Allow load_paths in safe mode with sanitization #50

bkeepers · 2016-07-10T16:35:09Z

load_paths is currently only supported in safe mode. This enables it all the time, but sanitizes the paths with Jekyll.sanitized_path in safe mode to ensure all paths are relative to the source directory. This also adds support for globbing (e.g. **/*/node_modules to add node modules and all transient dependencies to the load path).

Having multiple paths in the sass load path is really helpful when using package managers like bower or NPM. For example:

sass:
  load_paths:
  - bower_components
  - **/*/node_modules

The motivation for this change is so I can use the latest version of primer on a jekyll site.

/cc @jonrohan

bkeepers · 2016-07-10T16:40:23Z

I should have looked at open PRs. It looks like #45 does something similar, but allowing multiple values for sass_dir. Either one of these solutions would work for me.

The globbing in this PR is a nice feature, but not absolutely necessary. I could get around not having it by specifying each nested node_modules directory manually,.

/cc @benbalter @parkr @spudowiar

parkr · 2016-07-10T17:46:23Z

lib/jekyll/converters/scss.rb

+        # Expand file globs (e.g. `node_modules/*/node_modules` )
+        paths = paths.map { |path| Dir.glob(path) }.flatten.uniq
+
+        paths.select { |path| File.directory?(path) }


Should this line and line 82 be combined into one string rather than re-assigning paths? Thus paths.map { }.flatten.uniq.select { }.

This changed a bit in e5c28a5 and 7faa098. Let me know if you want me to try to chain these calls together more.

bkeepers · 2016-07-10T18:15:14Z

Any idea what's going on with the tests? They're all passing for me locally, but getting some weird errors on Travis:

  1) Jekyll::Converters::Scss when building configurations in safe mode forces load_paths to be just the local load path
     Failure/Error: Jekyll::Site.new(site_configuration)

     TypeError:
       can't create instance of singleton class
     # /home/travis/.rvm/gems/ruby-2.3.0/gems/jekyll-2.5.3/lib/jekyll/site.rb:428:in `new'
     # /home/travis/.rvm/gems/ruby-2.3.0/gems/jekyll-2.5.3/lib/jekyll/site.rb:428:in `block in instantiate_subclasses'
     # /home/travis/.rvm/gems/ruby-2.3.0/gems/jekyll-2.5.3/lib/jekyll/site.rb:427:in `map'
     # /home/travis/.rvm/gems/ruby-2.3.0/gems/jekyll-2.5.3/lib/jekyll/site.rb:427:in `instantiate_subclasses'
     # /home/travis/.rvm/gems/ruby-2.3.0/gems/jekyll-2.5.3/lib/jekyll/site.rb:81:in `setup'
     # /home/travis/.rvm/gems/ruby-2.3.0/gems/jekyll-2.5.3/lib/jekyll/site.rb:41:in `initialize'
     # ./spec/scss_converter_spec.rb:5:in `new'
     # ./spec/scss_converter_spec.rb:5:in `block (2 levels) in <top (required)>'
     # ./spec/scss_converter_spec.rb:85:in `block (4 levels) in <top (required)>'
     # ./spec/scss_converter_spec.rb:96:in `block (4 levels) in <top (required)>'

parkr · 2016-07-10T18:55:05Z

This looks great! @jekyll/security, would you mind taking a quick 👀 to ensure this is production-ready? Seems OK, but easier to ask now than later. 😉

Any idea what's going on with the tests?

@bkeepers We should remove the tests for Jekyll 2.5 for future versions of this gem. Ruby 2.3 changed the way singleton classes work and that seems to have caused a serious issue with Jekyll 2.5. It's not supported any longer so let's just nix it.

parkr · 2016-07-10T19:04:08Z

@bkeepers #52 fixes the CI issue.

* origin/master: (24 commits) Don't need history sections. Update history to reflect merge of jekyll#52 [ci skip] Don't test Jekyll 2.5 against Ruby 2.3. Whoops, they have to be h3's Update history to reflect merge of jekyll#46 [ci skip] travis: Jekyll 3.1.2 travis: match rvm versions with jekyll/jekyll Release 💎 v1.4.0 Update history to reflect merge of jekyll#42 add_charset false by default, but still strip BOM Update history to reflect merge of jekyll#39 Update history to reflect merge of jekyll#41 Test Jekyll 2 & 3 explicitly fix converter spec for jekyll 3 travis: update to match jekyll-watch Travis: use container infra Update Gemfile Add Jekyll 2 & 3 to test matrix Update history to reflect merge of jekyll#40 Update the version of Sass to be 3.4.x ...

parkr · 2016-07-10T20:13:42Z

spec/scss_converter_spec.rb

@@ -230,4 +230,60 @@ def converter(overrides = {})

  end

+  context "importing from internal libraries" do
+    let(:internal_library) { source_dir("bower_components/jquery") }
+    let(:converter) { site.getConverterImpl(Jekyll::Converters::Scss) }


This will have to be site.find_converter_instance if Jekyll::VERSION >= "3.0"

parkr · 2016-07-10T20:15:11Z

@bkeepers 2 more comments above, then LGTM. ☝️

bkeepers · 2016-07-10T20:23:10Z

Thanks for the review, @parkr!

parkr · 2016-07-10T22:09:05Z

This LGTM. Thank you! @benbalter, would you mind being my second pair of 👀 on this?

btoews · 2016-07-11T15:08:04Z

lib/jekyll/converters/scss.rb

+        # Expand file globs (e.g. `node_modules/*/node_modules` )
+        Dir.chdir(@config["source"]) do
+          paths = paths.map { |path| Dir.glob(path) }.flatten.uniq.
+                        map { |path| File.expand_path(path) }


I'd rather we did the Jekyll.sanitized_path after the expanding/globbing. Dir.glob and File.expand_path should be safe after the Jekyll.sanitized_path call, but they might do something weird that I don't know about.

