Asciidoctor Diagram executes external renderers. Security risks usually come from untrusted diagram input and unsafe runtime permissions.
- Treat diagram sources as executable input for render backends.
- Require review for diagram files from external contributors.
- Run rendering only in CI jobs with restricted permissions.
¶ Sandbox Renderer Execution
- Use isolated containers/VMs for build jobs.
- Drop unnecessary Linux capabilities.
- Mount source read-only where possible.
- Disable outbound internet for render jobs unless required.
- Prevent diagram engines from reaching internal metadata services.
- Enforce egress allow-lists in CI runners.
- Prevent renderer access to host secrets and CI tokens.
- Separate workspace, cache, and artifact directories.
- Rotate and clean temporary build directories after runs.
¶ Dependency and Extension Hygiene
- Pin Asciidoctor Diagram and backend tool versions.
- Track vulnerabilities for Graphviz, PlantUML, and related binaries.
- Rebuild CI images regularly.