{"action":"created","comment":{"url":"https://api.github.com/repos/jekyll/jekyll-sass-converter/pulls/comments/76627159","id":76627159,"diff_hunk":"@@ -75,11 +75,28 @@ def sass_dir_relative_to_site_source\n       end\n \n       def sass_load_paths\n+        paths = user_sass_load_paths + [sass_dir_relative_to_site_source]\n+\n         if safe?\n-          [sass_dir_relative_to_site_source]\n-        else\n-          (user_sass_load_paths + [sass_dir_relative_to_site_source]).uniq\n-        end.select { |load_path| File.directory?(load_path) }\n+          # Sanitize paths to prevent any attack vectors (.e.g. `/**/*`)\n+          paths.map! { |path| Jekyll.sanitized_path(@config[\"source\"], path) }\n+        end\n+\n+        # Expand file globs (e.g. `node_modules/*/node_modules` )\n+        Dir.chdir(@config[\"source\"]) do","path":"lib/jekyll/converters/scss.rb","position":16,"original_position":16,"commit_id":"b693eb16b4dd3db251b91cc0888e0c2db715875e","original_commit_id":"b693eb16b4dd3db251b91cc0888e0c2db715875e","user":{"login":"benbalter","id":282759,"avatar_url":"https://avatars.githubusercontent.com/u/282759?v=3","gravatar_id":"","url":"https://api.github.com/users/benbalter","html_url":"https://github.com/benbalter","followers_url":"https://api.github.com/users/benbalter/followers","following_url":"https://api.github.com/users/benbalter/following{/other_user}","gists_url":"https://api.github.com/users/benbalter/gists{/gist_id}","starred_url":"https://api.github.com/users/benbalter/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/benbalter/subscriptions","organizations_url":"https://api.github.com/users/benbalter/orgs","repos_url":"https://api.github.com/users/benbalter/repos","events_url":"https://api.github.com/users/benbalter/events{/privacy}","received_events_url":"https://api.github.com/users/benbalter/received_events","type":"User","site_admin":true},"body":"This should likely be sanitized, no? Same rationale as above.","created_at":"2016-08-29T15:25:47Z","updated_at":"2016-08-29T15:25:47Z","html_url":"https://github.com/jekyll/jekyll-sass-converter/pull/50#discussion_r76627159","pull_request_url":"https://api.github.com/repos/jekyll/jekyll-sass-converter/pulls/50","_links":{"self":{"href":"https://api.github.com/repos/jekyll/jekyll-sass-converter/pulls/comments/76627159"},"html":{"href":"https://github.com/jekyll/jekyll-sass-converter/pull/50#discussion_r76627159"},"pull_request":{"href":"https://api.github.com/repos/jekyll/jekyll-sass-converter/pulls/50"}}},"pull_request":{"url":"https://api.github.com/repos/jekyll/jekyll-sass-converter/pulls/50","id":76877562,"html_url":"https://github.com/jekyll/jekyll-sass-converter/pull/50","diff_url":"https://github.com/jekyll/jekyll-sass-converter/pull/50.diff","patch_url":"https://github.com/jekyll/jekyll-sass-converter/pull/50.patch","issue_url":"https://api.github.com/repos/jekyll/jekyll-sass-converter/issues/50","number":50,"state":"open","locked":false,"title":"Allow load_paths in safe mode with sanitization","user":{"login":"bkeepers","id":173,"avatar_url":"https://avatars.githubusercontent.com/u/173?v=3","gravatar_id":"","url":"https://api.github.com/users/bkeepers","html_url":"https://github.com/bkeepers","followers_url":"https://api.github.com/users/bkeepers/followers","following_url":"https://api.github.com/users/bkeepers/following{/other_user}","gists_url":"https://api.github.com/users/bkeepers/gists{/gist_id}","starred_url":"https://api.github.com/users/bkeepers/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bkeepers/subscriptions","organizations_url":"https://api.github.com/users/bkeepers/orgs","repos_url":"https://api.github.com/users/bkeepers/repos","events_url":"https://api.github.com/users/bkeepers/events{/privacy}","received_events_url":"https://api.github.com/users/bkeepers/received_events","type":"User","site_admin":true},"body":"`load_paths` is currently only supported in safe mode. This enables it all the time, but sanitizes the paths with `Jekyll.sanitized_path` in safe mode to ensure all paths are relative to the source directory. This also adds support for globbing (e.g. `**/*/node_modules` to add node modules and all transient dependencies to the load path).\r\n\r\nHaving multiple paths in the sass load path is really helpful when using package managers like bower or NPM. For example:\r\n\r\n```yaml\r\nsass:\r\n  load_paths:\r\n  - bower_components\r\n  - **/*/node_modules\r\n```\r\n\r\nThe motivation for this change is so I can use the latest version of [primer](https://github.com/primer/primer) on a jekyll site.