Commit graph

12 commits

Author SHA1 Message Date
Bjørn Erik Pedersen
f4389e48ce
Add some basic security policies with sensible defaults
This ommmit contains some security hardening measures for the Hugo build runtime.

There are some rarely used features in Hugo that would be good to have disabled by default. One example would be the "external helpers".

For `asciidoctor` and some others we use Go's `os/exec` package to start a new process.

These are a predefined set of binary names, all loaded from `PATH` and with a predefined set of arguments. Still, if you don't use `asciidoctor` in your project, you might as well have it turned off.

You can configure your own in the new `security` configuration section, but the defaults are configured to create a minimal amount of site breakage. And if that do happen, you will get clear instructions in the loa about what to do.

The default configuration is listed below. Note that almost all of these options are regular expression _whitelists_ (a string or a slice); the value `none` will block all.

```toml
[security]
  enableInlineShortcodes = false
  [security.exec]
    allow = ['^dart-sass-embedded$', '^go$', '^npx$', '^postcss$']
    osEnv = ['(?i)^(PATH|PATHEXT|APPDATA|TMP|TEMP|TERM)$']

  [security.funcs]
    getenv = ['^HUGO_']

  [security.http]
    methods = ['(?i)GET|POST']
    urls = ['.*']
```
2021-12-16 09:40:22 +01:00
Bjørn Erik Pedersen
6183184b96
Merge commit '45e6fdb315d113ba13e20a633ed0c67e3f25170d' 2021-12-13 21:05:10 +01:00
Bjørn Erik Pedersen
494f284be3
docs: Adjust config docs 2021-08-03 12:22:02 +02:00
Bjørn Erik Pedersen
e7e194435b
Merge commit '9d31f650da964a52f05fc27b7fb99cf3e09778cf' 2021-02-23 17:41:05 +01:00
Bjørn Erik Pedersen
626b16e024
Merge commit '9e1dcefc5f559944b70d2fa520f6acd5c56a69f2' 2020-05-31 12:43:33 +02:00
Bjørn Erik Pedersen
1e5eb8679e
Merge commit '3c0036805d64fdd8290f1c4a31371780ff3ea365' 2020-02-06 13:03:30 +01:00
Bjørn Erik Pedersen
bfb9613a14
Add Goldmark as the new default markdown handler
This commit adds the fast and CommonMark compliant Goldmark as the new default markdown handler in Hugo.

If you want to continue using BlackFriday as the default for md/markdown extensions, you can use this configuration:

```toml
[markup]
defaultMarkdownHandler="blackfriday"
```

Fixes #5963
Fixes #1778
Fixes #6355
2019-11-23 14:12:24 +01:00
Bjørn Erik Pedersen
27aef3f1fb Merge commit 'b9bd35d72e14932fb6588ff62b90cddef0a060fc' as 'docs' 2019-10-21 10:22:28 +02:00
Bjørn Erik Pedersen
39121de4d9
docs: Replace /docs 2019-10-21 10:21:51 +02:00
Bjørn Erik Pedersen
77bf2991b1 docs: Add Hugo Modules docs 2019-07-25 13:21:30 +02:00
Bjørn Erik Pedersen
876e5f67b1
Merge commit 'c2037f0c9a3a35b9db9c404f6b5f94ec8b690a53' 2019-03-26 18:41:36 +01:00
Bjørn Erik Pedersen
22afe28047
Merge commit '978856e2ad12d2bcaf37bb9e31f806b30a4c42f4' 2018-12-26 10:27:54 +01:00