Release 💎 3.8.6

Create 3.8.6 release notes

.travis.yml

@@ -2,7 +2,6 @@ bundler_args: --without benchmark:site:development
 script: script/cibuild
 cache: bundler
 language: ruby
-sudo: false
 
 rvm:
   - &ruby1 2.5.1
@@ -31,7 +30,7 @@ branches:
   only:
     - master
     - themes
-    - /*-stable/
+    - /.*-stable/
 
 notifications:
   slack:
@@ -54,5 +53,4 @@ after_success:
   - bundle exec codeclimate-test-reporter
 
 before_install:
-  - gem update --system
-  - gem install bundler
+  - gem update --system || true

Gemfile

@@ -27,15 +27,17 @@ group :test do
   gem "httpclient"
   gem "jekyll_test_plugin"
   gem "jekyll_test_plugin_malicious"
-  # nokogiri v1.8 does not work with ruby 2.1 and below
-  gem "nokogiri", RUBY_VERSION >= "2.2" ? "~> 1.7" : "~> 1.7.0"
+  # nokogiri v1.10 does not work with ruby 2.2 and below
+  gem "nokogiri", RUBY_VERSION >= "2.3" ? "~> 1.9" : "~> 1.9.0"
   gem "rspec"
   gem "rspec-mocks"
   gem "rubocop", "~> 0.56.0"
   gem "test-dependency-theme", :path => File.expand_path("test/fixtures/test-dependency-theme", __dir__)
   gem "test-theme", :path => File.expand_path("test/fixtures/test-theme", __dir__)
+  gem "test-theme-skinny", :path => File.expand_path("test/fixtures/test-theme-skinny", __dir__)
+  gem "test-theme-symlink", :path => File.expand_path("test/fixtures/test-theme-symlink", __dir__)
 
-  gem "jruby-openssl" if RUBY_ENGINE == "jruby"
+  gem "jruby-openssl", "0.10.1" if RUBY_ENGINE == "jruby"
 end
 
 #

History.markdown

@@ -1,3 +1,31 @@
+## 3.8.6 / 2019-07-02
+
+### Bug Fixes
+
+  * Update log output for an invalid theme directory (#7734)
+  * Memoize `SiteDrop#documents` to reduce allocations (#7722)
+  * Excerpt handling of custom and intermediate tags (#7467)
+  * Escape valid special chars in a site's path name (#7573)
+  * Revert memoizing `Site#docs_to_write` and refactor `#documents` (#7689)
+  * Fix broken `include_relative` usage in excerpt (#7690)
+  * Install platform-specific gems as required (3c06609406)
+
+### Security Fixes
+
+  * Theme gems: ensure directories aren't symlinks (#7424)
+
+## 3.8.5 / 2018-11-04
+
+### Bug Fixes
+
+  * Re-implement handling Liquid blocks in excerpts (#7250)
+
+## 3.8.4 / 2018-09-18
+
+### Bug Fixes
+
+  * security: fix `include` bypass of `EntryFilter#filter` symlink check (#7228)
+
 ## 3.8.3 / 2018-06-05
 
 ### Bug Fixes

appveyor.yml

@@ -6,6 +6,7 @@ branches:
   only:
     - master
     - themes
+    - /.*-stable/
 
 build: off
 

docs/_config.yml

@@ -1,5 +1,5 @@
 ---
-version: 3.8.3
+version: 3.8.6
 name: Jekyll • Simple, blog-aware, static sites
 description: Transform your plain text into static websites and blogs
 url: https://jekyllrb.com

docs/_docs/history.md

@@ -4,6 +4,44 @@ permalink: "/docs/history/"
 note: This file is autogenerated. Edit /History.markdown instead.
 ---
 
