Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Asciidoctor core now uses read_contents to download and embed custom stylesheet #1089

Merged
merged 2 commits into from
Oct 29, 2020
Merged

Asciidoctor core now uses read_contents to download and embed custom stylesheet #1089

merged 2 commits into from
Oct 29, 2020

Conversation

ggrossetie
Copy link
Member

Adjust the implementation to be compatible with asciidoctor/asciidoctor#3766

@mojavelinux
Copy link
Member

Long term, we really need to think about how the definition for what a remote URL is can be controlled. For example, even though chrome:// looks like a remote URL to core, it's actually a specialized file URI for the browser extension. We shouldn't be circumventing allow-uri-read, but changing when allow-uri-read is requested. And that is only once we know, for certain, that the target requires a network call.

@ggrossetie
Copy link
Member Author

@mojavelinux Yes!
In this case, we should probably clarify the intent of allow-uri-read:

For security reasons, this capability is not enabled by default. To allow content to be read from a URI, you must enable the URI read permission by:

-- gh.com/asciidoctor/asciidoctor.org/master/docs/_includes/uri-include.adoc

It should be: "To allow content to be read from a remote URI..."

(And we want enough logic hooks for that).

I think a is_remote? check/hook in core would help but since I'm already monkey-patching the whole read_contents there's no rush.

@ggrossetie ggrossetie merged commit 4e5ee5f into asciidoctor:master Oct 29, 2020
@ggrossetie ggrossetie deleted the fix-asciidoctor-upstream-3766 branch October 29, 2020 08:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants