Ensure redirect_from prefix (baseurl/github.url) is NOT outside site source about jekyll-redirect-from HOT 3 CLOSED

We also have to ensure that we strip the host from site.github.url when we write the file, if it impacts it.

from jekyll-redirect-from.

I'm not really convinced this is a security concern right now. The redirect target URL is only injected in the HTML / meta tag and has no effect on the server (the only other place where it's used is File.join in redirector.rb#L53 and that should be safe from what I can glance from the Ruby docs).

We also have to ensure that we strip the host from site.github.url when we write the file, if it impacts it.

The prefix doesn't impact the file name, only the redirect_from value does and that is passed to permalink which I suppose already sanitizes input.

from jekyll-redirect-from.

You're right – that's because baseurl doesn't write to a subfolder. It writes like before but requires this extra bit of magic to ensure the redirect page's HTML redirects to the proper URL with baseurl included.

Thanks!

from jekyll-redirect-from.