+## 3.8.6 / 2019-07-02
+{: #v3-8-6}
+
+### Bug Fixes
+{: #bug-fixes-v3-8-6}
+
+- Update log output for an invalid theme directory ([#7734]({{ site.repository }}/issues/7734))
+- Memoize `SiteDrop#documents` to reduce allocations ([#7722]({{ site.repository }}/issues/7722))
+- Excerpt handling of custom and intermediate tags ([#7467]({{ site.repository }}/issues/7467))
+- Escape valid special chars in a site's path name ([#7573]({{ site.repository }}/issues/7573))
+- Revert memoizing `Site#docs_to_write` and refactor `#documents` ([#7689]({{ site.repository }}/issues/7689))
+- Fix broken `include_relative` usage in excerpt ([#7690]({{ site.repository }}/issues/7690))
+- Install platform-specific gems as required (3c06609406)
+
+### Security Fixes
+{: #security-fixes-v3-8-6}
+
+- Theme gems: ensure directories aren't symlinks ([#7424]({{ site.repository }}/issues/7424))
+
+
+## 3.8.5 / 2018-11-04
+{: #v3-8-5}
+
+### Bug Fixes
+{: #bug-fixes-v3-8-5}
+
+- Re-implement handling Liquid blocks in excerpts ([#7250]({{ site.repository }}/issues/7250))
+
+
+## 3.8.4 / 2018-09-18
+{: #v3-8-4}
+
+### Bug Fixes
+{: #bug-fixes-v3-8-4}
+
+- security: fix `include` bypass of `EntryFilter#filter` symlink check ([#7228]({{ site.repository }}/issues/7228))
+
+
 ## 3.8.3 / 2018-06-05
 {: #v3-8-3}
 

docs/_posts/2019-07-02-jekyll-3-8-6-released.markdown

@@ -0,0 +1,19 @@
+---
+title: 'Jekyll 3.8.6 Released'
+date: 2019-07-02 11:21:02 -0400
+author: parkr
+version: 3.8.6
+categories: [release]
+---
+
+We have another patch release in the 3.8 series! This time, we have one security patch
+and a handful of bug patches, including:
+
+- Filter symlinks from theme gems
+- Fix excerpt handling of some Liquid tags
+- Handle case where a theme directory doesn't exist
+- A few internal optimizations to reduce memory overhead
+
+... and a few more! You can check out the patches and see all the details in [the release notes](/docs/history/#v3-8-6)
+
+Happy Jekylling!

docs/latest_version.txt

@@ -1 +1 @@
-3.8.3
+3.8.6

features/include_relative_tag.feature

@@ -0,0 +1,60 @@
+Feature: include_relative Tag
+  In order to share content across several closely related pages
+  As a hacker who likes to blog
+  I want to be able to include snippets in my site's pages and documents relative to current file
+
+  Scenario: Include a file relative to a post
+    Given I have a _posts directory
+    And I have a _posts/snippets directory
+    And I have the following post:
+      | title     | date       | content                                         |
+      | Star Wars | 2018-09-02 | {% include_relative snippets/welcome_para.md %} |
+    And I have an "_posts/snippets/welcome_para.md" file that contains "Welcome back Dear Reader!"
+    When I run jekyll build
+    Then I should get a zero exit status
+    And the _site directory should exist
+    And I should see "Welcome back Dear Reader!" in "_site/2018/09/02/star-wars.html"
+
+  Scenario: Include a nested file relative to a post
+    Given I have a _posts directory
+    And I have a _posts/snippets directory
+    And I have a _posts/snippets/welcome_para directory
+    And I have the following post:
+      | title     | date       | content                                         |
+      | Star Wars | 2018-09-02 | {% include_relative snippets/welcome_para.md %} |
+    And I have an "_posts/snippets/welcome_para.md" file that contains "{% include_relative snippets/welcome_para/greeting.md %} Dear Reader!"
+    And I have an "_posts/snippets/welcome_para/greeting.md" file that contains "Welcome back"
+    When I run jekyll build
+    Then I should get a zero exit status
+    And the _site directory should exist
+    And I should see "Welcome back Dear Reader!" in "_site/2018/09/02/star-wars.html"
+
+  Scenario: Include a nested file relative to a post as an excerpt
+    Given I have a _posts directory
+    And I have a _posts/snippets directory
+    And I have a _posts/snippets/welcome_para directory
+    And I have a "_posts/2018-09-02-star-wars.md" file with content:
+      """
+      {% include_relative snippets/welcome_para.md %}
+
+      Hello World
+      """
+    And I have an "_posts/snippets/welcome_para.md" file that contains "{% include_relative snippets/welcome_para/greeting.md %} Dear Reader!"
+    And I have an "_posts/snippets/welcome_para/greeting.md" file that contains "Welcome back"
+    And I have an "index.md" page that contains "{% for post in site.posts %}{{ post.excerpt }}{% endfor %}"
+    When I run jekyll build
+    Then I should get a zero exit status
+    And the _site directory should exist
+    And I should see "Welcome back Dear Reader!" in "_site/2018/09/02/star-wars.html"
+    And I should see "Welcome back Dear Reader!" in "_site/index.html"
+
+  Scenario: Include a nested file relative to a page at root
+    Given I have a snippets directory
+    And I have a snippets/welcome_para directory
+    And I have a "index.md" page that contains "{% include_relative snippets/welcome_para.md %}"
+    And I have a "snippets/welcome_para.md" file that contains "{% include_relative snippets/welcome_para/greeting.md %} Dear Reader!"
+    And I have a "snippets/welcome_para/greeting.md" file that contains "Welcome back"
+    When I run jekyll build
+    Then I should get a zero exit status
+    And the _site directory should exist
+    And I should see "Welcome back Dear Reader!" in "_site/index.html"

