From f9168146978bd970d1f4fb061eff75264af88bb1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bj=C3=B8rn=20Erik=20Pedersen?=
 <bjorn.erik.pedersen@gmail.com>
Date: Sun, 23 Sep 2018 17:00:33 +0200
Subject: Prevent symbolic links from themes

---
 hugofs/nolstat_fs.go               | 39 ++++++++++++++++++++++++++++++++++++++
 hugolib/filesystems/basefs.go      |  1 +
 hugolib/filesystems/basefs_test.go |  6 ++++++
 3 files changed, 46 insertions(+)
 create mode 100644 hugofs/nolstat_fs.go

diff --git a/hugofs/nolstat_fs.go b/hugofs/nolstat_fs.go
new file mode 100644
index 000000000..6b27e8e1f
--- /dev/null
+++ b/hugofs/nolstat_fs.go
@@ -0,0 +1,39 @@
+// Copyright 2018 The Hugo Authors. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package hugofs
+
+import (
+	"os"
+
+	"github.com/spf13/afero"
+)
+
+var (
+	_ afero.Fs = (*noLstatFs)(nil)
+)
+
+type noLstatFs struct {
+	afero.Fs
+}
+
+// NewNoLstatFs creates a new filesystem with no Lstat support.
+func NewNoLstatFs(fs afero.Fs) afero.Fs {
+	return &noLstatFs{Fs: fs}
+}
+
+// LstatIfPossible always delegates to Stat.
+func (fs *noLstatFs) LstatIfPossible(name string) (os.FileInfo, bool, error) {
+	fi, err := fs.Stat(name)
+	return fi, false, err
+}
diff --git a/hugolib/filesystems/basefs.go b/hugolib/filesystems/basefs.go
index c8d568270..77a68a8ae 100644
--- a/hugolib/filesystems/basefs.go
+++ b/hugolib/filesystems/basefs.go
@@ -718,6 +718,7 @@ func createThemesOverlayFs(p *paths.Paths) (afero.Fs, []string, error) {
 	}
 
 	fs, err := createOverlayFs(p.Fs.Source, absPaths)
+	fs = hugofs.NewNoLstatFs(fs)
 
 	return fs, absPaths, err
 
diff --git a/hugolib/filesystems/basefs_test.go b/hugolib/filesystems/basefs_test.go
index ffa430add..9f4b512fd 100644
--- a/hugolib/filesystems/basefs_test.go
+++ b/hugolib/filesystems/basefs_test.go
@@ -218,6 +218,12 @@ func TestRealDirs(t *testing.T) {
 
 	checkFileCount(bfs.Resources.Fs, "", assert, 3)
 
+	assert.NotNil(bfs.themeFs)
+	fi, b, err := bfs.themeFs.(afero.Lstater).LstatIfPossible(filepath.Join("resources", "t1.txt"))
+	assert.NoError(err)
+	assert.False(b)
+	assert.Equal("t1.txt", fi.Name())
+
 }
 
 func TestStaticFs(t *testing.T) {
-- 
cgit v1.2.3