Hugo Data Input Validation Security

support
1

What methods does Hugo employ to validate the data it is processing ( if any )?

I would like to understand and be able to articulate to others, the security implications and user/website developer responsibilities of employing Hugo SSG.

Whether it be a snippit of js code, some markup, shortcode or an entire theme, what are the best practices and concerns which must be taken into account? Could for instance malicious code be processed by Hugo and transferred into a production site? Could code run via Hugo to infect the developer environment possibly thru go code injection?

Thanks for any comments or links!

2

This is a big topic, and I don’t understand some of your sub questions. But in general:

For HTML output (which I guess is what we’re talking about here), this is the core security model:

https://golang.org/pkg/html/template/#hdr-Security_Model

In short:

  • Templates authors (you) are trusted, the data you send in is not.
  • This is why you sometimes need to use the safeHTML function to avoid escaping of data you know is safe.
  • There is one exception to the above (as noted in the documentation): If you enable inline shortcodes you also say that the shortcodes and data handling in content files are trusted, as those macros are treated as pure text.

It may be worth adding that Hugo is a static site generator with no concept of dynamic user input.

2 Likes
3

This is useful. Thank You.

I am envisioning a scenario where multiple content providers would submit material for the site. The material would conceivably be any format Hugo accepts and may be from machine generated 3rd party’s.

I am wondering how I should ensure the content was safe for each build and what role I can expect Hugo to play.