asciidoctor-plantuml 0.1.0 → 0.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 06c1cf16fb57543cec6f90c9d907894ebe6c8b8888396f5cfeb9305340f130c1
-  data.tar.gz: 82488d9c4c5431c9244e0ad834bfbb2ae88ef1fe38146cca7d369352f967ff4f
+  metadata.gz: fa9d42baca46ef240d1621640dce548f96a46e4e535a6405cace400e2495f097
+  data.tar.gz: b7320f06086d5230ceb3507945971f48efe988edfd159ebde0cc1c5609bc86f6
 SHA512:
-  metadata.gz: 71e3258bc87c722dc6c393129ca5b5984c4ac45f4ea3f6c7ef49907d9dc71c605a1650852bcf6b6f9201115179f3672724883eaa6db0947dca387bb1a7ecf47c
-  data.tar.gz: 41993506e615c6ce9180b5677d2bb40a83e18b33abae1b1d16e96ed5b0493d773a747659a4c08be24a13728ac0303e3c63f31ea194b109decec8f0148f7ef79f
+  metadata.gz: e0f9dc73e4f6f116b1321d2d25a23a268d8158777abeb2c3984c5ce642dd1aecbe2febeb602d9d8e0fb038cb310fb934f460300996170e2e83d81a57fc159588
+  data.tar.gz: b9aea5f39cb2c27e48b1239518a9d8a63b7938cc81899c3454782a6afe235a0597817525bdfe125441e09f03dcc4b6abd276fc1509f5b8aa86abcf64e2287afd

data/lib/asciidoctor_plantuml/plantuml.rb

@@ -91,10 +91,16 @@ module Asciidoctor
 
           # insert global plantuml config after first line
           config_path = parent.attr('plantuml-include', '', true)
-          begin
-            content = insert_config_to_content(parent, config_path, content, attrs) unless config_path.empty?
-          rescue StandardError => e
-            return plantuml_invalid_file(config_path, e.message, attrs)
+
+          unless config_path.empty?
+            begin
+              source_file = parent.document.normalize_system_path(config_path, nil, nil, recover: false)
+              content = insert_config_to_content(parent, source_file, content, attrs)
+            rescue StandardError => e
+              return plantuml_invalid_file(source_file, e.message, attrs)
+            rescue SecurityError => e
+              return plantuml_insecure_file(source_file, e.message, attrs)
+            end
           end
 
           if %w[png svg txt].include?(format) && method("#{format}_enabled?").call
@@ -114,12 +120,14 @@ module Asciidoctor
           plantuml_content_format(parent, code, format, attrs)
         end
 
-        def plantuml_content_from_file(parent, source_file, attrs = {})
-          File.open(source_file) do |f|
-            return plantuml_content(parent, f, attrs)
-          end
+        def plantuml_content_from_file(parent, target, attrs = {})
+          source_file = parent.document.normalize_system_path(target, nil, nil, recover: false)
+          content = ::File.open(source_file, mode: FILE_READ_MODE)
+          plantuml_content(parent, content, attrs)
         rescue StandardError => e
           plantuml_invalid_file(source_file, e.message, attrs)
+        rescue SecurityError => e
+          plantuml_insecure_file(source_file, e.message, attrs)
         end
 
         # Compression code used to generate PlantUML URLs. Taken directly from
@@ -149,12 +157,10 @@ module Asciidoctor
         private
 
         def insert_config_to_content(parent, config_path, content, attrs)
-          File.open(config_path) do |file|
-            config = file.read
-            subs = attrs['subs']
-            config = parent.apply_subs(config, parent.resolve_subs(subs)) if subs
-            return content.dup.insert(content.index("\n"), "\n#{config}") unless config.empty?
-          end
+          config = File.read(config_path, mode: FILE_READ_MODE)
+          subs = attrs['subs']
+          config = parent.apply_subs(config, parent.resolve_subs(subs)) if subs
+          return content.dup.insert(content.index("\n"), "\n#{config}") unless config.empty?
         end
 
         def plantuml_txt_content(code, format, attrs = {})
@@ -227,6 +233,11 @@ module Asciidoctor
           _plantuml_error_content(error, attrs)
         end
 
