copy_logo_images: do not render dynamic Sphinx template content

src/pydata_sphinx_theme/__init__.py

@@ -1129,6 +1129,12 @@ def copy_logo_images(app: Sphinx, exception=None) -> None:
             continue
         if not (Path(app.srcdir) / path_image).exists():
             logger.warning(f"Path to {kind} image logo does not exist: {path_image}")
+        # Ensure templates cannot be passed for logo path to avoid security vulnerability
+        if path_image.lower().endswith("_t"):
+            raise ExtensionError(
+                f"The {kind} logo path '{path_image}' looks like a Sphinx template; "
+                "please provide a static logo image."
+            )
         copy_asset_file(path_image, staticdir)
 
 

tests/test_build.py

@@ -312,6 +312,20 @@ def test_logo_external_image(sphinx_build_factory):
     assert f'src="{test_url}"' in index_str
 
 
+def test_logo_template_rejected(sphinx_build_factory):
+    """Test that dynamic Sphinx templates are not accepted as logo files"""
+    # Test with a specified external logo image source
+    confoverrides = {
+        "html_theme_options": {
+            "logo": {
+                "image_dark": "image_dark_t",
+            }
+        },
+    }
+    with pytest.raises(sphinx.errors.ExtensionError, match="static logo image"):
+        sphinx_build_factory("base", confoverrides=confoverrides).build()
+
+
 def test_favicons(sphinx_build_factory):
     """Test that arbitrary favicons are included."""
     html_theme_options_favicons = {