search

LaurentRDC / pandoc-plot

Render and include figures in Pandoc documents using your plotting toolkit of choice
https://laurentrdc.github.io/pandoc-plot/
GNU General Public License v2.0
216 stars 8 forks source link

`--safe` option that only allows safe plotting options #52

Open mgajda opened 1 year ago

mgajda commented 1 year ago

While diversity is great feature, sometimes one would like to call pandoc-plot on Markdown of unknown origin. In such case it would be nice to have --safe option that disables all those plotting libraries that can execute arbitrary code.

This would probably allow only gnuplot, graphviz, plantuml, and ggplot2 without shell escape.

To disable shell escape in gnuplot it may be sufficient to run with environment variable set: SHELL=/bin/false gnuplot. As far as I know graphviz and plantuml allow no shell escape.

LaurentRDC commented 1 year ago

That's a good suggestion.

I don't have time to implement it myself, but I'm happy to review pull requests for this feature.