Directory traversal vulnerability

[Dreamsorcerer]

I can't find any information about security reporting, so I'll just put this here.
It appears that this project may have copied some code from aiohttp, which we've recently discovered is vulnerable to a directory traversal attack:
GHSA-5h86-8mv2-jq9f

The similar-looking code is at:

nikola/nikola/plugins/command/auto/__init__.py

Line 543 in 2f5cf49

if not self._follow_symlinks:

Please verify if your code is vulnerable and fix if appropriate. The patch we used for aiohttp is https://github.com/aio-libs/aiohttp/pull/8079/files

[Kwpolska]

Thanks for the report. We don’t have a formal security reporting workflow, because Nikola is expected to be run on personal machines, and the nikola auto server should never be exposed to the public Internet. Feel free to take a look at PR #3756.