\r\n\r\n/cc @jonrohan","created_at":"2016-07-10T16:35:09Z","updated_at":"2016-08-29T15:25:47Z","closed_at":null,"merged_at":null,"merge_commit_sha":"ffff9d9f574235f95e84e8903d2285cc6b102a16","assignee":null,"assignees":[],"milestone":null,"commits_url":"https://api.github.com/repos/jekyll/jekyll-sass-converter/pulls/50/commits","review_comments_url":"https://api.github.com/repos/jekyll/jekyll-sass-converter/pulls/50/comments","review_comment_url":"https://api.github.com/repos/jekyll/jekyll-sass-converter/pulls/comments{/number}","comments_url":"https://api.github.com/repos/jekyll/jekyll-sass-converter/issues/50/comments","statuses_url":"https://api.github.com/repos/jekyll/jekyll-sass-converter/statuses/b693eb16b4dd3db251b91cc0888e0c2db715875e","head":{"label":"bkeepers:safe-load-paths","ref":"safe-load-paths","sha":"b693eb16b4dd3db251b91cc0888e0c2db715875e","user":{"login":"bkeepers","id":173,"avatar_url":"https://avatars.githubusercontent.com/u/173?v=3","gravatar_id":"","url":"https://api.github.com/users/bkeepers","html_url":"https://github.com/bkeepers","followers_url":"https://api.github.com/users/bkeepers/followers","following_url":"https://api.github.com/users/bkeepers/following{/other_user}","gists_url":"https://api.github.com/users/bkeepers/gists{/gist_id}","starred_url":"https://api.github.com/users/bkeepers/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bkeepers/subscriptions","organizations_url":"https://api.github.com/users/bkeepers/orgs","repos_url":"https://api.github.com/users/bkeepers/repos","events_url":"https://api.github.com/users/bkeepers/events{/privacy}","received_events_url":"https://api.github.com/users/bkeepers/received_events","type":"User","site_admin":true},"repo":{"id":63007821,"name":"jekyll-sass-converter","full_name":"bkeepers/jekyll-sass-converter","owner":{"login":"bkeepers","id":173,"avatar_url":"https://avatars.githubusercontent.com/u/173?v=3","gravatar_id":"","url":"https://api.github.com/users/bkeepers","html_url":"https://github.com/bkeepers","followers_url":"https://api.github.com/users/bkeepers/followers","following_url":"https://api.github.com/users/bkeepers/following{/other_user}","gists_url":"https://api.github.com/users/bkeepers/gists{/gist_id}","starred_url":"https://api.github.com/users/bkeepers/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bkeepers/subscriptions","organizations_url":"https://api.github.com/users/bkeepers/orgs","repos_url":"https://api.github.com/users/bkeepers/repos","events_url":"https://api.github.com/users/bkeepers/events{/privacy}","received_events_url":"https://api.github.com/users/bkeepers/received_events","type":"User","site_admin":true},"private":false,"html_url":"https://github.com/bkeepers/jekyll-sass-converter","description":"A Sass converter for Jekyll.","fork":true,"url":"https://api.github.com/repos/bkeepers/jekyll-sass-converter","forks_url":"https://api.github.com/repos/bkeepers/jekyll-sass-converter/forks","keys_url":"https://api.github.com/repos/bkeepers/jekyll-sass-converter/keys{/key_id}","collaborators_url":"https://api.github.com/repos/bkeepers/jekyll-sass-converter/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/bkeepers/jekyll-sass-converter/teams","hooks_url":"https://api.github.com/repos/bkeepers/jekyll-sass-converter/hooks","issue_events_url":"https://api.github.com/repos/bkeepers/jekyll-sass-converter/issues/events{/number}","events_url":"https://api.github.com/repos/bkeepers/jekyll-sass-converter/events","assignees_url":"https://api.github.com/repos/bkeepers/jekyll-sass-converter/assignees{/user}","branches_url":"https://api.github.com/repos/bkeepers/jekyll-sass-converter/branches{/branch}","tags_url":"https://api.github.com/repos/bkeepers/jekyll-sass-converter/tags","blobs_url":"https://api.github.com/repos/bkeepers/jekyll-sass-converter/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/bkeepers/jekyll-sass-converter/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/bkeepers/jekyll-sass-converter/git/refs{/sha}","trees_url":"https://api.github.com/repos/bkeepers/jekyll-sass-converter/git/trees{/sha}","statuses_url":"https://api.github.com/repos/bkeepers/jekyll-sass-converter/statuses/{sha}","languages_url":"https://api.github.com/repos/bkeepers/jekyll-sass-converter/languages","stargazers_url":"https://api.github.com/repos/bkeepers/jekyll-sass-converter/stargazers","contributors_url":"https://api.github.com/repos/bkeepers/jekyll-sass-converter/contributors","subscribers_url":"https://api.github.com/repos/bkeepers/jekyll-sass-converter/subscribers","subscription_url":"https://api.github.com/repos/bkeepers/jekyll-sass-converter/subscription","commits_url":"https://api.github.com/repos/bkeepers/jekyll-sass-converter/commits{/sha}","git_commits_url":"https://api.github.com/repos/bkeepers/jekyll-sass-converter/git/commits{/sha}","comments_url":"https://api.github.com/repos/bkeepers/jekyll-sass-converter/comments{/number}","issue_comment_url":"https://api.github.com/repos/bkeepers/jekyll-sass-converter/issues/comments{/number}","contents_url":"https://api.github.com/repos/bkeepers/jekyll-sass-converter/contents/{+path}","compare_url":"https://api.github.com/repos/bkeepers/jekyll-sass-converter/compare/{base}...{head}","merges_url":"https://api.github.com/repos/bkeepers/jekyll-sass-converter/merges","archive_url":"https://api.github.com/repos/bkeepers/jekyll-sass-converter/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/bkeepers/jekyll-sass-converter/downloads","issues_url":"https://api.github.com/repos/bkeepers/jekyll-sass-converter/issues{/number}","pulls_url":"https://api.github.com/repos/bkeepers/jekyll-sass-converter/pulls{/number}","milestones_url":"https://api.github.com/repos/bkeepers/jekyll-sass-converter/milestones{/number}","notifications_url":"https://api.github.com/repos/bkeepers/jekyll-sass-converter/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/bkeepers/jekyll-sass-converter/labels{/name}","releases_url":"https://api.github.com/repos/bkeepers/jekyll-sass-converter/releases{/id}","deployments_url":"https://api.github.com/repos/bkeepers/jekyll-sass-converter/deployments","created_at":"2016-07-10T16:26:20Z","updated_at":"2016-07-10T16:26:21Z","pushed_at":"2016-08-28T20:13:40Z","git_url":"git://github.com/bkeepers/jekyll-sass-converter.git","ssh_url":"git@github.com:bkeepers/jekyll-sass-converter.git","clone_url":"https://github.com/bkeepers/jekyll-sass-converter.git","svn_url":"https://github.com/bkeepers/jekyll-sass-converter","homepage":"http://rubygems.org/gems/jekyll-sass-converter","size":88,"stargazers_count":0,"watchers_count":0,"language":"Ruby","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"jekyll:master","ref":"master","sha":"97cf74f8afbb32a627bbe96cfbc61556514eee4e","user":{"login":"jekyll","id":3083652,"avatar_url":"https://avatars.githubusercontent.com/u/3083652?v=3","gravatar_id":"","url":"https://api.github.com/users/jekyll","html_url":"https://github.com/jekyll","followers_url":"https://api.github.com/users/jekyll/followers","following_url":"https://api.github.com/users/jekyll/following{/other_user}","gists_url":"https://api.github.com/users/jekyll/gists{/gist_id}","starred_url":"https://api.github.com/users/jekyll/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jekyll/subscriptions","organizations_url":"https://api.github.com/users/jekyll/orgs","repos_url":"https://api.github.com/users/jekyll/repos","events_url":"https://api.github.com/users/jekyll/events{/privacy}","received_events_url":"https://api.github.com/users/jekyll/received_events","type":"Organization","site_admin":false},"repo":{"id":16243570,"name":"jekyll-sass-converter","full_name":"jekyll/jekyll-sass-converter","owner":{"login":"jekyll","id":3083652,"avatar_url":"https://avatars.githubusercontent.com/u/3083652?v=3","gravatar_id":"","url":"https://api.github.com/users/jekyll","html_url":"https://github.com/jekyll","followers_url":"https://api.github.com/users/jekyll/followers","following_url":"https://api.github.com/users/jekyll/following{/other_user}","gists_url":"https://api.github.com/users/jekyll/gists{/gist_id}","starred_url":"https://api.github.com/users/jekyll/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jekyll/subscriptions","organizations_url":"https://api.github.com/users/jekyll/orgs","repos_url":"https://api.github.com/users/jekyll/repos","events_url":"https://api.github.com/users/jekyll/events{/privacy}","received_events_url":"https://api.github.com/users/jekyll/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/jekyll/jekyll-sass-converter","description":"A Sass converter for