config/security: Add O\w+ (e.g. GOROOT) to the default allowed list

Fixes #10429

diff --git a/config/security/securityConfig.go b/config/security/securityConfig.go
index 979c40125c3f784caebace7d7707fd3d0d4daa38..4b0e0708606408c4ddf353938c3e35d65ea09523 100644 (file)
--- a/config/security/securityConfig.go
+++ b/config/security/securityConfig.go
@@ -42,7 +42,7 @@ var DefaultConfig = Config{
                ),
                // These have been tested to work with Hugo's external programs
                // on Windows, Linux and MacOS.
-               OsEnv: NewWhitelist("(?i)^((HTTPS?|NO)_PROXY|PATH(EXT)?|APPDATA|TE?MP|TERM)$"),
+               OsEnv: NewWhitelist(`(?i)^((HTTPS?|NO)_PROXY|PATH(EXT)?|APPDATA|TE?MP|TERM|GO\w+)$`),
        },
        Funcs: Funcs{
                Getenv: NewWhitelist("^HUGO_", "^CI$"),

diff --git a/config/security/securityConfig_test.go b/config/security/securityConfig_test.go
index c34af9efa342468cfb8d18c8c7a88d4c7b5a6ee7..55409e318bf43983522484412486d81ffd10bab7 100644 (file)
--- a/config/security/securityConfig_test.go
+++ b/config/security/securityConfig_test.go
@@ -140,7 +140,7 @@ func TestToTOML(t *testing.T) {
        got := DefaultConfig.ToTOML()
 
        c.Assert(got, qt.Equals,
-               "[security]\n  enableInlineShortcodes = false\n\n  [security.exec]\n    allow = ['^dart-sass-embedded$', '^go$', '^npx$', '^postcss$']\n    osEnv = ['(?i)^((HTTPS?|NO)_PROXY|PATH(EXT)?|APPDATA|TE?MP|TERM)$']\n\n  [security.funcs]\n    getenv = ['^HUGO_', '^CI$']\n\n  [security.http]\n    methods = ['(?i)GET|POST']\n    urls = ['.*']",
+               "[security]\n  enableInlineShortcodes = false\n\n  [security.exec]\n    allow = ['^dart-sass-embedded$', '^go$', '^npx$', '^postcss$']\n    osEnv = ['(?i)^((HTTPS?|NO)_PROXY|PATH(EXT)?|APPDATA|TE?MP|TERM|GO\\w+)$']\n\n  [security.funcs]\n    getenv = ['^HUGO_', '^CI$']\n\n  [security.http]\n    methods = ['(?i)GET|POST']\n    urls = ['.*']",
        )
 }
 
@@ -163,4 +163,8 @@ func TestDecodeConfigDefault(t *testing.T) {
        c.Assert(pc.HTTP.Methods.Accept("GET"), qt.IsTrue)
        c.Assert(pc.HTTP.Methods.Accept("get"), qt.IsTrue)
        c.Assert(pc.HTTP.Methods.Accept("DELETE"), qt.IsFalse)
+
+       c.Assert(pc.Exec.OsEnv.Accept("PATH"), qt.IsTrue)
+       c.Assert(pc.Exec.OsEnv.Accept("GOROOT"), qt.IsTrue)
+       c.Assert(pc.Exec.OsEnv.Accept("MYSECRET"), qt.IsFalse)
 }