Javascript hyperlinks in SVG

0 votes
asked Apr 1, 2020 in Bug by fred (540 points)
Hello,

When I try to use a Javascript hyperlink like the following, the hyperlink is not present in output SVG (but it is in PNG+area) :

@startuml
Bob -> Alice : [[javascript:alert('test') hello]]
@enduml

This used to work in 2017 versions, and possibly more recently as well, but I have not tested all intermediate versions.

Is this on purpose (e.g., for security reasons)? If so, could there be a flag to enable support for Javascript hyperlinks even if they are off by default?

Thanks,

Frédéric

1 Answer

0 votes
answered Apr 2, 2020 by plantuml (257,900 points)
selected Apr 14, 2020 by fred
 
Best answer

Yes, it has been removed for security reasons.

In last beta, we have added an environment variable to enable Javascript hyperlink back.

http://beta.plantuml.net/plantuml.jar

You have to set PLANTUML_JAVASCRIPT_UNSECURE to true :

set PLANTUML_JAVASCRIPT_UNSECURE=true

or

setenv PLANTUML_JAVASCRIPT_UNSECURE true

or

java -DPLANTUML_JAVASCRIPT_UNSECURE=true -jar /path/to/plantuml.jar ...

Tell us if it's not working for you!

commented Apr 2, 2020 by fred (540 points)
Hello,

Thanks. Would that environment variable work for the webservice as well (plantuml.war) ? On a local install of course. Because this is where I need it, and I do not know how to set it up.

Best regards,

Frédéric
commented Apr 14, 2020 by fred (540 points)
Hello,

This works as intented with a local installation of the PlantUML webservice.

Thanks,

Frédéric
...