Read in static files into collection.files as StaticFiles.
#2737
Conversation
| @@ -214,7 +206,7 @@ def read(opts = {}) | |||
| unless defaults.empty? | |||
| @data = defaults | |||
| end | |||
| @content = File.open(path, "rb", merged_file_read_opts(opts)) { |f| f.read } | |||
| @content = File.read(path, merged_file_read_opts(opts)) | |||
There was a problem hiding this comment.
@alfredxing This reverts your change from before. Why did you go with one and not the other? Aren't they the same?
There was a problem hiding this comment.
I'm fine with both implementations. I was actually working on this one (where static files were StaticFiles instead of Documents), but switched over to the Document one as per your comment in the PR (it was a bit simpler to implement it with Documents as well).
|
@mattr- I keep getting RedCarpet errors in Ruby 2.1 on Travis: |
| doc.read | ||
| docs << doc | ||
| else | ||
| relative_dir = File.join(relative_directory, File.dirname(file_path)).chomp("/.") |
There was a problem hiding this comment.
@parkr Shouldn't this be full_path? Where is this path sanitized?
There was a problem hiding this comment.
Would you feel better if we did Jekyll.sanitized_path(relative_directory, File.dirname(file_path)).chomp("/.")? Can you create a PoC that exploits this line? The StaticFile class should handle the reading and writing path sanitation, but I can change this if you want.
There was a problem hiding this comment.
The StaticFile class should handle the reading and writing path sanitation, but I can change this if you want.
I thought that too, but looked, and couldn't find a sanitize_path call (or am I missing something)?
h/t @benbalter #2737 (comment) Not sure if the previous code can be exploited, but being super safe is never a bad thing.
h/t @benbalter #2737 (comment) Not sure if the previous code can be exploited, but being super safe is never a bad thing.
Fixes #2555.