3 ms·
Phabricator had allowed for specifying dot notation in their markdown (remarkup) which would use graphviz to render the images in the comment. I loved this feat
by neandrake 10y ago
Phabricator had allowed for specifying dot notation in their markdown (remarkup) which would use graphviz to render the images in the comment. I loved this feature but it was removed due to potential exploits [0]. Is anyone familiar with how graphiviz-as-a-service could be possible while addressing these concerns?
[0] https://hackerone.com/reports/88395 https://hackerone.com/reports/88395, https://secure.phabricator.com/T9408 https://secure.phabricator.com/T9408
- neilkod 10y agoAs both a heavy phabricator user AND a graphviz lover, your comment got me quite excited....up until the part where it was removed :(
- neandrake 10y agoIf you look through the task description on the phabricator task I linked, there is Paste file which has the contents of an extension to allow continued use of graphviz, however they state it's insecure and not supported.
- leni536 10y agoMy guess is that seccomp blacklisting file access should be enough. It wouldn't be too hard to patch graphviz to disallow file access. And/or containerising it to only have write/read access inside a single, dedicated folder.
- ellson 10y agoGraphviz has code to restrict file access when used in a web server. Its in lib/common/utils.c:safefile() But to be honest, a container approach would probably be better today.
- bitexploder 10y agoThis is built using Emscripten. They compiled native Graphviz to JS and there is a thin shim that renders the .dot files to the browser. Dot command gives output that makes this relatively easy.