[{"data":1,"prerenderedAt":455},["ShallowReactive",2],{"content-en-\u002Fsyntax\u002Fpaths-and-security":3},{"id":4,"title":5,"body":6,"description":447,"extension":448,"meta":449,"navigation":450,"path":451,"seo":452,"stem":453,"__hash__":454},"content_en\u002Fsyntax\u002Fpaths-and-security.md","Paths and Security",{"type":7,"value":8,"toc":429},"minimark",[9,13,18,27,84,90,94,110,114,131,135,153,157,164,174,188,192,197,204,226,230,240,244,306,310,320,324,374,378],[10,11,5],"h1",{"id":12},"paths-and-security",[14,15,17],"h2",{"id":16},"doc_root-marker",".doc_root marker",[19,20,21,22,26],"p",{},"Place an empty file named ",[23,24,25],"code",{},".doc_root"," at your project root. The library walks up from the entry file to find it.",[28,29,30,47],"table",{},[31,32,33],"thead",{},[34,35,36,42],"tr",{},[37,38,39,40],"th",{},"With ",[23,41,25],{},[37,43,44,45],{},"Without ",[23,46,25],{},[48,49,50,62,74],"tbody",{},[34,51,52,59],{},[53,54,55,56],"td",{},"Reads restricted to ",[23,57,58],{},"rootDir",[53,60,61],{},"Relative paths only",[34,63,64,71],{},[53,65,66,67,70],{},"Root-relative paths allowed (",[23,68,69],{},"\u002Fpartials\u002Fx.md",")",[53,72,73],{},"Root-relative paths error",[34,75,76,81],{},[53,77,78,79],{},"Absolute paths allowed if resolved path stays inside ",[23,80,58],{},[53,82,83],{},"Absolute paths effectively error",[19,85,86,87,89],{},"Symlinks are followed on Node, but the resolved target must stay inside ",[23,88,58],{},".",[14,91,93],{"id":92},"relative-paths","Relative paths",[19,95,96,99,100,103,104,106,107,109],{},[23,97,98],{},".\u002F"," and ",[23,101,102],{},"..\u002F"," work. Without ",[23,105,25],{},", ",[23,108,102],{}," is not restricted — your loader and file layout are responsible for safety.",[14,111,113],{"id":112},"remote-paths-node","Remote paths (Node)",[19,115,116,119,120,99,123,126,127,130],{},[23,117,118],{},"https:\u002F\u002F…"," URLs are allowed for ",[23,121,122],{},"include",[23,124,125],{},"component"," on Node. The default ",[23,128,129],{},"createNodeLoader"," fetches them.",[14,132,134],{"id":133},"browser","Browser",[136,137,138,147],"ul",{},[139,140,141,142,146],"li",{},"Loader is ",[143,144,145],"strong",{},"required"," — the library does not fetch files",[139,148,149,150],{},"Cross-origin loading is ",[143,151,152],{},"not supported",[14,154,156],{"id":155},"underscore-partials","Underscore partials",[19,158,159,160,163],{},"Files or directories starting with ",[23,161,162],{},"_"," are excluded from SSG entry discovery (like Sass partials):",[165,166,171],"pre",{"className":167,"code":169,"language":170},[168],"language-text","content\u002F\n  index.md          ← build entry\n  _partials\u002F\n    header.md       ← not an entry, but includable\n","text",[23,172,169],{"__ignoreMap":173},"",[19,175,176,177,179,180,183,184,187],{},"Explicitly listing a ",[23,178,162],{}," path in ",[23,181,182],{},"build({ input })"," overrides the filter. Set ",[23,185,186],{},"includeUnderscoreEntries: true"," to include all matches.",[14,189,191],{"id":190},"expression-security","Expression security",[193,194,196],"h3",{"id":195},"forbidden-property-access","Forbidden property access",[19,198,199,200,203],{},"Accessing these keys throws ",[23,201,202],{},"forbidden_property_access",":",[136,205,206,211,216,221],{},[139,207,208],{},[23,209,210],{},"__proto__",[139,212,213],{},[23,214,215],{},"prototype",[139,217,218],{},[23,219,220],{},"constructor",[139,222,223],{},[23,224,225],{},"__defineGetter__",[193,227,229],{"id":228},"no-arbitrary-code","No arbitrary code",[19,231,232,233,106,236,239],{},"Expressions are parsed and evaluated against a whitelist — no ",[23,234,235],{},"eval",[23,237,238],{},"import",", or host JS execution.",[14,241,243],{"id":242},"xss-and-output","XSS and output",[28,245,246,256],{},[31,247,248],{},[34,249,250,253],{},[37,251,252],{},"Topic",[37,254,255],{},"Behavior",[48,257,258,269,282,298],{},[34,259,260,266],{},[53,261,262,265],{},[23,263,264],{},"{{ }}"," output",[53,267,268],{},"Not escaped — raw interpolation",[34,270,271,276],{},[53,272,273],{},[23,274,275],{},"{{{ }}}",[53,277,278,279,281],{},"Same as ",[23,280,264],{}," today",[34,283,284,287],{},[53,285,286],{},"Context sanitization",[53,288,289,290,293,294,297],{},"None — suspicious values trigger ",[23,291,292],{},"suspicious_context_value"," ",[143,295,296],{},"warnings"," only",[34,299,300,303],{},[53,301,302],{},"HTML safety",[53,304,305],{},"Responsibility of your MD→HTML pipeline",[193,307,309],{"id":308},"suspicious-context-patterns","Suspicious context patterns",[19,311,312,313,316,317,89],{},"Values containing script tags, event handlers, ",[23,314,315],{},"javascript:"," URLs, embed tags, or meta refresh may warn. The value is ",[143,318,319],{},"not modified",[14,321,323],{"id":322},"secrets","Secrets",[28,325,326,336],{},[31,327,328],{},[34,329,330,333],{},[37,331,332],{},"Do",[37,334,335],{},"Don't",[48,337,338,357],{},[34,339,340,354],{},[53,341,342,343,346,347,350,351],{},"Pass secrets via ",[23,344,345],{},"serverContext"," on ",[23,348,349],{},"renderServer"," \u002F ",[23,352,353],{},"build",[53,355,356],{},"Put secrets in front matter",[34,358,359,366],{},[53,360,361,362,365],{},"Use ",[23,363,364],{},"renderClient"," only with public data",[53,367,368,369,371,372],{},"Pass ",[23,370,345],{}," to ",[23,373,364],{},[14,375,377],{"id":376},"resource-limits","Resource limits",[28,379,380,389],{},[31,381,382],{},[34,383,384,387],{},[37,385,386],{},"Limit",[37,388,255],{},[48,390,391,399,413,421],{},[34,392,393,396],{},[53,394,395],{},"Front matter size",[53,397,398],{},"64 KB max — error",[34,400,401,410],{},[53,402,403,350,406,409],{},[23,404,405],{},"if",[23,407,408],{},"each"," nesting",[53,411,412],{},"20 levels — warning, block skipped",[34,414,415,418],{},[53,416,417],{},"Circular includes",[53,419,420],{},"Warning, reference skipped",[34,422,423,426],{},[53,424,425],{},"File expansion depth",[53,427,428],{},"No hard limit",{"title":173,"searchDepth":430,"depth":430,"links":431},2,[432,433,434,435,436,437,442,445,446],{"id":16,"depth":430,"text":17},{"id":92,"depth":430,"text":93},{"id":112,"depth":430,"text":113},{"id":133,"depth":430,"text":134},{"id":155,"depth":430,"text":156},{"id":190,"depth":430,"text":191,"children":438},[439,441],{"id":195,"depth":440,"text":196},3,{"id":228,"depth":440,"text":229},{"id":242,"depth":430,"text":243,"children":443},[444],{"id":308,"depth":440,"text":309},{"id":322,"depth":430,"text":323},{"id":376,"depth":430,"text":377},"Path resolution, partials, and security considerations for hyogen.md.","md",{},true,"\u002Fsyntax\u002Fpaths-and-security",{"title":5,"description":447},"syntax\u002Fpaths-and-security","ICRrbJ8-C8k046BJmWZB4O89hhzkb3KQ-UCMtFGmleU",1787223115035]