mirror of
https://github.com/gohugoio/hugo.git
synced 2026-09-30 18:15:45 +02:00
Bjørn Erik PedersenandClaude Fable 5.1
41040cc7b1
Imports not found in Hugo's file systems were resolved by the Sass compiler itself, with the real mount directories as include paths. The compiler follows symlinks and knows nothing about the project root, so a theme could import ../secret, an absolute path, or a symlink it ships, and get the file content into the published CSS. Resolve these imports in Hugo instead, checked against the same allowRead roots as the Node.js tools and js.Build. Dart Sass gets no load paths anymore; for LibSASS a rejected path is returned as an @error body. Thanks to @Hama1cco for finding and reporting this issue. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>