features/rendering.feature

@@ -5,6 +5,19 @@ Feature: Rendering
   But I want to make it as simply as possible
   So render with Liquid and place in Layouts
 
+  Scenario: Rendering a site with parentheses in its path name
+    Given I have a blank site in "omega(beta)"
+    And   I have an "omega(beta)/test.md" page with layout "simple" that contains "Hello World"
+    And   I have an omega(beta)/_includes directory
+    And   I have an "omega(beta)/_includes/head.html" file that contains "Snippet"
+    And   I have a configuration file with "source" set to "omega(beta)"
+    And   I have an omega(beta)/_layouts directory
+    And   I have an "omega(beta)/_layouts/simple.html" file that contains "{% include head.html %}: {{ content }}"
+    When  I run jekyll build --profile
+    Then  I should get a zero exit status
+    And   I should see "Snippet: <p>Hello World</p>" in "_site/test.html"
+    And   I should see "_layouts/simple.html" in the build output
+
   Scenario: When receiving bad Liquid
     Given I have a "index.html" page with layout "simple" that contains "{% include invalid.html %}"
     And   I have a simple layout that contains "{{ content }}"

features/theme.feature

@@ -57,6 +57,17 @@ Feature: Writing themes
     And I should see "From your site." in "_site/assets/application.coffee"
     And I should see "From your site." in "_site/assets/base.js"
 
+  Scenario: A theme with *just* layouts
+    Given I have a configuration file with "theme" set to "test-theme-skinny"
+    And I have an "index.html" page with layout "home" that contains "The quick brown fox."
+    When I run jekyll build
+    Then I should get a zero exit status
+    And the _site directory should exist
+    And I should see "Message: The quick brown fox." in "_site/index.html"
+    But I should not see "_includes" in the build output
+    And I should not see "_sass" in the build output
+    And I should not see "assets" in the build output
+
   Scenario: Requiring dependencies of a theme
     Given I have a configuration file with "theme" set to "test-dependency-theme"
     When I run jekyll build

lib/jekyll/commands/new.rb

@@ -88,10 +88,14 @@ group :jekyll_plugins do
 end
 
 # Windows does not include zoneinfo files, so bundle the tzinfo-data gem
-gem "tzinfo-data", platforms: [:mingw, :mswin, :x64_mingw, :jruby]
+# and associated library.
+install_if -> { RUBY_PLATFORM =~ %r!mingw|mswin|java! } do
+  gem "tzinfo", "~> 1.2"
+  gem "tzinfo-data"
+end
 
 # Performance-booster for watching directories on Windows
-gem "wdm", "~> 0.1.0" if Gem.win_platform?
+gem "wdm", "~> 0.1.0", :install_if => Gem.win_platform?
 
 RUBY
         end

lib/jekyll/drops/site_drop.rb

@@ -8,8 +8,7 @@ module Jekyll
       mutable false
 
       def_delegator  :@obj, :site_data, :data
-      def_delegators :@obj, :time, :pages, :static_files, :documents,
-                            :tags, :categories
+      def_delegators :@obj, :time, :pages, :static_files, :tags, :categories
 
       private def_delegator :@obj, :config, :fallback_data
 
@@ -39,6 +38,16 @@ module Jekyll
         @site_collections ||= @obj.collections.values.sort_by(&:label).map(&:to_liquid)
       end
 
+      # `Site#documents` cannot be memoized so that `Site#docs_to_write` can access the
+      # latest state of the attribute.
+      #
+      # Since this method will be called after `Site#pre_render` hook,
+      # the `Site#documents` array shouldn't thereafter change and can therefore be
+      # safely memoized to prevent additional computation of `Site#documents`.
+      def documents
+        @documents ||= @obj.documents
+      end
+
       # `{{ site.related_posts }}` is how posts can get posts related to
       # them, either through LSI if it's enabled, or through the most
       # recent posts.

