Launching editor upon content creation with v0.90.0 and later

tips & tricks
1

There are two methods to launch an editor upon content creation:

  1. Use the --editor command line flag. Example:

    hugo new --editor gedit content/en/post/foo.md

  2. Set newContentEditor in site configuration. Example:

    newContentEditor = 'gedit'

Regardless of method, additional site configuration is required due to the enhanced security measures implemented in Hugo v0.90.0.

security.exec.allow

First, you must must add the editor to security.exec.allow. If you forget to do this, Hugo will throw a descriptive error with instructions to address the problem.

For example, to use the gedit editor:

[security.exec]
allow = ['^dart-sass-embedded$', '^go$', '^npx$', '^postcss$', '^gedit$']

security.exec.osEnv

Second, you may have to add one or more operating system environment variables to security.exec.osEnv. This will depend on your operating system, the editor that you have specified, and potentially several other factors such as how the editor was installed, or even how Hugo was installed.

For example, with gedit on Ubuntu, I had to add DISPLAY:

[security.exec]
osEnv = ['(?i)^(PATH|PATHEXT|APPDATA|TMP|TEMP|TERM|DISPLAY)$']

If the required environment variables are not included in security.exec.osEnv, the editor will not launch. In some cases the failure will be silent, while in others the editor may throw an error. It can take some effort, including trial and error, to determine which environment variable(s) must be added to security.exec.osEnv for different scenarios.

Given the variations described above, I thought it would be useful to keep track of what has worked for others.

Editor Operating System Env Vars to Add to security.exec.osEnv
code Ubuntu 20.04 LTS DISPLAY
gedit Ubuntu 20.04 LTS DISPLAY
nano Ubuntu 20.04 LTS none required
subl Ubuntu 20.04 LTS DISPLAY|HOME
emacs Mac/Linux/OpenBSD LANG

I will try to keep this table updated to reflect comments on this topic.

5 Likes
2

I also had to add LANG to the environment to get Emacs to switch to the correct character encoding (Mac/Linux/OpenBSD). Otherwise, smart quotes and Japanese text were garbage.

2 Likes
4

It seems quite complicated just to launch an editor.
Is everybody concerned by the security issues Hugo v0.90.0 tries to adress?

  • If so, could Hugo add alone the allow and osEnv directive, knowing the editor name? Or without knowing the editor, could there be default directives that ensure any editor can be lauched?
  • If not, will there be an option to disable security overhead?
5

There is an issue about this on Github where a .* is the solution. I myself started more than once a thread about what exactly is this security model that requires me to understand what some arbitrary editor is using in regards to OS environmental value, but that deviated from the plan to get information :wink: So I think whitelisting everything is a solution. I will take full responsibility of my development station.

I’ll follow up a link to the allow-all solution if I find it.

Edit: Here is an explanation of what this security model tries to do: --editor option affected by security.exec.allow in 0.91.x · Issue #9315 · gohugoio/hugo · GitHub and here is the whitelist all thingy I wrote above: Downloading private modules not working with Hugo v0.91.0 or higher · Issue #9333 · gohugoio/hugo · GitHub