From a8e0ca9254666354f3e62a65c76050f278893ce6 Mon Sep 17 00:00:00 2001
From: =?utf8?q?Bj=C3=B8rn=20Erik=20Pedersen?=
 <bjorn.erik.pedersen@gmail.com>
Date: Sun, 19 Oct 2025 11:50:46 +0200
Subject: [PATCH] hugofs: Make sure that non-project module mounts are local
 paths

Fixes #14069
---
 hugofs/hugofs_integration_test.go | 46 +++++++++++++++++++++++++++++++
 modules/collect.go                |  5 +++-
 2 files changed, 50 insertions(+), 1 deletion(-)
 create mode 100644 hugofs/hugofs_integration_test.go

diff --git a/hugofs/hugofs_integration_test.go b/hugofs/hugofs_integration_test.go
new file mode 100644
index 000000000..1be1384f0
--- /dev/null
+++ b/hugofs/hugofs_integration_test.go
@@ -0,0 +1,46 @@
+// Copyright 2025 The Hugo Authors. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package hugofs_test
+
+import (
+	"testing"
+
+	qt "github.com/frankban/quicktest"
+
+	"github.com/gohugoio/hugo/hugolib"
+)
+
+func TestMountRestrictTheme(t *testing.T) {
+	files := `
+-- hugo.toml --
+disableKinds = ["taxonomy", "term", "rss"]
+theme = "mytheme"
+[[module.mounts]]
+source = '../file2.txt'
+target = 'assets/file2.txt'
+-- themes/mytheme/hugo.toml --
+[[module.mounts]]
+source = '../../file1.txt'
+target = 'assets/file1.txt'
+-- file1.txt --
+file1
+-- file2.txt --
+file2
+-- layouts/all.html --
+All.
+`
+	b, err := hugolib.TestE(t, files)
+	b.Assert(err, qt.IsNotNil)
+	b.Assert(err.Error(), qt.Contains, "mount source must be a local path for modules/themes")
+}
diff --git a/modules/collect.go b/modules/collect.go
index 6ff37aa63..5f3a39e02 100644
--- a/modules/collect.go
+++ b/modules/collect.go
@@ -710,7 +710,10 @@ func (c *collector) normalizeMounts(owner *moduleAdapter, mounts []Mount) ([]Mou
 		mnt.Target = filepath.Clean(mnt.Target)
 		var sourceDir string
 
-		if owner.projectMod && filepath.IsAbs(mnt.Source) {
+		if !owner.projectMod && !filepath.IsLocal(mnt.Source) {
+			return nil, fmt.Errorf("%s: %q: mount source must be a local path for modules/themes", errMsg, mnt.Source)
+		}
+		if filepath.IsAbs(mnt.Source) {
 			// Abs paths in the main project is allowed.
 			sourceDir = mnt.Source
 		} else {
-- 
2.39.5