Bjørn Erik PedersenandClaude Fable 5.1 41040cc7b1 tocss: Confine Sass import fallbacks to the allowed read paths ...

Imports not found in Hugo's file systems were resolved by the Sass compiler
itself, with the real mount directories as include paths. The compiler follows
symlinks and knows nothing about the project root, so a theme could import
../secret, an absolute path, or a symlink it ships, and get the file content
into the published CSS.

Resolve these imports in Hugo instead, checked against the same allowRead roots
as the Node.js tools and js.Build. Dart Sass gets no load paths anymore; for
LibSASS a rejected path is returned as an @error body.

Thanks to @Hama1cco for finding and reporting this issue.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

2026-09-28 16:13:46 +02:00

..

assets

…

images

Fix smartcrop with rotation (#15371)

2026-09-22 15:58:12 +02:00

internal

…

jsconfig

…

kinds

…

page

Avoid allocating in SitesMatrix.MatchSiteVector

2026-09-26 21:20:09 +02:00

postpub

…

resource

…

resource_factories

config/security: Add http.proxyFromEnvironment and document the resolved address check

2026-09-07 17:36:39 +02:00

resource_transformers

tocss: Confine Sass import fallbacks to the allowed read paths

2026-09-28 16:13:46 +02:00

testdata

…

artifact.go

…

docs.go

…

image_cache.go

…

image_test.go

Fix smartcrop with rotation (#15371)

2026-09-22 15:58:12 +02:00

image.go

…

post_publish.go

…

resource_cache.go

…

resource_metadata.go

…

resource_spec_test.go

…

resource_spec.go

…

resource_test.go

…

resource.go

…

resources_integration_test.go

…

testhelpers_test.go

…

transform_integration_test.go

…

transform_test.go

…

transform.go

Expand and consolidate BOM trimming

2026-09-21 21:39:37 +02:00