0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-06 06:24:48 +08:00
discourse/plugins/discourse-graphviz
David Taylor 1e7d122617
SECURITY: Prevent Sidekiq DoS via Graphviz rendering [backport 2026.1] (#40752)
Backport of #40743 to release/2026.1.

---

- Safely pass arguments to prevent JS injection into MiniRacer sandbox

- Add timeout for defense-in-depth
2026-06-10 18:13:50 +01:00
..
assets SECURITY: Sanitize graphviz SVG anchor links to prevent XSS 2026-03-19 15:46:24 +00:00
config Update translations (#36623) 2025-12-11 09:27:48 +01:00
db/post_migrate SECURITY: Sanitize graphviz SVG anchor links to prevent XSS 2026-03-19 15:46:24 +00:00
public/javascripts
spec SECURITY: Sanitize graphviz SVG anchor links to prevent XSS 2026-03-19 15:46:24 +00:00
.prettierignore
CHANGELOG.md
LICENSE.md
package.json DEV: Overhaul typechecking configuration (#35794) 2025-11-12 12:54:34 +00:00
plugin.rb SECURITY: Prevent Sidekiq DoS via Graphviz rendering [backport 2026.1] (#40752) 2026-06-10 18:13:50 +01:00
README.md
tsconfig.json DEV: Overhaul typechecking configuration (#35794) 2025-11-12 12:54:34 +00:00
upgrade-viz-js.rb

discourse-graphviz

https://meta.discourse.org/t/graphviz-plugin/97554/

Adds Graphviz capability to discourse.

Topic discussing the plugin itself can be found here: https://meta.discourse.org/t/graphviz-plugin/97554

Usage

See the Graphviz site for documentation and examples.
To use with a discourse post, wrap the chart defintion in graphviz tags and define engine (if not defined, it will default to dot) like this:

[graphviz engine=neato]
graph {
  a -- b;
  b -- c;
  a -- c;
  d -- c;
  e -- c;
  e -- a;
}
[/graphviz]