Repository: getnikola/nikola

Issue:
reST file inclusion is a security hole
### Environment

**Python Version:** 3.7.3

**Nikola Version:** 8.0.2

**Operating System:** Any

### Description:

A number of reST directives allow for the inclusion of files in rendered output, namely [include](http://docutils.sourceforge.net/docs/ref/rst/directives.html#including-an-external-document-fragment), [raw](http://docutils.sourceforge.net/docs/ref/rst/directives.html#raw-data-pass-through), and [CSV Table](http://docutils.sourceforge.net/docs/ref/rst/directives.html#id4), which can potentially expose secret file contents.

Consider a site manage with CI for build and deploy:
* The site is managed by Person A who has permission to do whatever
* Deployment keys are kept in a repo root file named `secrets.json`
* The `master` branch is always built and deployed to `www.example.com`
* Any other branch is built and deployed to `${branchname}.ci-test.example.com`
* Person B is an author for the site with commit privileges but no permission to see the CI deploy keys
* Person B creates a post with the contents:

  ```rest
  Testing a leak
  ==============

  :slug: testing-a-leak
  :date: 2019-10-29 06:55:31+00:00
  :type: text

  Write your post here.

  .. include:: secrets.json
  ```

  and adds it to their branch `i-can-haz-yur-creds`
* Person B pushes their branch
* Person B goes to `i-can-haz-yur-creds.ci-test.example.com/blog/2019/10/29/testing-a-leak.html` and can see the credentials clear as day.

The solution according to docutils is to set [file_insertion_enabled](http://docutils.sourceforge.net/docs/user/config.html#file-insertion-enabled) to false (default is true).


Discussion:
More concretely, I am looking to use something like staticman to handle comments but don't want anyone extracting secrets by cleverly constructing a comment.
This clearly needs a possibility to configure this. I'm relying on this functionality for one of my blogs (allows to include some common ReST definitions everywhere), but in general this is a dangerous feature.
There are also some other places where someone with access could potentially exfiltrate data, for example with `.. template:` or `.. listning::`. Making it possible to work around it would be a good idea.

But to implement comments, you should (a) not allow strangers to just build your site, because that way you will end up with spam, `<script>` and other nefarious stuff, (b) create a minimalistic compiler for your comments, that understands only basic syntax like `**bold**`, newlines, and URLs, that always filters out `<` and `>` as `&lt;` and `&gt;` and that does not interpret shortcodes, so that users can’t type bad stuff in comments.
Nikola is not meant for processing 3rd party content.

Patches welcome to harden the obvious bits, but defaults can't change, and
I expect it's probably not possible to make it meaningfully secure in that
sense.

On Tue, Oct 29, 2019 at 6:34 AM Chris Warrick <notifications@github.com>
wrote:

> There are also some other places where someone with access could
> potentially exfiltrate data, for example with .. template: or ..
> listning::. Making it possible to work around it would be a good idea.
>
> But to implement comments, you should (a) not allow strangers to just
> build your site, because that way you will end up with spam, <script> and
> other nefarious stuff, (b) create a minimalistic compiler for your
> comments, that understands only basic syntax like **bold**, newlines, and
> URLs, that always filters out < and > as &lt; and &gt; and that does not
> interpret shortcodes, so that users can’t type bad stuff in comments.
>
> —
> You are receiving this because you are subscribed to this thread.
> Reply to this email directly, view it on GitHub
> <https://github.com/getnikola/nikola/issues/3311?email_source=notifications&email_token=AAAAMK2WVUQFHHMO43BR25TQQ77SFA5CNFSM4JGEQJJKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOECP2QJI#issuecomment-547334181>,
> or unsubscribe
> <https://github.com/notifications/unsubscribe-auth/AAAAMK25UI5SIPZQXGALURLQQ77SFANCNFSM4JGEQJJA>
> .
>


Resolving patch:
diff --git a/nikola/nikola.py b/nikola/nikola.py
--- a/nikola/nikola.py
+++ b/nikola/nikola.py
@@ -561,6 +561,7 @@ def __init__(self, **config):
             'GITHUB_REMOTE_NAME': 'origin',
             'GITHUB_COMMIT_SOURCE': False,  # WARNING: conf.py.in overrides this with True for backwards compatibility
             'META_GENERATOR_TAG': True,
+            'REST_FILE_INSERTION_ENABLED': True,
         }
 
         # set global_context for template rendering
diff --git a/nikola/plugins/compile/rest/__init__.py b/nikola/plugins/compile/rest/__init__.py
--- a/nikola/plugins/compile/rest/__init__.py
+++ b/nikola/plugins/compile/rest/__init__.py
@@ -126,6 +126,7 @@ def compile_string(self, data, source_path=None, is_two_file=True, post=None, la
             'template': default_template_path,
             'language_code': LEGAL_VALUES['DOCUTILS_LOCALES'].get(LocaleBorg().current_lang, 'en'),
             'doctitle_xform': self.site.config.get('USE_REST_DOCINFO_METADATA'),
+            'file_insertion_enabled': self.site.config.get('REST_FILE_INSERTION_ENABLED'),
         }
 
         from nikola import shortcodes as sc


Test patch: