jekyll_flexible_include 2.0.7 → 2.0.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 38eeb054b62e4c999437208ce95cb7291174167839d344db3df48670954b32ef
-  data.tar.gz: '0962b93b74c28d6521c655cea29f0646c11051d8f3ddaf690618b9ed91e7276b'
+  metadata.gz: 64eb6af1f283738c8152205359b97b42081c571cc8cd16dc30d263108e21aba0
+  data.tar.gz: 87b46d76f2f43022c458fff1dc4f3ea5523ccc0afe29ca7eb4c6c7f41554427d
 SHA512:
-  metadata.gz: 2e3ec9a8c269bda135c245a54b995abd6f2229658190a5f89e1bad97372e85f4a37af7c7227cbaa8b518f1ae90a6b70ecc3f0f9c881859329fdf241123047ca6
-  data.tar.gz: b8f6497ee5505ac0f43f28a6c9d0bb639be7b7c2bc712375f8ae6774522ccaae6ecd0108be1bdcb0d72cb1656e0b1a268ffa52d3feb675722295aca6c698961d
+  metadata.gz: 143e9c8cc4e9d5a109ce41020e46c4c8c0366e9c30bf4201263767e5276818ca32293430d6464afbea3a1925c90256219394dcf77b57735dd49ff3efa42dd940
+  data.tar.gz: 2dd1b9df7fa2936231ef0bb85ef8ecb87fc7afa9d519a9fda3dd9167869b13671c9ece3c13b1576ac11d9c0abc1adc498e7bc66fd5fb3fdb9634e417666119a6

data/CHANGELOG.md

@@ -1,3 +1,6 @@
+## 2.0.8 / 2022-04-14
+  * Added the ability to restrict arbitrary command execution, and specify the allowable directories to read from.
+
 ## 2.0.7 / 2022-04-14
   * Added `file=` option, so the included file or process is better defined. This option is not required; the file/process can be specified without it as before.
   * Documented `data-lt-active="false"`.

data/README.md

@@ -48,6 +48,34 @@ The following options imply `pre`:
   * `label` specifies that an automatically generated label be placed above the contents. There is no need to specify this option if `download` or `copy_button` options are provided.
   * `label="blah blah"` specifies a label for the contents; this value overrides the default label. The value can be enclosed in single or double quotes.
 
+### Restricting Directory Access
+By default, `flexible_include` can read from all directories according to the permissions of the user account that launched the `jekyll` process.
+For security-conscience environments, the accessible paths can be restricted.
+
+Defining an environment variable called `FLEXIBLE_INCLUDE_PATHS` prior to launching Jekyll will restrict the paths that `flexible_include` will be able to read from.
+This environment variable consists of a colon-delimited set of
+[file and directory glob patterns](https://docs.ruby-lang.org/en/2.7.0/Dir.html#method-c-glob).
+For example, the following restricts access to only the files within:
+ 1. The `~/my_dir` directory tree of the account of the user that launched Jekyll.
+ 2. The directory tree rooted at `/var/files`.
+ 3. The directory tree rooted at the expanded value of the `$work` environment variable.
+```shell
+export FLEXIBLE_INCLUDE_PATHS='~/my_dir/**/{*,.*}:/var/files/**/{*,.*}:$work/**/{*,.*}'
+```
+Note that the above matches dot (hidden) files as well as regular files.
+To just match visible files:
+```shell
+export FLEXIBLE_INCLUDE_PATHS='~/my_dir/**/*:/var/files/**/*:$work/**/*'
+```
+
+
+### Restricting Arbitrary Processes
+By default, `flexible_include` can execute any command. You can disable that by setting the environment variable `DISABLE_FLEXIBLE_INCLUDE` to any non-empty value.
+```shell
+export DISABLE_FLEXIBLE_INCLUDE=true
+```
+
+If a potential command execution is intercepted, a big red message will appear on the generated web page that says `Arbitrary command execution denied by DISABLE_FLEXIBLE_INCLUDE value.`, and a red error message will be logged on the console that says something like: `ERROR FlexibleInclude: _posts/2020/2020-10-03-jekyll-plugins.html - Arbitrary command execution denied by DISABLE_FLEXIBLE_INCLUDE value.`
 
 
 ## Installation

data/lib/flexible_include/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module JekyllFlexibleIncludePluginVersion
-  VERSION = "2.0.7"
+  VERSION = "2.0.8"
 end

data/lib/flexible_include.rb

@@ -24,6 +24,13 @@ class FlexibleInclude < Liquid::Tag
     super
     @logger = PluginMetaLogger.instance.new_logger(self, PluginMetaLogger.instance.config)
     @helper = JekyllTagHelper.new(tag_name, markup, @logger)
+
+    @execution_denied = ENV['DISABLE_FLEXIBLE_INCLUDE']
+
+    # If FLEXIBLE_INCLUDE_PATHS='~/lib/**/*:*/**/*'
+    # Then @read_paths will be set to ["~/lib/**/*", "*/**/*"]
+    @read_paths = ENV['FLEXIBLE_INCLUDE_PATHS']
+    @read_paths = @read_paths.split(":").map { |x| JekyllTagHelper.expand_env x } if @read_paths
   end
 
   # @param liquid_context [Liquid::Context]
@@ -48,13 +55,16 @@ class FlexibleInclude < Liquid::Tag
     path = JekyllTagHelper.expand_env(filename)
     case path
     when /\A\// # Absolute path
+      return denied("Access to #{path} denied by FLEXIBLE_INCLUDE_PATHS value.") unless access_allowed(path)
       @logger.debug { "Absolute path=#{path}, filename=#{filename}" }
     when /\A~/ # Relative path to user's home directory
+      return denied("Access to #{path} denied by FLEXIBLE_INCLUDE_PATHS value.") unless access_allowed(path)
       @logger.debug { "User home start filename=#{filename}, path=#{path}" }
       filename.slice! "~/"
       path = File.join(ENV['HOME'], filename)
       @logger.debug { "User home end filename=#{filename}, path=#{path}" }
     when /\A!/ # Run command and return response
+      return denied("Arbitrary command execution denied by DISABLE_FLEXIBLE_INCLUDE value.") if @execution_denied
       filename = JekyllTagHelper.remove_quotes(@helper.argv.first) if @helper.argv.first
       filename.slice! "!"
       contents = run(filename)
@@ -72,6 +82,16 @@ class FlexibleInclude < Liquid::Tag
 
   private
 
+  def access_allowed(path)
+    return true unless @read_paths
+    Dir.glob(@read_paths).find { |x| x == path }
+  end
+
+  def denied(msg)
+    @logger.error("#{@helper.page.path} - #{msg}")
+    "<p style='color: white; background-color: red; padding: 2pt 1em 2pt 1em;'>#{msg}</p>"
+  end
+
   def read_file(file)
     File.read(file)
   end

data/lib/jekyll_tag_helper.rb

@@ -9,7 +9,7 @@ class JekyllTagHelper
     string.gsub("{", "&#123;").gsub("}", "&#125;").gsub("<", "&lt;")
   end
 
-  # Expand environment variable references
+  # Expand a environment variable reference
   def self.expand_env(str)
     str.gsub(/\$([a-zA-Z_][a-zA-Z0-9_]*)|\${\g<1>}|%\g<1>%/) { ENV[Regexp.last_match(1)] }
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: jekyll_flexible_include
 version: !ruby/object:Gem::Version
-  version: 2.0.7
+  version: 2.0.8
 platform: ruby
 authors:
 - Mike Slinn