plgu…
parkr Dec 6, 2013
bce2c2e
Print the output of Jekyll if the command fails
parkr Dec 6, 2013
5591ff2
Whoops, it's called 'jekyll_run_output'
parkr Dec 6, 2013
e91db82
I mean the argument and the local variable should be the same thing
parkr Dec 6, 2013
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
1 change: 1 addition & 0 deletions bin/jekyll
View file
Open in desktop
Expand Up @@ -41,6 +41,7 @@ def add_build_options(c)
c.option '--lsi', 'Use LSI for improved related posts'
c.option '-D', '--drafts', 'Render posts in the _drafts folder'
c.option '-V', '--verbose', 'Print verbose output.'
c.option '-W', '--whitelist', 'Gem plugin whitelist'
end

command :default do |c|
Expand Down
21 changes: 18 additions & 3 deletions lib/jekyll/site.rb
View file
Open in desktop
Expand Up @@ -77,11 +77,10 @@ def setup
require f
end
end
self.gems.each do |gem|
require gem
end
end

require_gems

self.converters = instantiate_subclasses(Jekyll::Converter)
self.generators = instantiate_subclasses(Jekyll::Generator)
end
Expand All @@ -97,6 +96,22 @@ def ensure_not_in_dest
end
end

def require_gems
self.gems.each do |gem|
if whitelist.include?(gem) || !self.safe
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

if the site is safe, then just iterate over whitelist & gems (the intersection of the two arrays), otherwise just iterate over gems. Might be wise to make a Site#allowed_gems array that handles the aforementioned condition.

require gem
end
end
end

def whitelist
@whitelist ||= begin
YAML.safe_load_file(self.config['whitelist']) || []
rescue
[]
end
end

# Internal: Setup the plugin search path
#
# Returns an Array of plugin search paths
Expand Down