allow-uri-read attribute is ignored in the .asciidoctorconfig file

[artemy-osipov]

allow-uri-read attribute must be set to include external files https://docs.asciidoctor.org/asciidoc/latest/directives/include-uri/ In addition, it must be specified through Asciidoc attributes https://github.com/asciidoctor/asciidoctorj/issues/71

Observed vs. expected behavior

allow-uri-read attribute is only recognized in the IDEA settings

Steps to reproduce

1. Write some adoc that includes external file

== Example

include::https://raw.githubusercontent.com/asciidoctor/asciidoctor-intellij-plugin/main/FEATURES.adoc[]

2. Set allow-uri-read attribute in gradle extension

asciidoctorj {
    attribute('allow-uri-read', 'true')
}

3. Run asciidoctorEditorConfig task to generate .asciidoctorconfig file

The line :allow-uri-read: true is successfully added to the file, but the preview only shows a link to a external file

However, if you generate documentation (run asciidoc task), the file will be successfully included

If the attribute is set through the IDEA settings, then the preview works fine

Environment

Plugin Version: 0.35.8

IntelliJ Details:

IntelliJ IDEA 2021.2.3 (Ultimate Edition)
Build #IU-212.5457.46, built on October 12, 2021
Runtime version: 11.0.12+7-b1504.40 x86_64
VM: OpenJDK 64-Bit Server VM by JetBrains s.r.o.
macOS 11.6
GC: ParNew, ConcurrentMarkSweep
Memory: 1979M
Cores: 12
Non-Bundled Plugins: Key Promoter X (2021.2), org.sonarlint.idea (6.1.0.38326), org.asciidoctor.intellij.asciidoc (0.35.8), org.mapstruct.intellij (1.3.0), izhangzhihao.rainbow.brackets (6.21)
Kotlin: 212-1.5.10-release-IJ5457.46

[ahus1]

Thanks for reporting this. As you looked up in the docs correctly, the attribute allow-uri-read needs to be placed on the command line or the Asciidoctor API. It can't be specified in the document or include. I assume this has been done for security reasons.

As the .asciidoctorconfig file works like an include, allow-uri-read doesn't work there. Adding it to the plugin's settings is the way to go.

I wonder how the user experience for this can be improved. Some options I see, please add more ideas:

• add error highlighting in the IDE when allow-uri-read is set in a file
• add a hint to the docs
• prevent the gradle plugin to add this to the .asciidoctorconfig file, instead show a warning
• ....

I'm looking forward to your ideas and suggestions. Thanks!

[artemy-osipov]

Thanks for the quick response

Unfortunately, this bug leads to inconsistency between actual asciidoc generation via gradle plugin and IDEA preview

To improve the user experience, I think the following options could be considered

• interpret some options from the .asciidoctorconfig file as Asciidoc attributes rather than document attributes. This will strengthen consistency with the gradle plugin and with the settings in IDEA and give more flexibility in specifying options. There may be some security concerns, but as far as I understand safe mode is introduced for this. Also, these attributes are not applied implicitly, but are taken from a file with an explicit list of attributes
• add integration to specify asciidoc attributes via a separate file similar to the .asciidoctorconfig
• when imports of external files are detected, output a notification with confirmation. A similar notification is already implemented to confirm the use of third-party extensions in .asciidoctor/lib

[mojavelinux]

interpret some options from the .asciidoctorconfig file as Asciidoc attributes rather than document attributes.

I agree this would be ideal, particularly security-related settings like allow-uri-read. I view the asciidoctorconfig file more as an API entry point than as an include.

Btw, "Asciidoc attributes rather than document attributes" is not the correct terminology. In both cases, they are document attributes. It would be correct to say security document attributes (see https://docs.asciidoctor.org/asciidoc/latest/attributes/document-attributes-ref/#security-attributes).

[ahus1]

@artemy-osipov - yes, I can see the inconsistency there. Still, .asciidoctorconfig works like an include/document: you can use for example ifdefs, and include other documents/snippets. This functionality is in the way of interpreting the file as you suggest.

add integration to specify AsciiDoc attributes via a separate file

If someone would promote/support such a configuration file in Asciidoctor, and if such a configuration file would solve a case/add value by for example supporting allow-uri-read, I'd be happy to support it in the plugin.

For those using Antora, there is already a structured way to supply attributes via a YAML file, and as far as I know allow-uri-read is set via API there.

I'll probably pursue the path an editor notification that detects the situation and asks the user to update the settings via a quick-fix.

[mojavelinux]

For those using Antora, there is already a structured way to supply attributes via a YAML file, and as far as I know allow-uri-read is set via API there.

:+1:

If someone would promote/support such a configuration file in Asciidoctor

My idea here is to mirror exactly what Antora is doing (in fact, Antora is that model). The schema of the asciidoc key would become a top-level YAML file to configure Asciidoctor. It's just a matter of tooling recognizing it.

[artemy-osipov]

If someone would promote/support such a configuration file in Asciidoctor, and if such a configuration file would solve a case/add value by for example supporting allow-uri-read, I'd be happy to support it in the plugin

It does seem to be the best option. Some file similar to .asciidoctorconfig but with a stricter structure (ex. yaml) in which you can set asciidoctor attributes/security-related settings and potentially many others (IDEA plugin settings/VSCode extension settings/etc). Should I open a separate feature request here?

[ahus1]

Closing this issue as no additional steps are planned for the AsciiDoc plugin.