-
-
Notifications
You must be signed in to change notification settings - Fork 7.4k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Allow for arbitrary Asciidoctor extensions #7698
Comments
This will be very helpful. @gzagatti maybe you can add a PR to add this functionality. |
Sure, will do. Just need some additional time. |
See #796, esp. starting with #796 (comment) and below. I doubt we'll merge your PR without safeguards in Hugo first. |
Thanks for considering the PR and pointing to the right discussion. With regards to the Asciidoc markup extension implemented in Hugo, it seems to be the case that Hugo is simply checking whether the allowed packages are installed in asciidoctor's execution path. Any extension which has been renamed to agree with these names could thus be executed, alas any arbitrary code could be executed. This is a workaround which I use on my own machine to ensure that I can use Hugo without modification. The PR thus try to follow Asciidoc specification in honoring the SafeMode directives. |
I don't use asciidoctor, so help me understand. What is "asciidoctor's execution path"? Is it the system search path ($PATH) or a path more exclusive to asciidoctor? Can asciidoctor be used to execute arbitrary executable names in the system path? Can asciidoctor be used to execute scripts/executables within a hugo site? |
So, without discussing how potentially unsafe Asciidoctor is (I don't know, and that is certainly beyhond the scope of this PR), I'm having problem seeing how this PR changes this in any direction? Note that my concerns comes from "me downloading and building a random Hugo site from the internet". |
I don't understand how this honors Asciidoctor specification. I don't see anything in the Asciidoctor documentation saying "use unsafe mode to be able to include any extension that is not allowed by Hugo otherwise". @bep What if it was an environment variable that cannot be changed in the Current behaviour:
Disable all extensions (including the ones in
Allow extensions
Allow all extensions:
|
Asciidoctor allows for any arbitrary extension that is passed with the For instance, my use case is to have a custom converter such as the simplified example below: require 'asciidoctor'
require 'asciidoctor/converter/html5'
class Converter::MyCustomHtml5Converter < Asciidoctor::Converter::Html5Converter
register_for 'html_5'
def convert node, transform = node.node_name, opts = nil
if transform == 'custom_transform'; return convert_custom node
else; return super
end
end
def convert_custom node
'foo'
end
end I place it on ...
markup:
asciidocext:
extensions:
- ./static/asciidoctor-extension.rb I am not sure exactly whether Asciidoctor's I hope this helps to understand how Asciidoctor works when loading extensions. |
markup:
asciidocext:
extensions:
- ./static/asciidoctor-extension.rb The above and variants of the above is not something I'm prepared to allow in Hugo at the moment. Note that I can sympathize with the argument about "this is my site and I own the source and configuration", but that isn't alway the case. One example would be me downloading arbitrary Hugo sites helping people out with problems on the forum. |
Fair enough, but as long as there was a method like the one proposed by @helfper in which we can specify the allowed ruby libraries that would be more than enough. For instance, the configuration could go like this: markup:
asciidocext:
extensions:
- asciidoctor-my-extension This would fail unless you have installed the ruby package in your system. An arbitrary Hugo site would not be able to install or use an arbitrary ruby extension if you did not install it before. In my case, it would be a matter of packaging the application and installing on my system. Would that pose significant security risks beyond what is already allowed in the current implementation? |
Can you demonstrate that for us? If the module is in the root of the hugo site, can you prove that asciidoctor can't locate it? I hate ruby (no, seriously 😆), so I'm not very familiar with it's package lookup process. This is the first time I've really paid much attention to our asciidoctor integration. If we allowed arbitrary extensions in the site config, how would you recommend that we sanitize the values? No path separators allowed? |
I did some investigation with regards to This link (pointed from Ruby's documentation) contains a discussion about the
If you did not modify ruby's > hugo serve -v
...
INFO 2021/01/13 23:09:22 Rendering posts/50f0be91-05d3-481a-ad65-102a3db51dbc.adoc with /home/gzagatti/.linuxbrew/bin/asciidoctor using asciidoctor args [-r asciidoctor-diagram -r asciidoctor-bibtex -r asciidoctor-katex --no-header-footer --verbose --trace -] ...
ERROR 2021/01/13 23:09:22 about.adoc: <internal:/home/gzagatti/.linuxbrew/lib/ruby/site_ruby/3.0.0/rubygems/core_ext/kernel_require.rb>:85:in `require': cannot load such file -- asciidoctor-diagram (LoadError)
... Thus, I think that if we sanitize the extensions by not allowing path separators or dots (ie. |
@gzagatti, Given everything you've detailed here, I think we can work around my security concerns. I've created a POC of what I'm thinking here: https://play.golang.org/p/kolDZ_g8Fw7. Essentially, don't allow any path separators, regardless of the platform. We can possibly fail the site build if a path separator was found instead of silently sanitizing the value. Cc: @bep |
@moorereason, thanks for considering this alternative. I would go even further and disallow dots in the extension name, since they serve no purpose except for calling relative paths. Here is some additional documentation about how Ruby gems should be named. I have modified your POC slightly to suggest how possible extension names should be resolved: https://play.golang.org/p/JQEnoCS1YPZ. If you're happy with that, I could give it a go and modify the PR to do as you suggested, "fail the site build if a path separator was found instead of silently sanitizing the value". |
Sounds good. 👍
Yes, please update the PR. |
I have updated PR #8131 by allowing only arbitrary asciidoc extensions that do not have path separators (either I hope this address the issues raised so far. I am looking forward to hearing back. |
markup: Allow installed arbitrary Asciidoc extension via path validation.
markup: Allow installed arbitrary Asciidoc extension via path validation.
