jekyll-sass-converter 1.4.0 → 1.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 71288fcd81a667822653dc71bd95ccedd9be0428
-  data.tar.gz: 71e8375de0f5aa7795850292b905c079a33054ba
+  metadata.gz: 645b96822c506f0d86f27cce5dc09793c4842982
+  data.tar.gz: 9eff7d0b5b3f471bc4d898edeb447aae620f3601
 SHA512:
-  metadata.gz: 0cc730a8eac61db90a74430bf0c0d865b580262bd19e2d0697fb66b0edb2bc704c10ec2996dbb7db826e1485223e5cda882434e92ad564a02bbee3ef252ea060
-  data.tar.gz: fee08ad83bd90778f43e144e48775ea00594d820c8e78f435f9f14eed19fb9584f9d41497e5217d4184cc51d1c05501b42ab07dc8a14131c077ceca975371163
+  metadata.gz: d06aefb9977c5861b8871db35659fc9b0e50b7870f329f83eeef738f3a5ef74ccba66c48ea989aed5f16152fc808fe0fe375c209c7938e96f9f9d16e2e4e8ee5
+  data.tar.gz: 2bf05d542e7e713970b2b5b3e7f4c25c95ba2b5d6f05fdaf6d1c217aa93527b911191dbe969fed816885dbeecfd1ccbd9700ed695b7ab0ff40a61e0f147e0712

data/lib/jekyll-sass-converter/version.rb

@@ -1,3 +1,3 @@
 module JekyllSassConverter
-  VERSION = "1.4.0"
+  VERSION = "1.5.0"
 end

data/lib/jekyll/converters/scss.rb

@@ -71,15 +71,32 @@ module Jekyll
       end
 
       def sass_dir_relative_to_site_source
-        Jekyll.sanitized_path(@config["source"], sass_dir)
+        Jekyll.sanitized_path(site_source, sass_dir)
       end
 
       def sass_load_paths
+        paths = user_sass_load_paths + [sass_dir_relative_to_site_source]
+
         if safe?
-          [sass_dir_relative_to_site_source]
-        else
-          (user_sass_load_paths + [sass_dir_relative_to_site_source]).uniq
-        end.select { |load_path| File.directory?(load_path) }
+          # Sanitize paths to prevent any attack vectors (.e.g. `/**/*`)
+          paths.map! { |path| Jekyll.sanitized_path(site_source, path) }
+        end
+
+        # Expand file globs (e.g. `node_modules/*/node_modules` )
+        Dir.chdir(site_source) do
+          paths = paths.map { |path| Dir.glob(path) }.flatten.uniq
+
+          paths.map! do |path|
+            if safe?
+              # Sanitize again in case globbing was able to do something crazy.
+              Jekyll.sanitized_path(site_source, path)
+            else
+              File.expand_path(path)
+            end
+          end
+        end
+
+        paths.select { |path| File.directory?(path) }
       end
 
       def allow_caching?
@@ -105,6 +122,11 @@ module Jekyll
       rescue ::Sass::SyntaxError => e
         raise SyntaxError.new("#{e.to_s} on line #{e.sass_line}")
       end
+
+      private
+      def site_source
+        @site_source ||= File.expand_path(@config["source"]).freeze
+      end
     end
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: jekyll-sass-converter
 version: !ruby/object:Gem::Version
-  version: 1.4.0
+  version: 1.5.0
 platform: ruby
 authors:
 - Parker Moore
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-12-26 00:00:00.000000000 Z
+date: 2016-11-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: sass
@@ -111,7 +111,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.2.5
+rubygems_version: 2.5.1
 signing_key: 
 specification_version: 4
 summary: A basic Sass converter for Jekyll.