search

mermaid-js / mermaid-live-editor

Edit, preview and share mermaid charts/diagrams. New implementation of the live editor.
https://mermaid.live
MIT License
4.07k stars 613 forks source link

Disable buttons that share data externally to allow safe self-hosting #1511

Open bluprince13 opened 3 weeks ago

bluprince13 commented 3 weeks ago

Is your feature request related to a problem? Please describe. One of the reasons users might self-host is because they want to prevent data being leaked out of their company/org. However, there are buttons on the UI that allow users to share their diagram with other website. For example, with https://mermaid.ink/ or https://kroki.io/ or https://www.mermaidchart.com. Some of the problem locations that I could see are highlighted in the image below. I don't know if there are others I haven't noticed.

CleanShot 2024-08-23 at 18 21 39

Describe the solution you'd like It would be nice if these could be disabled using environment variables. For example, if rendererUrl and krokiRendererUrl are empty, then the respective buttons could be hidden.

For the mermaid chart links,

  1. the link to https://mermaidchart.com/ on the icon at the top right
  2. notification at the top linking to mermaidchart

Even though clicking on the link doesn't directly result in a data leak, it could still mislead users into thinking that it's okay to share the data on https://www.mermaidchart.com/.

Describe alternatives you've considered Could modify the code to get the desired effect, however then it could get annoying to resolve merge conflicts when pulling the latest version of this repo. An easy way to toggle these off via env variables might be something the community would benefit from.

Additional context I'm not very optimistic about this feature request being accepted, but thought it couldn't hurt to ask. Feels like these would be simple changes, so happy to raise a PR too.

sidharthv96 commented 3 weeks ago

Totally makes sense to disable those in the self hosted version, please raise PR.