@moorereason @bep I would like to follow up on this conversation and PR #8131 where I incorporated the issues raised in this discussion. |
Thanks so much! It was a pleasure to contribute with this project. |
fb551cc75 Update index.md 7af894857 Update index.md d235753ea Hugo 0.82.1 e03e72deb Merge branch 'temp0821' e62648961 Merge branch 'release-0.82.1' e1ab0f6eb releaser: Add release notes to /docs for release of 0.82.1 5d354c38d Replaced ``` code blocks with Code Toggler c9d065c20 Remove duplicate YAML keys (#1420) 8ae31e701 Add webp image encoding support 848f2af26 Update internal.md (#1407) c103a86a4 Fix `ref` shortcode example output (#1409) 9f8ba56dc Remove leading dot from where function KEY (#1419) 363251a51 Improve presentation of template lookup order (#1382) b73da986d Improve description of Page Resources (#1381) 4e0bb96d5 Rework robots.txt page (#1405) edf893e6f Update migrations.md (#1412) 450f1580b Add link to `site` function doc (#1417) cfffa6e6f Added one extension to the list (#1414) 05f1665a0 Update theme 5de0b1c6a Update theme 250e20552 Add hugo.IsExtended dea5e1fd7 Fix typo on merge function page (#1408) 1bbed2cf3 Update configuration.md be0b64a46 Omit ISO cbb5b8367 Fix `dateFormat` documentation 698f15466 Regenerate the docshelper f9a8a7cb6 Update multilingual.md a22dc6267 Fix grammar (#1398) eb98b0997 Fix pretty URL example (#1397) f4c4153dc Mention date var complementation in post scheduling (#1396) 17fae284c Fix resources.ExecuteAsTemplate argument order (#1394) 97e2c2abb Use code-toggle shortcode in `multilingual.md` (#1388) 3a84929bb Harmonize capitalization (#1393) 17f15daa6 fix file naming used in example (#1392) 5d97b6a18 Add slice syntax to sections permalinks config 00665b97b Improve description of `site.md` edcf5e3fc Fix example in `merge.md` f275ab778 Update postprocess.md 9593e3991 Fix file name 59bd9656f Update postprocess.md 1172fb6d0 Update to theNewDynamic repository (#1263) f5b5c1d2c Update Hugo container image 4f2e92f2a Adapt anchorize.md to Goldmark 98aa19073 Directly link to `highlight` shortcode (#1384) 4c75c2422 Fix header level f15c06f23 markdownify: add note about render-hooks and .RenderString (#1281) 69c82eb68 Remove Blackfriday reference from shortcode desc (#1380) 36de478df Update description of ignoreFiles config setting (#1377) 6337699d8 Remove "Authors" page from documentation (#1371) 35e73ca90 fix indent in example (#1372) d3f01f19a Remove opening body tag from header example (#1376) 341a5a7d8 Update index.md c9bfdbee6 Release 0.82.0 119644949 releaser: Add release notes to /docs for release of 0.82.0 32efaed78 docs: Regenerate docs helper dea5449a2 docs: Regen CLI docs eeab18fce Merge commit '81689af79901f0cdaff765cda6322dd4a9a7ccb3' d508a1259 Attributes for code fences should be placed after the lang indicator only c80905cef deps: Update to esbuild v0.9.0 95350eb79 Add support for Google Analytics v4 02d36f9bc Allow markdown attribute lists to be used in title render hooks 7df220a64 Merge commit '9d31f650da964a52f05fc27b7fb99cf3e09778cf' d80bf61b7 Fixes #7698. git-subtree-dir: docs git-subtree-split: fb551cc750faa83a1493b0e0d0898cd98ab74465
This issue has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs. |
First of all thanks for putting this project together.
I am currently using Asciidoctor to write all the posts for my website. However, I use custom made extensions to render my posts according to my specifications.
Unfortunately, Hugo comes with a hard coded pre-specificed list of allowed Asciidoctor extensions. When Hugo is preparing the Asciidoctor converter it basically checks whether the passed extension is on the list of allowed extension and if not it simply ignores the extension.
I have created a fork that simply removes the check and Hugo is able to use any arbitrary Asciidoctor extension which means I can render my website just by calling
hugo
.This behavior is quite puzzling to me as I do not see any reason to not allow the user to determine the extensions which he/she wants to use. Of course, It should be the final user's responsibility to ensure that her/his desired extension is compatible with Hugo. I might be missing something here.Would it be possible to turn off this check on allowed extensions? Is there any reason otherwise.
Thanks again for developing this awesome software.
The text was updated successfully, but these errors were encountered: