silva
/
new_site
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fixed security issue with download 3rd party plugin (#2365) 

Added condition to avoid security issue according to GitHub's dependabot


![image](https://github.com/alshedivat/al-folio/assets/31376482/b470a83a-5038-48be-99a6-1cbf63de57bf)

---------

Signed-off-by: George Araujo <george.gcac@gmail.com>
This commit is contained in:
George 2024-04-23 11:29:15 -03:00 committed by GitHub
parent b315315f9b
commit 06ca08cbaf
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 16 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
_plugins/download-3rd-party.rb
View File

@ -7,6 +7,11 @@ Jekyll::Hooks.register :site, :after_init do |site|
require 'uri' require 'uri'
def download_file(url, dest) def download_file(url, dest)
# only try to download the file if url doesn't start with | for security reasons
if url.start_with?('|')
return
end
# create the directory if it doesn't exist # create the directory if it doesn't exist
dir = File.dirname(dest) dir = File.dirname(dest)
unless File.directory?(dir) unless File.directory?(dir)
@ -30,11 +35,16 @@ Jekyll::Hooks.register :site, :after_init do |site|
end end
def download_fonts(url, dest) def download_fonts(url, dest)
# only try to download the file if url doesn't start with | for security reasons
if url.start_with?('|')
return
end
# only download fonts if the directory doesn't exist or is empty # only download fonts if the directory doesn't exist or is empty
unless File.directory?(dest) && !Dir.empty?(dest) unless File.directory?(dest) && !Dir.empty?(dest)
puts "Downloading fonts from #{url} to #{dest}" puts "Downloading fonts from #{url} to #{dest}"
# get available fonts from the url # get available fonts from the url
doc = Nokogiri::HTML(URI().open(url, "User-Agent" => "Ruby/#{RUBY_VERSION}")) doc = Nokogiri::HTML(URI.open(url, "User-Agent" => "Ruby/#{RUBY_VERSION}"))
doc.css('a').each do |link| doc.css('a').each do |link|
# get the file name from the url # get the file name from the url
file_name = link['href'].split('/').last.split('?').first file_name = link['href'].split('/').last.split('?').first
@ -49,6 +59,11 @@ Jekyll::Hooks.register :site, :after_init do |site|
end end
def download_fonts_from_css(config, url, dest) def download_fonts_from_css(config, url, dest)
# only try to download the file if url doesn't start with | for security reasons
if url.start_with?('|')
return
end
# get the file name from the url # get the file name from the url
file_name = url.split('/').last.split('?').first file_name = url.split('/').last.split('?').first