Jekyll.","fork":false,"url":"https://api.github.com/repos/jekyll/jekyll-sass-converter","forks_url":"https://api.github.com/repos/jekyll/jekyll-sass-converter/forks","keys_url":"https://api.github.com/repos/jekyll/jekyll-sass-converter/keys{/key_id}","collaborators_url":"https://api.github.com/repos/jekyll/jekyll-sass-converter/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/jekyll/jekyll-sass-converter/teams","hooks_url":"https://api.github.com/repos/jekyll/jekyll-sass-converter/hooks","issue_events_url":"https://api.github.com/repos/jekyll/jekyll-sass-converter/issues/events{/number}","events_url":"https://api.github.com/repos/jekyll/jekyll-sass-converter/events","assignees_url":"https://api.github.com/repos/jekyll/jekyll-sass-converter/assignees{/user}","branches_url":"https://api.github.com/repos/jekyll/jekyll-sass-converter/branches{/branch}","tags_url":"https://api.github.com/repos/jekyll/jekyll-sass-converter/tags","blobs_url":"https://api.github.com/repos/jekyll/jekyll-sass-converter/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/jekyll/jekyll-sass-converter/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/jekyll/jekyll-sass-converter/git/refs{/sha}","trees_url":"https://api.github.com/repos/jekyll/jekyll-sass-converter/git/trees{/sha}","statuses_url":"https://api.github.com/repos/jekyll/jekyll-sass-converter/statuses/{sha}","languages_url":"https://api.github.com/repos/jekyll/jekyll-sass-converter/languages","stargazers_url":"https://api.github.com/repos/jekyll/jekyll-sass-converter/stargazers","contributors_url":"https://api.github.com/repos/jekyll/jekyll-sass-converter/contributors","subscribers_url":"https://api.github.com/repos/jekyll/jekyll-sass-converter/subscribers","subscription_url":"https://api.github.com/repos/jekyll/jekyll-sass-converter/subscription","commits_url":"https://api.github.com/repos/jekyll/jekyll-sass-converter/commits{/sha}","git_commits_url":"https://api.github.com/repos/jekyll/jekyll-sass-converter/git/commits{/sha}","comments_url":"https://api.github.com/repos/jekyll/jekyll-sass-converter/comments{/number}","issue_comment_url":"https://api.github.com/repos/jekyll/jekyll-sass-converter/issues/comments{/number}","contents_url":"https://api.github.com/repos/jekyll/jekyll-sass-converter/contents/{+path}","compare_url":"https://api.github.com/repos/jekyll/jekyll-sass-converter/compare/{base}...{head}","merges_url":"https://api.github.com/repos/jekyll/jekyll-sass-converter/merges","archive_url":"https://api.github.com/repos/jekyll/jekyll-sass-converter/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/jekyll/jekyll-sass-converter/downloads","issues_url":"https://api.github.com/repos/jekyll/jekyll-sass-converter/issues{/number}","pulls_url":"https://api.github.com/repos/jekyll/jekyll-sass-converter/pulls{/number}","milestones_url":"https://api.github.com/repos/jekyll/jekyll-sass-converter/milestones{/number}","notifications_url":"https://api.github.com/repos/jekyll/jekyll-sass-converter/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/jekyll/jekyll-sass-converter/labels{/name}","releases_url":"https://api.github.com/repos/jekyll/jekyll-sass-converter/releases{/id}","deployments_url":"https://api.github.com/repos/jekyll/jekyll-sass-converter/deployments","created_at":"2014-01-26T00:42:50Z","updated_at":"2016-08-29T11:45:13Z","pushed_at":"2016-08-28T20:13:41Z","git_url":"git://github.com/jekyll/jekyll-sass-converter.git","ssh_url":"git@github.com:jekyll/jekyll-sass-converter.git","clone_url":"https://github.com/jekyll/jekyll-sass-converter.git","svn_url":"https://github.com/jekyll/jekyll-sass-converter","homepage":"http://rubygems.org/gems/jekyll-sass-converter","size":100,"stargazers_count":50,"watchers_count":50,"language":"Ruby","has_issues":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":49,"mirror_url":null,"open_issues_count":5,"forks":49,"open_issues":5,"watchers":50,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/jekyll/jekyll-sass-converter/pulls/50"},"html":{"href":"https://github.com/jekyll/jekyll-sass-converter/pull/50"},"issue":{"href":"https://api.github.com/repos/jekyll/jekyll-sass-converter/issues/50"},"comments":{"href":"https://api.github.com/repos/jekyll/jekyll-sass-converter/issues/50/comments"},"review_comments":{"href":"https://api.github.com/repos/jekyll/jekyll-sass-converter/pulls/50/comments"},"review_comment":{"href":"https://api.github.com/repos/jekyll/jekyll-sass-converter/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/jekyll/jekyll-sass-converter/pulls/50/commits"},"statuses":{"href":"https://api.github.com/repos/jekyll/jekyll-sass-converter/statuses/b693eb16b4dd3db251b91cc0888e0c2db715875e"}}}}
{"actor":{"display_login":"benbalter"}}