From b124633526b1a2daf079604876c607a4ff9fc326 Mon Sep 17 00:00:00 2001 From: Crevil Date: Sat, 3 Jul 2021 12:04:36 +0200 Subject: [PATCH] Document techdocs svg_object limitation Currently it is not possible to use the PlantUML format 'svg_object' as this makes it possible for bad actors to inject malicious content into documentation. This change documents this limitation under the troubleshooting section of the techdocs feature. Signed-off-by: Crevil --- docs/features/techdocs/troubleshooting.md | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/docs/features/techdocs/troubleshooting.md b/docs/features/techdocs/troubleshooting.md index e6efefc578..d8b413be5c 100644 --- a/docs/features/techdocs/troubleshooting.md +++ b/docs/features/techdocs/troubleshooting.md @@ -55,3 +55,20 @@ INFO - Start watching changes [I 210115 19:00:45 handlers:64] Start detecting changes INFO - Start detecting changes ``` + +## PlantUML with `svg_object` doesn't render + +The [plantuml-markdown](https://pypi.org/project/plantuml-markdown/) MkDocs +plugin available in +[`mkdocs-techdocs-core`](https://github.com/backstage/mkdocs-techdocs-core) +supports different formats for rendering diagrams. TechDocs does however not +support all of them. + +The `svg_object` format renders a diagram as an HTML `` tag but this is +not allowed as it enables bad actors to inject malicious content into +documentation pages. See +[CVE-2021-32661](https://github.com/advisories/GHSA-gg96-f8wr-p89f) for more +details. + +Instead use `svg_inline` which renders as an `` tag and provides the same +benefits as `svg_object`.