paulononato/backstage
1
0
Fork 0
Code Issues Pull Requests Actions 24 Packages Projects Releases Wiki Activity

Document techdocs svg_object limitation

Browse Source 
Currently it is not possible to use the PlantUML format 'svg_object' as this
makes it possible for bad actors to inject malicious content into documentation.

This change documents this limitation under the troubleshooting section of the
techdocs feature.

Signed-off-by: Crevil <bjoern.soerensen@gmail.com>
This commit is contained in:
Crevil
2021-07-03 12:04:36 +02:00
parent 8f6fbf0232
commit b124633526
1 changed files with 17 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/features/techdocs/troubleshooting.md
+17
View File
@@ -55,3 +55,20 @@ INFO - Start watching changes
[I 210115 19:00:45 handlers:64] Start detecting changes
INFO - Start detecting changes
```
## PlantUML with `svg_object` doesn't render
The [plantuml-markdown](https://pypi.org/project/plantuml-markdown/) MkDocs
plugin available in
[`mkdocs-techdocs-core`](https://github.com/backstage/mkdocs-techdocs-core)
supports different formats for rendering diagrams. TechDocs does however not
support all of them.
The `svg_object` format renders a diagram as an HTML `<object>` tag but this is
not allowed as it enables bad actors to inject malicious content into
documentation pages. See
[CVE-2021-32661](https://github.com/advisories/GHSA-gg96-f8wr-p89f) for more
details.
Instead use `svg_inline` which renders as an `<svg>` tag and provides the same
benefits as `svg_object`.