lib/jekyll/entry_filter.rb

@@ -31,9 +31,12 @@ module Jekyll
 
     def filter(entries)
       entries.reject do |e|
-        unless included?(e)
-          special?(e) || backup?(e) || excluded?(e) || symlink?(e)
-        end
+        # Reject this entry if it is a symlink.
+        next true if symlink?(e)
+        # Do not reject this entry if it is included.
+        next false if included?(e)
+        # Reject this entry if it is special, a backup file, or excluded.
+        special?(e) || backup?(e) || excluded?(e)
       end
     end
 

lib/jekyll/excerpt.rb

@@ -128,36 +128,47 @@ module Jekyll
     #
     # Returns excerpt String
 
-    LIQUID_TAG_REGEX = %r!{%-?\s*(\w+).+\s*-?%}!m
+    LIQUID_TAG_REGEX = %r!{%-?\s*(\w+)\s*.*?-?%}!m
     MKDWN_LINK_REF_REGEX = %r!^ {0,3}\[[^\]]+\]:.+$!
 
     def extract_excerpt(doc_content)
       head, _, tail = doc_content.to_s.partition(doc.excerpt_separator)
 
-      # append appropriate closing tag (to a Liquid block), to the "head" if the
-      # partitioning resulted in leaving the closing tag somewhere in the "tail"
-      # partition.
-      if head.include?("{%")
-        head =~ LIQUID_TAG_REGEX
-        tag_name = Regexp.last_match(1)
+      # append appropriate closing tag(s) (for each Liquid block), to the `head`
+      # if the partitioning resulted in leaving the closing tag somewhere
+      # in the `tail` partition.
 
-        if liquid_block?(tag_name) && head.match(%r!{%-?\s*end#{tag_name}\s*-?%}!).nil?
-          print_build_warning
+      if head.include?("{%")
+        modified  = false
+        tag_names = head.scan(LIQUID_TAG_REGEX)
+        tag_names.flatten!
+        tag_names.reverse_each do |tag_name|
+          next unless liquid_block?(tag_name)
+          next if head =~ endtag_regex_stash(tag_name)
+
+          modified = true
           head << "\n{% end#{tag_name} %}"
         end
+        print_build_warning if modified
       end
 
-      if tail.empty?
-        head
-      else
-        head.to_s.dup << "\n\n" << tail.scan(MKDWN_LINK_REF_REGEX).join("\n")
-      end
+      return head if tail.empty?
+
+      head << "\n\n" << tail.scan(MKDWN_LINK_REF_REGEX).join("\n")
     end
 
     private
 
+    def endtag_regex_stash(tag_name)
+      @endtag_regex_stash ||= {}
+      @endtag_regex_stash[tag_name] ||= %r!{%-?\s*end#{tag_name}.*?\s*-?%}!m
+    end
+
     def liquid_block?(tag_name)
-      Liquid::Template.tags[tag_name].superclass == Liquid::Block
+      return false unless tag_name.is_a?(String)
+      return false unless Liquid::Template.tags[tag_name]
+
+      Liquid::Template.tags[tag_name].ancestors.include?(Liquid::Block)
     rescue NoMethodError
       Jekyll.logger.error "Error:",
         "A Liquid tag in the excerpt of #{doc.relative_path} couldn't be " \
@@ -167,12 +178,13 @@ module Jekyll
 
     def print_build_warning
       Jekyll.logger.warn "Warning:", "Excerpt modified in #{doc.relative_path}!"
-      Jekyll.logger.warn "",
-        "Found a Liquid block containing separator '#{doc.excerpt_separator}' and has " \
-        "been modified with the appropriate closing tag."
-      Jekyll.logger.warn "",
-        "Feel free to define a custom excerpt or excerpt_separator in the document's " \
-        "Front Matter if the generated excerpt is unsatisfactory."
+      Jekyll.logger.warn "", "Found a Liquid block containing the excerpt separator" \
+                         " #{doc.excerpt_separator.inspect}. "
+      Jekyll.logger.warn "", "The block has been modified with the appropriate" \
+                         " closing tag."
+      Jekyll.logger.warn "", "Feel free to define a custom excerpt or" \
+                         " excerpt_separator in the document's front matter" \
+                         " if the generated excerpt is unsatisfactory."
     end
   end
 end

