-
-
Notifications
You must be signed in to change notification settings - Fork 8.1k
Closed
Labels
Description
In v0.152.0 (#14071) we prevented mounts defined within modules from accessing things like /etc/passwd. We did this by limiting the source to paths within the module. That works great, but we may want to change that restriction to paths within the module and paths within the project.
Reasoning...
Yesterday we had a report of the "mount source must be a local path for modules/themes" error with a project that uses the docsy theme.
See https://github.com/google/docsy/blob/818f62f07329270860a4faa3e2a9e8cfbd269a96/hugo.yaml#L39-L40.
Here's an integration test:
// Issue 14083
func TestIssue14083(t *testing.T) {
t.Parallel()
files := `
-- hugo.toml --
disableKinds = ['page','rss','section','sitemap','taxonomy','term']
[[module.imports]]
path = 'my-theme'
-- package.json --
{
"dependencies": {
"bootstrap": "^5.3.8"
}
}
-- content/_index.md --
---
title: home
---
-- node_modules/bootstrap/dist/css/bootstrap.css --
foo
-- themes/my-theme/layouts/home.html --
{{ with resources.Get "/vendor/bootstrap/dist/css/bootstrap.css" }}{{ .RelPermalink }}{{ end }}
-- themes/my-theme/hugo.toml --
[[module.mounts]]
source = 'layouts'
target = 'layouts'
[[module.mounts]]
source = 'assets'
target = 'assets'
[[module.mounts]]
source = '../../node_modules/bootstrap'
target = 'assets/vendor/bootstrap'
`
b := hugolib.Test(t, files)
b.AssertFileExists("public/index.html", true)
b.AssertFileExists("public/vendor/bootstrap/dist/css/bootstrap.css", true) // fails
}In the above, the package.json file is present to illustrate the use case; it is not used by integration test.
marshalc, irkode and CatMe0w