Added exec template function.

[sba1]

A new template function called exec is added. This function can be used to
include the standard output of an external command. Commands that are
allowed to be executed must be listed within the newly introduced
execWhiteList setting.

This is very similar to PR #1548, especially the idea of the white list was
inspired by that request.

[bep]

Return an error instead of logging it. Easier to test, for once.

[sba1]

• if !commandAccepted {

•    jww.ERROR.Printf("Executing %s is not allowed. Check
  

  execWhiteList settings.", str)

•    return "", nil
  

Return an error instead of logging it.

Done. The test for the failure case looks a bit awkward now, let me know
if it can be improved (never did anything with Go before).

[moorereason]

No need to use fmt.Sprintf here.

[moorereason]

lgtm

CircleCI is dumb.

[digitalcraftsman]

Does this pull request replace #847?

[sba1]

Am 2016-03-12 12:41, schrieb digitalcraftsman:

Does this pull request replace #847 [1]?

Seems so. At least in parts. It doesn't add the short code yet (though I
have this in my local branch).

[bep]

As neither of these solves the fundamental security issue, it doesn't really matter.

[sba1]

As neither of these solves the fundamental security issue, it doesn't
really matter.

In fact, I was not aware of PR #847 and the discussion when creating
this PR, however, as in the final version of this request (which was not
responded though), a white list config string for the global
configuration was introduced following your suggestion. This is also the
case in this PR as described in the doc and commit message. If this is
not correct (in fact my knowledge about Hugo internals is little) I'm
open for suggestions.

For instance, another possibility would be to add a new command line
parameter to hugo to enable this feature.

[bep]

@digitalcraftsman suggested in another issue that we add a savetofile template func. Combine that with exec and you will have the perfect platform for sophisticated Trojan horses.

A whitelist and a --unsafe flag is the minimum here. But that is, in my eyes, still not enough. People make mistakes and suddenly the unsafe boolean is switched and the whitelist check could be bypassed by terminating the string with an emoji :-) ...

[digitalcraftsman]

Especially in this combination I can understand your concerns.

[sba1]

@digitalcraftsman [1] suggested in another issue that we add a savetofile template func. Combina that with exec and you will have the perfect platform for sophisticated Trojan horses.

Actually, one of my wishes that I can directly embed some code (in some programming language) which is compiled, executed, its output is then embedded in the final output (so this exec is only the first step). Like in report generation such as in knitr or pweave, but initially much simpler.

A whitelist and a --unsafe flag is the minimum here. But that is, in my eyes, still not enough. People make mistake ans suddenly the unsafe boolean is switched and the whitelist check could be bypassed by terminating the string with an emoji :-) ...

I would use hugo only as a static site generator. I agree that the feature can be troublesome when one would use "hugo server" in production. Is this the intended use case for hugo? Generally, I wouldn't mind if this exec feature would simply not work for "hugo server".

[bep]

Unless someone has some really enlightening to add, I suggest we close this and related issues/PRs -- and focus on what we can do. A cross-platform cat (file reader) would be a good start.

[sba1]

Unless someone has some really enlightening to add, I suggest we close this and related issues/PRs -- and focus on what we can do. A cross-platform cat (file reader) would be a good start.

Of course, it is all your choice. But what is with the suggestion to disable the feature for the "hugo server" option? With this question I'm just trying to understand what the exact security concerns are. For me, hugo appears to be a static web site generator, so it converts some input files to some output files similar to a compiler ahead of time, i.e., there is usually a separate publishing step. If I understood it correctly, your concern is that one could do everything with an exec feature, which is of course right as it was the purpose of such a command (though the feature has to be explicitly enabled and the user has every control over it). This is essentially a feature other programming language offers (also e.g. in LaTeX). Also, I've just learned about the "external helpers" concept of hugo, which means that hugo already calls external (predefined) programs. Apparently, some flexibility is useful (and because one doesn't have control over these tools one also cannot say that they never do potentially bad things).

[bep]

http://discuss.gohugo.io/ is a better place for discussions.

[bep]

I'm closing this now. We may revisit this in the future. Maybe.

[github-actions]

This pull request has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.