+        def plantuml_insecure_file(file, error, attrs = {})
+          error = "PlantUML Error: Could not read \"#{file}\": #{error}"
+          _plantuml_error_content(error, attrs)
+        end
+
         def _plantuml_error_content(error, attrs = {})
           content = '<div class="listingblock">'
           content += '<div class="content">'
@@ -321,9 +332,7 @@ module Asciidoctor
       named :plantuml
 
       def process(parent, target, attrs)
-        base_dir = parent.document.base_dir
-        source_file = parent.document.path_resolver.system_path(target, base_dir, base_dir)
-        content = Processor.plantuml_content_from_file(parent, source_file, attrs)
+        content = Processor.plantuml_content_from_file(parent, target, attrs)
         Processor.create_plantuml_block(parent, content, attrs)
       end
     end

data/lib/asciidoctor_plantuml/version.rb

@@ -2,6 +2,6 @@
 
 module Asciidoctor
   module PlantUML
-    VERSION = '0.1.0'
+    VERSION = '0.1.1'
   end
 end

data/test/test_plantuml.rb

@@ -198,6 +198,13 @@ DOC_BLOCK_MACRO_MISSING_FILE = <<~ENDOFSTRING
   plantuml::test/fixtures/missing.puml[]
 ENDOFSTRING
 
+DOC_BLOCK_MACRO_INSECURE_FILE = <<~ENDOFSTRING
+  = Hello PlantUML!
+
+  .Title Of this
+  plantuml::/etc/passwd[]
+ENDOFSTRING
+
 DOC_SUBS_ATTRIBUTES = <<~ENDOFSTRING
   = Hello PlantUML!
   :text: Label
@@ -234,6 +241,18 @@ DOC_CONFIG_INCLUDE_MISSING_FILE = <<~ENDOFSTRING
   ----
 ENDOFSTRING
 
+DOC_CONFIG_INCLUDE_INSECURE_FILE = <<~ENDOFSTRING
+  = Hello PlantUML!
+  :plantuml-include: /etc/passwd
+
+  [plantuml, format="png"]
+  .Title Of this
+  ----
+  User -> (Start)
+  User --> (Use the application) : Label
+  ----
+ENDOFSTRING
+
 DOC_CONFIG_INCLUDE_MACRO_BLOCK = <<~ENDOFSTRING
   = Hello PlantUML!
   :plantuml-include: test/fixtures/config.puml
@@ -375,7 +394,7 @@ class PlantUmlTest < Test::Unit::TestCase
   end
 
   def test_should_show_file_error
-    html = ::Asciidoctor.convert(StringIO.new(DOC_BLOCK_MACRO_MISSING_FILE), backend: 'html5')
+    html = ::Asciidoctor.convert(StringIO.new(DOC_BLOCK_MACRO_MISSING_FILE), backend: 'html5', safe: :secure)
     page = Nokogiri::HTML(html)
 
     elements = page.css('pre.plantuml-error')
@@ -383,6 +402,15 @@ class PlantUmlTest < Test::Unit::TestCase
     assert_includes html, 'No such file or directory'
   end
 
+  def test_should_show_insecure_error
+    html = ::Asciidoctor.convert(StringIO.new(DOC_BLOCK_MACRO_INSECURE_FILE), backend: 'html5', safe: :secure)
+    page = Nokogiri::HTML(html)
+
+    elements = page.css('pre.plantuml-error')
+    assert_equal elements.size, 1
+    assert_includes html, 'is outside of jail'
+  end
+
   def test_plantuml_subs_attributes
     html = ::Asciidoctor.convert(StringIO.new(DOC_SUBS_ATTRIBUTES), backend: 'html5')
     page = Nokogiri::HTML(html)
@@ -397,7 +425,7 @@ class PlantUmlTest < Test::Unit::TestCase
   end
 
   def test_plantuml_config_include
-    html = ::Asciidoctor.convert(StringIO.new(DOC_CONFIG_INCLUDE), backend: 'html5')
+    html = ::Asciidoctor.convert(StringIO.new(DOC_CONFIG_INCLUDE), backend: 'html5', safe: :secure)
     page = Nokogiri::HTML(html)
 
     elements = page.css('img.plantuml')
@@ -418,8 +446,17 @@ class PlantUmlTest < Test::Unit::TestCase
     assert_includes html, 'No such file or directory'
   end
 
+  def test_plantuml_config_include_insecure_file
+    html = ::Asciidoctor.convert(StringIO.new(DOC_CONFIG_INCLUDE_INSECURE_FILE), backend: 'html5', safe: :secure)
+    page = Nokogiri::HTML(html)
+
+    elements = page.css('pre.plantuml-error')
+    assert_equal elements.size, 1
+    assert_includes html, 'is outside of jail'
+  end
+
   def test_plantuml_config_include_macro_block
-    html = ::Asciidoctor.convert(StringIO.new(DOC_CONFIG_INCLUDE_MACRO_BLOCK), backend: 'html5')
+    html = ::Asciidoctor.convert(StringIO.new(DOC_CONFIG_INCLUDE_MACRO_BLOCK), backend: 'html5', safe: :secure)
     page = Nokogiri::HTML(html)
 
     elements = page.css('img.plantuml')

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: asciidoctor-plantuml
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.1.1
 platform: ruby
 authors:
 - Horacio Sanson
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-04-30 00:00:00.000000000 Z
+date: 2022-05-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler