From 623dda71747c58dd052dbde3a0dbed1fb75b0c41 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B8rn=20Erik=20Pedersen?= Date: Thu, 23 Dec 2021 12:46:04 +0100 Subject: Revert "config/security: Add HOME to default exec env var whitelist" There have been one report in the wild suggesting that this needs to be tested better before doing: https://discourse.gohugo.io/t/hugo-mod-failing-in-v0-91-1-but-works-in-v0-91-0/36180/5 This reverts commit fca266ebbb81af3d4479873a7a79759033c7ce25. --- config/security/securityConfig.go | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'config/security/securityConfig.go') diff --git a/config/security/securityConfig.go b/config/security/securityConfig.go index 8b0a52698..09c5cb625 100644 --- a/config/security/securityConfig.go +++ b/config/security/securityConfig.go @@ -42,7 +42,7 @@ var DefaultConfig = Config{ ), // These have been tested to work with Hugo's external programs // on Windows, Linux and MacOS. - OsEnv: NewWhitelist("(?i)^(PATH|PATHEXT|APPDATA|HOME|TMP|TEMP|TERM)$"), + OsEnv: NewWhitelist("(?i)^(PATH|PATHEXT|APPDATA|TMP|TEMP|TERM)$"), }, Funcs: Funcs{ Getenv: NewWhitelist("^HUGO_"), @@ -110,6 +110,7 @@ func (c Config) CheckAllowedExec(name string) error { } } return nil + } func (c Config) CheckAllowedGetEnv(name string) error { @@ -158,6 +159,7 @@ func (c Config) ToSecurityMap() map[string]interface{} { "security": m, } return sec + } // DecodeConfig creates a privacy Config from a given Hugo configuration. @@ -187,6 +189,7 @@ func DecodeConfig(cfg config.Provider) (Config, error) { } return sc, nil + } func stringSliceToWhitelistHook() mapstructure.DecodeHookFuncType { @@ -202,6 +205,7 @@ func stringSliceToWhitelistHook() mapstructure.DecodeHookFuncType { wl := types.ToStringSlicePreserveString(data) return NewWhitelist(wl...), nil + } } -- cgit v1.2.3