👍 on that, thanks for the review, @mastahyeti. @bkeepers, would that work for you?

There's probably some DOS vectors if we don't sanitize before (.e.g. /**/* would scan the entire file system). Should we do both?

I'm 👍 on that. Sanitizing shouldn't be a very expensive operation.

@bkeepers Renewed interest in this. Would you mind taking a sec to update this path sanitization?

bkeepers · 2016-08-28T20:09:32Z

@parkr ok, I made updates based on feedback.

benbalter · 2016-08-29T15:25:25Z

lib/jekyll/converters/scss.rb

-          (user_sass_load_paths + [sass_dir_relative_to_site_source]).uniq
-        end.select { |load_path| File.directory?(load_path) }
+          # Sanitize paths to prevent any attack vectors (.e.g. `/**/*`)
+          paths.map! { |path| Jekyll.sanitized_path(@config["source"], path) }


What would happen if a malicious user set source: ../../../../../password? Aren't we using untrusted user input here to sanitize user input? (Or is that checked further down the stack @parkr?)

On GitHub Pages, we override source so no users could do this. Does that mitigate your concerns?

Additionally, @config["source"] comes from site.config. A quick solution is to do what Site does:

@source = File.expand_path(@config["source"]).freeze

bkeepers · 2016-11-14T17:59:38Z

@parkr @benbalter anything I can do to get this merged?

benbalter

My two concerns around source are resolved since source is going to be overridden on any safe implementation. 👍 from me but defer to @parkr in case there's anything I missed.

parkr · 2016-11-14T19:49:07Z

@jekyllbot: merge +minor

Allow load_paths in safe mode

1d4ac23

parkr reviewed Jul 10, 2016
View reviewed changes

bkeepers added 4 commits July 10, 2016 13:54

Add separate context for spec

4ab5c25

Glob and expand paths relative to source

e5c28a5

Combine maps

7faa098

Add test to ensure no traversal

39f708c

parkr added the enhancement label Jul 10, 2016

bkeepers mentioned this pull request Jul 10, 2016

Allow importing plain .css files #53

Closed

parkr reviewed Jul 10, 2016
View reviewed changes

bkeepers added 2 commits July 10, 2016 16:21

Remove test dir after

ad983fb

Fix old method for getting converter

8943904

btoews reviewed Jul 11, 2016
View reviewed changes

bkeepers force-pushed the safe-load-paths branch from 4db6883 to 5683bc6 Compare August 28, 2016 20:13

Sanitize after globbing for good measure

b693eb1

bkeepers force-pushed the safe-load-paths branch from 5683bc6 to b693eb1 Compare August 28, 2016 20:13

benbalter reviewed Aug 29, 2016
View reviewed changes

parkr approved these changes Oct 28, 2016

View reviewed changes

benbalter approved these changes Nov 14, 2016

View reviewed changes

jekyllbot merged commit 510da65 into jekyll:master Nov 14, 2016

jekyllbot added the enhancement label Nov 14, 2016

jekyllbot added a commit that referenced this pull request Nov 14, 2016

Update history to reflect merge of #50 [ci skip]

fc2f0a4

This was referenced Nov 14, 2016

SCSS converter: expand @config["source"] to be "safer". #55

Merged

Allow multiple SASS load paths, even in safe mode #45

Closed

jekyll locked and limited conversation to collaborators Apr 23, 2019

jekyllbot added the frozen-due-to-age label Apr 23, 2019

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Allow load_paths in safe mode with sanitization #50

Allow load_paths in safe mode with sanitization #50

bkeepers commented Jul 10, 2016

bkeepers commented Jul 10, 2016

parkr Jul 10, 2016

bkeepers Jul 10, 2016

bkeepers commented Jul 10, 2016

parkr commented Jul 10, 2016

parkr commented Jul 10, 2016

parkr Jul 10, 2016

parkr commented Jul 10, 2016

bkeepers commented Jul 10, 2016

parkr commented Jul 10, 2016

btoews Jul 11, 2016

parkr Jul 11, 2016

bkeepers Jul 21, 2016

parkr Jul 22, 2016

parkr Aug 9, 2016

bkeepers commented Aug 28, 2016

benbalter Aug 29, 2016

parkr Aug 30, 2016

parkr Oct 28, 2016

bkeepers commented Nov 14, 2016

benbalter left a comment

parkr commented Nov 14, 2016

Allow load_paths in safe mode with sanitization #50

Allow load_paths in safe mode with sanitization #50

Conversation

bkeepers commented Jul 10, 2016

bkeepers commented Jul 10, 2016

Choose a reason for hiding this comment

Choose a reason for hiding this comment

bkeepers commented Jul 10, 2016

parkr commented Jul 10, 2016

parkr commented Jul 10, 2016

Choose a reason for hiding this comment

parkr commented Jul 10, 2016

bkeepers commented Jul 10, 2016

parkr commented Jul 10, 2016

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

bkeepers commented Aug 28, 2016

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

bkeepers commented Nov 14, 2016

benbalter left a comment

Choose a reason for hiding this comment

parkr commented Nov 14, 2016