Fix security #122

2019-09-26 19:08:48 +02:00
parent aa9172f715
commit 83138142c5
4 changed files with 27 additions and 0 deletions
--- a/src/main/java/net/sourceforge/plantuml/servlet/UmlDiagramService.java
+++ b/src/main/java/net/sourceforge/plantuml/servlet/UmlDiagramService.java
@@ -42,6 +42,13 @@ import java.util.regex.Pattern;
@SuppressWarnings("serial")
 public abstract class UmlDiagramService extends HttpServlet {

+    static {
+        OptionFlags.ALLOW_INCLUDE = false;
+        if ("true".equalsIgnoreCase(System.getenv("ALLOW_PLANTUML_INCLUDE"))) {
+            OptionFlags.ALLOW_INCLUDE = true;
+        }
+    }
+
    @Override
    public void doGet(HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException {