asciidoctor / asciidoctor-intellij-plugin

AsciiDoc plugin for products on the IntelliJ platform (IDEA, RubyMine, etc)
https://intellij-asciidoc-plugin.ahus1.de/
Apache License 2.0
342 stars 145 forks source link

Allow the user to configure the safe mode #347

Closed ggrossetie closed 4 years ago

ggrossetie commented 4 years ago

I think we should allow the user to configure the safe mode: https://asciidoctor.org/docs/user-manual/#running-asciidoctor-securely

Currently the value is unsafe according to the value printed when using the attribute {safe-mode-name} in a document.

{safe-mode-name}

AsciiDoc Plugin Version: 0.30.7

IntelliJ IDEA 2019.2.3 (Ultimate Edition)
Build #IU-192.6817.14, built on September 24, 2019
Runtime version: 11.0.4+10-b304.69 amd64
VM: OpenJDK 64-Bit Server VM by JetBrains s.r.o
Linux 4.15.0-58-generic
GC: ParNew, ConcurrentMarkSweep
Memory: 1981M
Cores: 8
Registry: 
Non-Bundled Plugins: Batch Scripts Support, CMD Support, CheckStyle-IDEA, FindBugs-IDEA, JFormDesigner, PsiViewer, org.asciidoctor.intellij.asciidoc, org.jetbrains.idea.grammar, org.jetbrains.plugins.slim, BashSupport, com.dmarcotte.handlebars, com.jetbrains.lang.ejs, com.jetbrains.plugins.jade, com.wix.eslint, org.intellij.scala, org.jetbrains.plugins.ruby
ahus1 commented 4 years ago

"unsafe" is the default when running Asciidoctor CLI from the command line. As in documentation-as-code environments developers would check out a repository and then build the docs locally, it is safe to assume that the "unsafe" mode from the command line is the right default.

Having said that the user should be able to configure this in the settings of the plugin.

ggrossetie commented 4 years ago

I agree the default value should be "unsafe" but you might want to configure it to "safe" if you are suspicious about a repository or a file.

ahus1 commented 4 years ago

Thanks to @bit-man to provide an implementation for this feature! The user can now configure it in the plugin's settings. This is now merged into the master and will be part of the next release.

To close this issue, I think this needs a little bit of information what "Safe Mode" is about and what the different options are. Each enum item could receive a little bit more text to explain the option. A label like we have it for "URL of custom Kroki instance" would do explaining the default, and where to get more information. Like the label for Kroki it can link to a web site (Asciidoctor or the plugin's Wiki page) where the user finds more information).

A short snippet in FEATURES.adoc that summarizes all functionality available in the plugin would be nice as well.

Here a screenshot of the current settings menu:

image

ahus1 commented 4 years ago

Thank you for @bit-man to provide additional hints for the settings, this issue is now complete.

image

bit-man commented 4 years ago

@ahus1 I've also added a tooltip explaining about Safe mode when mouse is over Safe mode label

ahus1 commented 4 years ago

A new pre-release 0.30.10 of this plugin includes this feature. The preview is available from GitHub releases and the IntelliJ AsciiDoc EAP repository.