mirror of
https://github.com/gohugoio/hugo.git
synced 2026-10-23 14:15:45 +02:00
Bjørn Erik PedersenandClaude Fable 5.1
c05c012a4a
Node's permission model checks the lexical path only and follows symlinks even when they point outside the allowed set. This is a documented limitation, so a symlink committed to the project tree (e.g. assets/css/x.css -> /etc/passwd) could be read by a PostCSS plugin and end up in the published site. Before invoking a Node tool, walk the allow-read and allow-write roots once per Exec and fail if any symlink resolves outside them. Relative links inside the tree, such as node_modules/.bin, are still fine. Users with a legitimate link can add its target to security.node.permissions.allowRead. Thanks to @DONG2209 for finding and reporting this issue. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>