hugo/target/htmlredirect.go
Anthony Fok e71bef79e5 Validate aliases to prevent directory traversal etc.
Add validation before creating aliases:

 * Prevent creating aliases outside webroot (public/ dir)
 * Skip empty "" alias
 * Skip "/" → "/index.html", which gets overwritten anyway
 * Refuse to create Windows-invalid filenames on Windows;
   warn on other platforms
 * In case of invalid aliases, after skipping them,
   return `err = nil` to prevent the error passing up
   all the way to `hugolib.Render()` and causing Hugo to abort.
 * Update alias tests.

Fixes #701: Add support for alias with whitespace
Fixes #1418: Add validation for alias
2015-09-13 18:08:42 +02:00

128 lines
3.8 KiB
Go

package target
import (
"bytes"
"fmt"
"html/template"
"path/filepath"
"runtime"
"strings"
"github.com/spf13/hugo/helpers"
"github.com/spf13/hugo/hugofs"
jww "github.com/spf13/jwalterweatherman"
)
const ALIAS = "<!DOCTYPE html><html><head><link rel=\"canonical\" href=\"{{ .Permalink }}\"/><meta http-equiv=\"content-type\" content=\"text/html; charset=utf-8\" /><meta http-equiv=\"refresh\" content=\"0;url={{ .Permalink }}\" /></head></html>"
const ALIAS_XHTML = "<!DOCTYPE html><html xmlns=\"http://www.w3.org/1999/xhtml\"><head><link rel=\"canonical\" href=\"{{ .Permalink }}\"/><meta http-equiv=\"content-type\" content=\"text/html; charset=utf-8\" /><meta http-equiv=\"refresh\" content=\"0;url={{ .Permalink }}\" /></head></html>"
var DefaultAliasTemplates *template.Template
func init() {
DefaultAliasTemplates = template.New("")
template.Must(DefaultAliasTemplates.New("alias").Parse(ALIAS))
template.Must(DefaultAliasTemplates.New("alias-xhtml").Parse(ALIAS_XHTML))
}
type AliasPublisher interface {
Translator
Publish(string, template.HTML) error
}
type HTMLRedirectAlias struct {
PublishDir string
Templates *template.Template
}
func (h *HTMLRedirectAlias) Translate(alias string) (aliasPath string, err error) {
originalAlias := alias
if len(alias) <= 0 {
return "", fmt.Errorf("Alias \"\" is an empty string")
}
alias = filepath.Clean(alias)
components := strings.Split(alias, helpers.FilePathSeparator)
if alias == helpers.FilePathSeparator {
return "", fmt.Errorf("Alias \"%s\" resolves to website root directory", originalAlias)
}
// Validate against directory traversal
if components[0] == ".." {
return "", fmt.Errorf("Alias \"%s\" traverses outside the website root directory", originalAlias)
}
// Handle Windows filename restrictions
msgs := []string{}
reservedNames := []string{"CON", "PRN", "AUX", "NUL", "COM1", "COM2", "COM3", "COM4", "COM5", "COM6", "COM7", "COM8", "COM9", "LPT1", "LPT2", "LPT3", "LPT4", "LPT5", "LPT6", "LPT7", "LPT8", "LPT9"}
if strings.ContainsAny(alias, ":*?\"<>|") {
msgs = append(msgs, fmt.Sprintf("Alias \"%s\" contains invalid characters in a filename on Windows: : * ? \" < > |", originalAlias))
}
for _, c := range components {
if strings.HasSuffix(c, ".") {
msgs = append(msgs, fmt.Sprintf("Alias \"%s\" contains component with trailing period, invalid on Windows", originalAlias))
}
for _, r := range reservedNames {
if c == r {
msgs = append(msgs, fmt.Sprintf("Alias \"%s\" contains component with reserved name \"%s\" on Windows", originalAlias, r))
}
}
}
if len(msgs) > 0 {
if runtime.GOOS == "windows" {
for _, m := range msgs {
jww.ERROR.Println(m)
}
return "", fmt.Errorf("Cannot create \"%s\": Windows filename restriction", originalAlias)
} else {
for _, m := range msgs {
jww.WARN.Println(m)
}
}
}
// Add the final touch
if strings.HasPrefix(alias, helpers.FilePathSeparator) {
alias = alias[1:]
}
if strings.HasSuffix(alias, helpers.FilePathSeparator) {
alias = alias + "index.html"
} else if !strings.HasSuffix(alias, ".html") {
alias = alias + helpers.FilePathSeparator + "index.html"
}
if originalAlias != alias {
jww.INFO.Printf("Alias \"%s\" translated to \"%s\"\n", originalAlias, alias)
}
return filepath.Join(h.PublishDir, alias), nil
}
type AliasNode struct {
Permalink template.HTML
}
func (h *HTMLRedirectAlias) Publish(path string, permalink template.HTML) (err error) {
if path, err = h.Translate(path); err != nil {
jww.ERROR.Printf("%s, skipping.", err)
return nil
}
t := "alias"
if strings.HasSuffix(path, ".xhtml") {
t = "alias-xhtml"
}
template := DefaultAliasTemplates
if h.Templates != nil {
template = h.Templates
}
buffer := new(bytes.Buffer)
err = template.ExecuteTemplate(buffer, t, &AliasNode{permalink})
if err != nil {
return
}
return helpers.WriteToDisk(path, buffer, hugofs.DestinationFS)
}