Release 💎 3.7.4

3.7.x: EntryFilter#filter symlink fix

History.markdown

@@ -1,3 +1,14 @@
+## 3.7.4 / 2018-09-07
+
+### Bug Fixes
+
+  * Security: fix `include` bypass of EntryFilter#filter symlink check
+
+## 3.7.3 / 2018-02-25
+
+### Bug Fixes
+  * Do not hardcode locale unless certainly necessary (#6791)
+
 ## 3.7.2 / 2018-01-25
 
 ### Development Fixes

lib/jekyll.rb

@@ -35,7 +35,6 @@ require "colorator"
 require "i18n"
 
 SafeYAML::OPTIONS[:suppress_warnings] = true
-I18n.config.available_locales = :en
 
 module Jekyll
   # internal requires

lib/jekyll/entry_filter.rb

@@ -31,9 +31,12 @@ module Jekyll
 
     def filter(entries)
       entries.reject do |e|
-        unless included?(e)
-          special?(e) || backup?(e) || excluded?(e) || symlink?(e)
-        end
+        # Reject this entry if it is a symlink.
+        next true if symlink?(e)
+        # Do not reject this entry if it is included.
+        next false if included?(e)
+        # Reject this entry if it is special, a backup file, or excluded.
+        special?(e) || backup?(e) || excluded?(e)
       end
     end
 

lib/jekyll/utils.rb

@@ -203,7 +203,10 @@ module Jekyll
       end
 
       # Drop accent marks from latin characters. Everything else turns to ?
-      string = ::I18n.transliterate(string) if mode == "latin"
+      if mode == "latin"
+        I18n.config.available_locales = :en if I18n.config.available_locales.empty?
+        string = I18n.transliterate(string)
+      end
 
       slug = replace_character_sequence_with_hyphen(string, :mode => mode)
 

lib/jekyll/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Jekyll
-  VERSION = "3.7.2".freeze
+  VERSION = "3.7.4".freeze
 end

test/source/symlink-test/symlinked-file-outside-source

@@ -0,0 +1 @@
+/etc/passwd

test/test_entry_filter.rb

@@ -5,7 +5,7 @@ require "helper"
 class TestEntryFilter < JekyllUnitTest
   context "Filtering entries" do
     setup do
-      @site = Site.new(site_configuration)
+      @site = fixture_site
     end
 
     should "filter entries" do
@@ -87,7 +87,7 @@ class TestEntryFilter < JekyllUnitTest
       # no support for symlinks on Windows
       skip_if_windows "Jekyll does not currently support symlinks on Windows."
 
-      site = Site.new(site_configuration("safe" => true))
+      site = fixture_site("safe" => true)
       site.reader.read_directories("symlink-test")
 
       assert_equal %w(main.scss symlinked-file).length, site.pages.length
@@ -99,11 +99,21 @@ class TestEntryFilter < JekyllUnitTest
       # no support for symlinks on Windows
       skip_if_windows "Jekyll does not currently support symlinks on Windows."
 
-      site = Site.new(site_configuration)
+      @site.reader.read_directories("symlink-test")
+      refute_equal [], @site.pages
+      refute_equal [], @site.static_files
+    end
 
+    should "include only safe symlinks in safe mode even when included" do
+      # no support for symlinks on Windows
+      skip_if_windows "Jekyll does not currently support symlinks on Windows."
+
+      site = fixture_site("safe" => true, "include" => ["symlinked-file-outside-source"])
       site.reader.read_directories("symlink-test")
-      refute_equal [], site.pages
-      refute_equal [], site.static_files
+
+      # rubocop:disable Performance/FixedSize
+      assert_equal %w(main.scss symlinked-file).length, site.pages.length
+      refute_includes site.static_files.map(&:name), "symlinked-file-outside-source"
     end
   end
 

test/test_layout_reader.rb

@@ -31,5 +31,51 @@ class TestLayoutReader < JekyllUnitTest
         assert_equal LayoutReader.new(@site).layout_directory, source_dir("blah/_layouts")
       end
     end
+
+    context "when a layout is a symlink" do
+      setup do
+        FileUtils.ln_sf("/etc/passwd", source_dir("_layouts", "symlink.html"))
+        @site = fixture_site({
+          "safe"    => true,
+          "include" => ["symlink.html"],
+        })
+      end
+
+      teardown do
+        FileUtils.rm(source_dir("_layouts", "symlink.html"))
+      end
+
+      should "only read the layouts which are in the site" do
+        skip_if_windows "Jekyll does not currently support symlinks on Windows."
+
+        layouts = LayoutReader.new(@site).read
+
+        refute layouts.key?("symlink"), "Should not read the symlinked layout"
+      end
+    end
+
+    context "with a theme" do
+      setup do
+        FileUtils.ln_sf("/etc/passwd", theme_dir("_layouts", "theme-symlink.html"))
+        @site = fixture_site({
+          "include" => ["theme-symlink.html"],
+          "theme"   => "test-theme",
+          "safe"    => true,
+        })
+      end
+
+      teardown do
+        FileUtils.rm(theme_dir("_layouts", "theme-symlink.html"))
+      end
+
+      should "not read a symlink'd theme" do
+        skip_if_windows "Jekyll does not currently support symlinks on Windows."
+
+        layouts = LayoutReader.new(@site).read
+
+        refute layouts.key?("theme-symlink"), \
+          "Should not read symlinked layout from theme"
+      end
+    end
   end
 end