yuzutech/kroki v0.36.0

on GitHub

Security

• Send a Content-Security-Policy: script-src 'none'; object-src 'none' header on every response, so that a script injected in a diagram (for instance through a diagram library that does not escape user input) cannot run on the Kroki origin when the SVG is opened directly or embedded in an <iframe>. The policy can be changed, or removed, with KROKI_CONTENT_SECURITY_POLICY (#2281)
• Prevent unauthenticated remote code execution on /tikz/svg via \special{ps:...}, which was still possible despite the previous fix: because of a bug in dvisvgm 3.6 (mgieseki/dvisvgm#306), the --no-specials=ps option was silently ignored, so PostScript specials were still handed off to Ghostscript. PostScript specials (ps:, ps::, pst:, ", !, header=, psfile=, pdffile=...) are now removed from the DVI file before it is passed to dvisvgm
• Prevent a reflected cross-site scripting (XSS) on /goat/svg via the svg-color-dark-scheme and svg-color-light-scheme options: GoAT inserts their values as-is into a <style> element of the SVG, so a value containing </style><script>... injected an executable script in the diagram. These options now only accept CSS color values (for instance: #FFF, red or rgb(0, 0, 0)), other values are rejected with a 400 error
• Prevent a reflected cross-site scripting (XSS) on /dbml/svg via the table url setting: the DBML renderer turned its value into a link on the table header without checking the URL scheme, so a javascript: URL ran a script when the header was clicked. Links whose scheme is not http, https or mailto (relative links are still allowed) are now removed from the diagram
• Prevent BlockDiag, SeqDiag, ActDiag, NwDiag, PacketDiag and RackDiag diagrams from making the server fetch an arbitrary URL (SSRF, e.g. against internal services or cloud metadata endpoints) or read a local image file: a node's icon or background naming a URL or a file was fetched or read, and embedded in the output, regardless of KROKI_SAFE_MODE. Unless Kroki is running in UNSAFE mode, blockdiag now runs with its new --no-external-images flag and ignores these images

Added

• Allow selecting the TALA layout engine, bundled since D2 0.9.0, with the D2 layout option (layout=tala). The option previously only accepted elk and silently fell back to the default dagre layout for any other value (#2272)

Changed

• Compile the server for Java 21 and document Java 21 as the minimum version for the manual install. Java 21 was already required at runtime since Structurizr 6, which is compiled for Java 21: on an older Java version, the server failed to start with an UnsupportedClassVersionError (#2276)

Fixed

• Apply the Symbolator library-name option, which was never recognized by Symbolator because of a trailing space in the argument name. As documented, the option requires title to be set and is ignored otherwise. The documentation of the title option is also fixed: it is a flag that adds the component name above the symbol, any value is ignored (#2277)

Diagram libraries

• Update BlockDiag, SeqDiag, ActDiag, NwDiag, PacketDiag and RackDiag to 3.4.3

What's Changed

• feat(d2): allow the TALA layout engine with the layout option by @ggrossetie in #2272
• docs: restart companion containers after a reboot in Compose examples by @ggrossetie in #2273
• build: compile the server for Java 21 by @ggrossetie in #2276
• test: wait for the HTTP responses in ServerTest by @ggrossetie in #2278
• fix(symbolator): apply the library-name option by @ggrossetie in #2277
• feat: send a Content-Security-Policy header to forbid scripts by @ggrossetie in #2281
• docs: document third-party companion containers and how to extend Kroki by @ggrossetie in #2279
• refactor: describe diagram options with DiagramOption by @Assaviv in #2274
• docs(changelog): list the blockdiag update under Diagram libraries by @ggrossetie in #2282

New Contributors

• @Assaviv made their first contribution in #2274

Full Changelog: v0.35.0...v0.36.0