lib/jekyll/liquid_renderer.rb

@@ -53,7 +53,9 @@ module Jekyll
     private
 
     def filename_regex
-      @filename_regex ||= %r!\A(#{source_dir}/|#{theme_dir}/|\W*)(.*)!i
+      @filename_regex ||= begin
+        %r!\A(#{Regexp.escape(source_dir)}/|#{Regexp.escape(theme_dir.to_s)}/|/*)(.*)!i
+      end
     end
 
     def new_profile_hash

lib/jekyll/site.rb

@@ -314,15 +314,15 @@ module Jekyll
     #
     # Returns an Array of Documents which should be written
     def docs_to_write
-      @docs_to_write ||= documents.select(&:write?)
+      documents.select(&:write?)
     end
 
     # Get all the documents
     #
     # Returns an Array of all Documents
     def documents
-      collections.reduce(Set.new) do |docs, (_, collection)|
-        docs + collection.docs + collection.files
+      collections.each_with_object(Set.new) do |(_, collection), set|
+        set.merge(collection.docs).merge(collection.files)
       end.to_a
     end
 

lib/jekyll/tags/include.rb

@@ -224,6 +224,7 @@ MSG
             else
               File.join(site.config["collections_dir"], page_payload["path"])
             end
+          resource_path.sub!(%r!/#excerpt\z!, "")
           site.in_source_dir File.dirname(resource_path)
         end
       end

lib/jekyll/theme.rb

@@ -56,12 +56,28 @@ module Jekyll
     end
 
     def realpath_for(folder)
-      File.realpath(Jekyll.sanitized_path(root, folder.to_s))
-    rescue Errno::ENOENT, Errno::EACCES, Errno::ELOOP
-      Jekyll.logger.warn "Invalid theme folder:", folder
+      # This resolves all symlinks for the theme subfolder and then ensures
+      # that the directory remains inside the theme root. This prevents the
+      # use of symlinks for theme subfolders to escape the theme root.
+      # However, symlinks are allowed to point to other directories within the theme.
+      Jekyll.sanitized_path(root, File.realpath(Jekyll.sanitized_path(root, folder.to_s)))
+    rescue Errno::ENOENT, Errno::EACCES, Errno::ELOOP => e
+      log_realpath_exception(e, folder)
       nil
     end
 
+    def log_realpath_exception(err, folder)
+      return if err.is_a?(Errno::ENOENT)
+
+      case err
+      when Errno::EACCES
+        Jekyll.logger.error "Theme error:", "Directory '#{folder}' is not accessible."
+      when Errno::ELOOP
+        Jekyll.logger.error "Theme error:",
+                            "Directory '#{folder}' includes a symbolic link loop."
+      end
+    end
+
     def gemspec
       @gemspec ||= Gem::Specification.find_by_name(name)
     rescue Gem::LoadError

lib/jekyll/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Jekyll
-  VERSION = "3.8.3".freeze
+  VERSION = "3.8.6".freeze
 end

test/fixtures/test-theme-skinny/_layouts/default.html

@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <meta charset="UTF-8">
+  <title>Skinny</title>
+</head>
+<body>
+  <h1>Hello World</h1>
+  {{ content }}
+</body>
+</html>

test/fixtures/test-theme-skinny/_layouts/home.html

@@ -0,0 +1,5 @@
+---
+layout: default
+---
+
+Message: {{ content }}

test/fixtures/test-theme-skinny/test-theme-skinny.gemspec

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+Gem::Specification.new do |s|
+  s.name     = "test-theme-skinny"
+  s.version  = "0.1.0"
+  s.licenses = ["MIT"]
+  s.summary  = "This is a theme with just layouts used to test Jekyll"
+  s.authors  = ["Jekyll"]
+  s.files    = ["lib/example.rb"]
+  s.homepage = "https://github.com/jekyll/jekyll"
+end

test/fixtures/test-theme-symlink/test-theme-symlink.gemspec

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+Gem::Specification.new do |s|
+  s.name        = "test-theme-symlink"
+  s.version     = "0.1.0"
+  s.licenses    = ["MIT"]
+  s.summary     = "This is a theme with a symlink used to test Jekyll"
+  s.authors     = ["Jekyll"]
+  s.files       = ["lib/example.rb"]
+  s.homepage    = "https://github.com/jekyll/jekyll"
+end

