hugofs: Make sure that non-project module mounts are local paths

Fixes #14069

diff --git a/hugofs/hugofs_integration_test.go b/hugofs/hugofs_integration_test.go
new file mode 100644 (file)
index 0000000..1be1384
--- /dev/null
+++ b/hugofs/hugofs_integration_test.go
@@ -0,0 +1,46 @@
+// Copyright 2025 The Hugo Authors. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package hugofs_test
+
+import (
+       "testing"
+
+       qt "github.com/frankban/quicktest"
+
+       "github.com/gohugoio/hugo/hugolib"
+)
+
+func TestMountRestrictTheme(t *testing.T) {
+       files := `
+-- hugo.toml --
+disableKinds = ["taxonomy", "term", "rss"]
+theme = "mytheme"
+[[module.mounts]]
+source = '../file2.txt'
+target = 'assets/file2.txt'
+-- themes/mytheme/hugo.toml --
+[[module.mounts]]
+source = '../../file1.txt'
+target = 'assets/file1.txt'
+-- file1.txt --
+file1
+-- file2.txt --
+file2
+-- layouts/all.html --
+All.
+`
+       b, err := hugolib.TestE(t, files)
+       b.Assert(err, qt.IsNotNil)
+       b.Assert(err.Error(), qt.Contains, "mount source must be a local path for modules/themes")
+}

diff --git a/modules/collect.go b/modules/collect.go
index 6ff37aa63a0fb7650619a2bd90e7a381cb6e28b0..5f3a39e02a8cea737c6f0d4ca1ac47940f288d81 100644 (file)
--- a/modules/collect.go
+++ b/modules/collect.go
@@ -710,7 +710,10 @@ func (c *collector) normalizeMounts(owner *moduleAdapter, mounts []Mount) ([]Mou
                mnt.Target = filepath.Clean(mnt.Target)
                var sourceDir string
 
-               if owner.projectMod && filepath.IsAbs(mnt.Source) {
+               if !owner.projectMod && !filepath.IsLocal(mnt.Source) {
+                       return nil, fmt.Errorf("%s: %q: mount source must be a local path for modules/themes", errMsg, mnt.Source)
+               }
+               if filepath.IsAbs(mnt.Source) {
                        // Abs paths in the main project is allowed.
                        sourceDir = mnt.Source
                } else {