-
-
Notifications
You must be signed in to change notification settings - Fork 9.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Read in static files into collection.files
as StaticFile
s.
#2737
Conversation
@@ -214,7 +206,7 @@ def read(opts = {}) | |||
unless defaults.empty? | |||
@data = defaults | |||
end | |||
@content = File.open(path, "rb", merged_file_read_opts(opts)) { |f| f.read } | |||
@content = File.read(path, merged_file_read_opts(opts)) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@alfredxing This reverts your change from before. Why did you go with one and not the other? Aren't they the same?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'm fine with both implementations. I was actually working on this one (where static files were StaticFiles instead of Documents), but switched over to the Document one as per your comment in the PR (it was a bit simpler to implement it with Documents as well).
@mattr- I keep getting RedCarpet errors in Ruby 2.1 on Travis:
|
doc.read | ||
docs << doc | ||
else | ||
relative_dir = File.join(relative_directory, File.dirname(file_path)).chomp("/.") |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@parkr Shouldn't this be full_path
? Where is this path sanitized?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Would you feel better if we did Jekyll.sanitized_path(relative_directory, File.dirname(file_path)).chomp("/.")
? Can you create a PoC that exploits this line? The StaticFile
class should handle the reading and writing path sanitation, but I can change this if you want.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The StaticFile class should handle the reading and writing path sanitation, but I can change this if you want.
I thought that too, but looked, and couldn't find a sanitize_path
call (or am I missing something)?
h/t @benbalter #2737 (comment) Not sure if the previous code can be exploited, but being super safe is never a bad thing.
h/t @benbalter #2737 (comment) Not sure if the previous code can be exploited, but being super safe is never a bad thing.
Fixes #2555.