test/helper.rb

@@ -195,6 +195,15 @@ class JekyllUnitTest < Minitest::Test
       skip msg.to_s.magenta
     end
   end
+
+  def symlink_if_allowed(target, sym_file)
+    FileUtils.ln_sf(target, sym_file)
+  rescue Errno::EACCES
+    skip "Permission denied for creating a symlink to #{target.inspect} " \
+         "on this machine".magenta
+  rescue NotImplementedError => error
+    skip error.to_s.magenta
+  end
 end
 
 class FakeLogger

test/source/_plugins/custom_block.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+# For testing excerpt handling of custom tags
+
+module Jekyll
+  class DoNothingBlock < Liquid::Block
+  end
+
+  class DoNothingOther < Liquid::Tag
+  end
+end
+
+Liquid::Template.register_tag("do_nothing", Jekyll::DoNothingBlock)
+Liquid::Template.register_tag("do_nothing_other", Jekyll::DoNothingOther)

test/source/_posts/2018-01-28-closed-liquid-block-excerpt.markdown

@@ -2,10 +2,23 @@
 layout: post
 ---
 
-{% if
-  page.layout == "post" %}
-You’ll find this post in your `_posts` directory.
-To add new posts, simply add a file in the `_posts` directory.
-{% endif %}
+{%
+  highlight
+  ruby
+%}
+{% assign foo = 'foobar' %}
+{% raw
+%}
+def print_hi(name)
+  puts "Hi, #{name}"
+end
+print_hi('Tom')
+#=> prints 'Hi, Tom' to STDOUT.
+{%
+  endraw
+%}
+{%
+  endhighlight
+%}
 
 So let's talk business.

test/source/_posts/2018-01-28-open-liquid-block-excerpt.markdown

@@ -2,10 +2,20 @@
 layout: post
 ---
 
-{% if page.layout == "post" %}
-  You’ll find this post in your `_posts` directory.
+{%
+  highlight
+  ruby
+%}
+{% assign foo = 'foobar' %}
+{% raw
+%}
+def print_hi(name)
+  puts "Hi, #{name}"
+end
 
-{% else %}
+print_hi('Tom')
+#=> prints 'Hi, Tom' to STDOUT.
+{% endraw %}
+{% endhighlight %}
 
-  To add new posts, simply add a file in the `_posts` directory.
-{% endif %}
+So let's talk business.

test/source/_posts/2018-11-15-excerpt-liquid-block.md

@@ -0,0 +1,29 @@
+---
+title:  liquid_block excerpt test with open tags in excerpt
+layout: post
+---
+
+{% assign company = "Yoyodyne" %}
+{% do_nothing_other %}
+{% do_nothing %}
+    {% unless false %}
+        {% for i in (1..10) %}
+            {% if true %}
+                {% raw %}
+                    EVIL! PURE AND SIMPLE FROM THE EIGHTH DIMENSION!
+                {% endraw %}
+            {% elsif false %}
+                No matter where you go, there you are.
+                {% break %}
+            {% else %}
+                {% case company %}
+                    {% when "Yoyodyne" %}
+                        Buckaroo Banzai
+                    {% else %}
+                        {% continue %}
+
+                {% endcase %}
+            {% endif %}
+        {% endfor %}
+    {% endunless %}
+{% enddo_nothing %}

test/source/symlink-test/symlinked-file-outside-source

@@ -0,0 +1 @@
+/etc/passwd

test/test_entry_filter.rb

@@ -5,7 +5,7 @@ require "helper"
 class TestEntryFilter < JekyllUnitTest
   context "Filtering entries" do
     setup do
-      @site = Site.new(site_configuration)
+      @site = fixture_site
     end
 
     should "filter entries" do
@@ -87,7 +87,7 @@ class TestEntryFilter < JekyllUnitTest
       # no support for symlinks on Windows
       skip_if_windows "Jekyll does not currently support symlinks on Windows."
 
-      site = Site.new(site_configuration("safe" => true))
+      site = fixture_site("safe" => true)
       site.reader.read_directories("symlink-test")
 
       assert_equal %w(main.scss symlinked-file).length, site.pages.length
@@ -99,11 +99,22 @@ class TestEntryFilter < JekyllUnitTest
       # no support for symlinks on Windows
       skip_if_windows "Jekyll does not currently support symlinks on Windows."
 
