Fix security #122

2019-09-26 19:08:48 +02:00
parent aa9172f715
commit 83138142c5
4 changed files with 27 additions and 0 deletions
--- a/src/main/java/net/sourceforge/plantuml/servlet/ProxyServlet.java
+++ b/src/main/java/net/sourceforge/plantuml/servlet/ProxyServlet.java
@@ -56,6 +56,13 @@ import javax.net.ssl.SSLPeerUnverifiedException;
@SuppressWarnings("serial")
 public class ProxyServlet extends HttpServlet {

+    static {
+        OptionFlags.ALLOW_INCLUDE = false;
+        if ("true".equalsIgnoreCase(System.getenv("ALLOW_PLANTUML_INCLUDE"))) {
+            OptionFlags.ALLOW_INCLUDE = true;
+        }
+    }
+
    @Override
    public void doGet(HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException {