paulononato/backstage
1
0
Fork 0
Code Issues Pull Requests Actions 22 Packages Projects Releases Wiki Activity

feat(sanitizer): add support for allowlisting additional URI protocols

Browse Source 
Signed-off-by: Nick Hudkins <nick@nickhudkins.com>
This commit is contained in:
Nick Hudkins
2025-07-17 12:39:23 -04:00
parent e656551f8f
commit cb0541f294
5 changed files with 87 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/features/techdocs/how-to-guides.md
+19
View File
@@ -606,6 +606,25 @@ techdocs:
This way, custom element like `<backstage-element attribute1="value"></backstage-element>` will be allowed in the result HTML.
## How to allow additional URI protocols in TechDocs
TechDocs uses the [DOMPurify](https://github.com/cure53/DOMPurify) library to
sanitize HTML and prevent XSS attacks.
It's possible to allow additional URI protocols based on a list of protocols. To do
this, add the allowed protocols in the `techdocs.sanitizer.additionalAllowedURIProtocols`
and `additionalAllowedURIProtocols` configuration of your `app-config.yaml`.
For example:
```yaml
techdocs:
sanitizer:
additionalAllowedURIProtocols: ["vscode"],
```
This way, links like `<a href="vscode://settings/">VSCode Settings<a>` will be allowed in the result HTML
## How to render PlantUML diagram in TechDocs
PlantUML allows you to create diagrams from plain text language. Each diagram description begins with the keyword - (@startXYZ and @endXYZ, depending on the kind of diagram). For UML Diagrams, Keywords @startuml & @enduml should be used. Further details for all types of diagrams can be found at [PlantUML Language Reference Guide](https://plantuml.com/guide).