-      site = Site.new(site_configuration)
+      @site.reader.read_directories("symlink-test")
+      refute_equal [], @site.pages
+      refute_equal [], @site.static_files
+    end
 
+    should "include only safe symlinks in safe mode even when included" do
+      # no support for symlinks on Windows
+      skip_if_windows "Jekyll does not currently support symlinks on Windows."
+
+      site = fixture_site("safe" => true, "include" => ["symlinked-file-outside-source"])
       site.reader.read_directories("symlink-test")
-      refute_equal [], site.pages
-      refute_equal [], site.static_files
+
+      # rubocop:disable Performance/FixedSize
+      assert_equal %w(main.scss symlinked-file).length, site.pages.length
+      refute_includes site.static_files.map(&:name), "symlinked-file-outside-source"
+      # rubocop:enable Performance/FixedSize
     end
   end
 

test/test_excerpt.rb

@@ -185,12 +185,17 @@ class TestExcerpt < JekyllUnitTest
       @post = setup_post("2018-01-28-open-liquid-block-excerpt.markdown")
       @excerpt = @post.data["excerpt"]
 
-      assert_includes @post.content, "{% if"
-      refute_includes @post.content.split("\n\n")[0], "{% endif %}"
+      head = @post.content.split("\n\n")[0]
+
+      assert_includes @post.content, "{%\n  highlight\n"
+      assert_includes @post.content, "{% raw"
+      refute_includes head, "{% endraw %}"
+      refute_includes head, "{% endhighlight %}"
     end
 
     should "be appended to as necessary and generated" do
-      assert_includes @excerpt.content, "{% endif %}"
+      assert_includes @excerpt.content, "{% endraw %}"
+      assert_includes @excerpt.content, "{% endhighlight %}"
       assert_equal true, @excerpt.is_a?(Jekyll::Excerpt)
     end
   end
@@ -202,13 +207,19 @@ class TestExcerpt < JekyllUnitTest
       @post = setup_post("2018-01-28-closed-liquid-block-excerpt.markdown")
       @excerpt = @post.data["excerpt"]
 
-      assert_includes @post.content, "{% if"
-      assert_includes @post.content.split("\n\n")[0], "{% endif %}"
+      head = @post.content.split("\n\n")[0]
+
+      assert_includes @post.content, "{%\n  highlight\n"
+      assert_includes @post.content, "{% raw"
+      assert_includes head, "{%\n  endraw\n%}"
+      assert_includes head, "{%\n  endhighlight\n%}"
     end
 
     should "not be appended to but generated as is" do
-      assert_includes @excerpt.content, "{% endif %}"
-      refute_includes @excerpt.content, "{% endif %}\n\n{% endif %}"
+      assert_includes @excerpt.content, "{%\n  endraw\n%}"
+      assert_includes @excerpt.content, "{%\n  endhighlight\n%}"
+      refute_includes @excerpt.content, "{%\n  endraw\n%}\n\n{% endraw %}"
+      refute_includes @excerpt.content, "{%\n  endhighlight\n%}\n\n{% endhighlight %}"
       assert_equal true, @excerpt.is_a?(Jekyll::Excerpt)
     end
   end
@@ -264,4 +275,29 @@ class TestExcerpt < JekyllUnitTest
       assert_equal true, @excerpt.is_a?(Jekyll::Excerpt)
     end
   end
+
+  context "An excerpt with Liquid tags" do
+    setup do
+      clear_dest
+      @site = fixture_site
+      @post = setup_post("2018-11-15-excerpt-liquid-block.md")
+      @excerpt = @post.data["excerpt"]
+
+      assert_includes @post.content.split("\n\n")[0].strip, "{% continue %}"
+      assert_equal true, Jekyll::DoNothingBlock.ancestors.include?(Liquid::Block)
+      assert_equal false, Jekyll::DoNothingOther.ancestors.include?(Liquid::Block)
+      assert_match "Jekyll::DoNothingBlock", Liquid::Template.tags["do_nothing"].name
+      assert_match "Jekyll::DoNothingOther", Liquid::Template.tags["do_nothing_other"].name
+    end
+
+    should "close open block tags, including custom tags, and ignore others" do
+      assert_includes @excerpt.content, "{% endcase %}"
+      assert_includes @excerpt.content, "{% endif %}"
+      assert_includes @excerpt.content, "{% endfor %}"
+      assert_includes @excerpt.content, "{% endunless %}"
+      assert_includes @excerpt.content, "{% enddo_nothing %}"
+      refute_includes @excerpt.content, "{% enddo_nothing_other %}"
+      assert_equal true, @excerpt.is_a?(Jekyll::Excerpt)
+    end
+  end
 end

