Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Make sure that site_path cannot begin with a slash #43

Open
spanezz opened this issue Dec 27, 2019 · 0 comments
Open

Make sure that site_path cannot begin with a slash #43

spanezz opened this issue Dec 27, 2019 · 0 comments
Labels
security Security related issue
Milestone
1.5 "repo"

Comments

@spanezz
Copy link
Owner

spanezz commented Dec 27, 2019

A metadata defining an absolute path in site_path, can cause the rendered file to be written to arbitrary locations in the file system, due to the behaviour of os.path.join with absolute paths.

Make sure we test that leading slashes are stripped from site_path when processing pages, so that the generated build_path entries are all relative path.
@spanezz spanezz added the security Security related issue label Dec 27, 2019
@spanezz spanezz added this to the 1.5 "repo" milestone Jan 6, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
security Security related issue
Projects
None yet
Milestone
1.5 "repo"
Development

No branches or pull requests
1 participant
@spanezz