d276e901b3
63386081c update cSpell config update 15c76494b Update cSpell custom dictionary (#1694) 34f3167b7 Update image processing (#1625) 7462cc798 fix: pipes in sample code break table creation (#1686) 48736447e Update anchorize.md 2ff0bd10b netlify: Hugo 0.95.0 0fc1d21b2 Update configuration.md 41855e372 Fix #1682 8c663433e Update related.md 7aa072eab netlify: Hugo 0.94.2 1682c7ee7 Update render-hooks.md ce1283cc4 Move the Render Hooks doc to its own page bbbbfbfc6 Update configuration-markup.md 92d91a316 Update configuration-markup.md 2e8068823 Update configuration-markup.md ff2dbca60 Update configuration-markup.md 89d8e5d65 Add code block documenation e993539f0 Update shortcodes.md c1b28dbfe netlify: Hugo 0.94.1 81b8c9b83 Merge branch 'tempv0.94.1' 4763b3d50 docs: Regenerate CLI docs b18463971 netlify: Bump to Hugo 0.94.0 4152ebc1d Merge branch 'tempv0.94.0' ba3a11ac2 docs: Regenerate docshelper e64016d13 docs: Regenerate docshelper 29180e4d2 add `.html` suffix to partial usage and references 3213e00f2 Docs tidy-up 6cfcae4b7 docs: Regenerate CLI docs 8a6cd0b4d docs: Regenerate docshelper b20ab262f Merge commit 'd706529720b3b2ccb99719ccd578062ca25a0cc2' git-subtree-dir: docs git-subtree-split: 63386081c55de6a7f97adde564a9cfc2ad326119
3.8 KiB
| title | description | date | layout | keywords | menu | weight | sections_weight | draft | aliases | toc | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Hugo's Security Model | A summary of Hugo's security model. | 2019-10-01 | single |
|
|
5 | 5 | false |
|
true |
Runtime Security
Hugo produces static output, so once built, the runtime is the browser (assuming the output is HTML) and any server (API) that you integrate with.
But when developing and building your site, the runtime is the hugo executable. Securing a runtime can be a real challenge.
Hugo's main approach is that of sandboxing and a security policy with strict defaults:
- Hugo has a virtual file system and only the main project (not third-party components) is allowed to mount directories or files outside the project root.
- Only the main project can walk symbolic links.
- User-defined components have read-only access to the filesystem.
- We shell out to some external binaries to support Asciidoctor and similar, but those binaries and their flags are predefined and disabled by default (see Security Policy). General functions to run arbitrary external OS commands have been discussed, but not implemented because of security concerns.
Security Policy
{{< new-in "0.91.0" >}}
Hugo has a built-in security policy that restricts access to os/exec, remote communication and similar.
The default configuration is listed below. Any build using features not in the allow list of the security policy will fail with a detailed message about what needs to be done. Most of these settings are allow lists (string or slice, Regular Expressions or none which matches nothing).
{{< code-toggle config="security" />}}
Note that these and other config settings in Hugo can be overridden by the OS environment. If you want to block all remote HTTP fetching of data:
HUGO_SECURITY_HTTP_URLS=none hugo
Dependency Security
Hugo is built as a static binary using Go Modules to manage its dependencies. Go Modules have several safeguards, one of them being the go.sum file. This is a database of the expected cryptographic checksums of all of your dependencies, including transitive dependencies.
Hugo Modules is a feature built on top of the functionality of Go Modules. Like Go Modules, a Hugo project using Hugo Modules will have a go.sum file. We recommend that you commit this file to your version control system. The Hugo build will fail if there is a checksum mismatch, which would be an indication of dependency tampering.
Web Application Security
These are the security threats as defined by OWASP.
For HTML output, this is the core security model:
https://golang.org/pkg/html/template/#hdr-Security_Model
In short:
Templates authors (you) are trusted, but the data you send in is not.
This is why you sometimes need to use the safe functions, such as safeHTML, to avoid escaping of data you know is safe.
There is one exception to the above, as noted in the documentation: If you enable inline shortcodes, you also say that the shortcodes and data handling in content files are trusted, as those macros are treated as pure text.
It may be worth adding that Hugo is a static site generator with no concept of dynamic user input.
For content, the default Markdown renderer is configured to remove or escape potentially unsafe content. This behavior can be reconfigured if you trust your content.