test/test_generated_site.rb

@@ -16,7 +16,7 @@ class TestGeneratedSite < JekyllUnitTest
     end
 
     should "ensure post count is as expected" do
-      assert_equal 57, @site.posts.size
+      assert_equal 58, @site.posts.size
     end
 
     should "insert site.posts into the index" do

test/test_layout_reader.rb

@@ -31,5 +31,52 @@ class TestLayoutReader < JekyllUnitTest
         assert_equal LayoutReader.new(@site).layout_directory, source_dir("blah/_layouts")
       end
     end
+
+    context "when a layout is a symlink" do
+      setup do
+        symlink_if_allowed("/etc/passwd", source_dir("_layouts", "symlink.html"))
+
+        @site = fixture_site(
+          "safe"    => true,
+          "include" => ["symlink.html"]
+        )
+      end
+
+      teardown do
+        FileUtils.rm_f(source_dir("_layouts", "symlink.html"))
+      end
+
+      should "only read the layouts which are in the site" do
+        skip_if_windows "Jekyll does not currently support symlinks on Windows."
+
+        layouts = LayoutReader.new(@site).read
+
+        refute layouts.key?("symlink"), "Should not read the symlinked layout"
+      end
+    end
+
+    context "with a theme" do
+      setup do
+        symlink_if_allowed("/etc/passwd", theme_dir("_layouts", "theme-symlink.html"))
+        @site = fixture_site(
+          "include" => ["theme-symlink.html"],
+          "theme"   => "test-theme",
+          "safe"    => true
+        )
+      end
+
+      teardown do
+        FileUtils.rm_f(theme_dir("_layouts", "theme-symlink.html"))
+      end
+
+      should "not read a symlink'd theme" do
+        skip_if_windows "Jekyll does not currently support symlinks on Windows."
+
+        layouts = LayoutReader.new(@site).read
+
+        refute layouts.key?("theme-symlink"), \
+               "Should not read symlinked layout from theme"
+      end
+    end
   end
 end

test/test_tags.rb

@@ -329,7 +329,7 @@ EOS
           %(<table class="rouge-table"><tbody>) +
             %(<tr><td class="gutter gl">) +
             %(<pre class="lineno">1\n</pre></td>) +
-            %(<td class="code"><pre>test</pre></td></tr>) +
+            %(<td class="code"><pre>test\n</pre></td></tr>) +
             %(</tbody></table>),
           @result
         )
@@ -476,7 +476,7 @@ EOS
         expected = <<-EOS
 <p>This is not yet highlighted</p>\n
 <figure class="highlight"><pre><code class="language-php" data-lang="php"><table class="rouge-table"><tbody><tr><td class="gutter gl"><pre class="lineno">1
-</pre></td><td class="code"><pre><span class="nx">test</span></pre></td></tr></tbody></table></code></pre></figure>\n
+</pre></td><td class="code"><pre><span class="nx">test</span>\n</pre></td></tr></tbody></table></code></pre></figure>\n
 <p>This should not be highlighted, right?</p>
 EOS
         assert_match(expected, @result)

test/test_theme_assets_reader.rb

@@ -75,4 +75,29 @@ class TestThemeAssetsReader < JekyllUnitTest
       refute_file_with_relative_path site.pages, "assets/style.scss"
     end
   end
+
+  context "symlinked theme" do
+    should "not read assets from symlinked theme" do
+      skip_if_windows "Jekyll does not currently support symlinks on Windows."
+
+      begin
+        tmp_dir = Dir.mktmpdir("jekyll-theme-test")
+        File.open(File.join(tmp_dir, "test.txt"), "wb") { |f| f.write "content" }
+
+        theme_dir = File.join(__dir__, "fixtures", "test-theme-symlink")
+        File.symlink(tmp_dir, File.join(theme_dir, "assets"))
+
+        site = fixture_site(
+          "theme"       => "test-theme-symlink",
+          "theme-color" => "black"
+        )
+        ThemeAssetsReader.new(site).read
+
+        assert_empty site.static_files, "static file should not have been picked up"
+      ensure
+        FileUtils.rm_rf(tmp_dir)
+        FileUtils.rm_rf(File.join(theme_dir, "assets"))
+      end
+    end
+  end
 end