pub enum SafeMode {
Unsafe = 0,
Safe = 1,
Server = 2,
Secure = 3,
}Expand description
Controls include access and exposure of local paths during parsing.
Fixed resource limits apply in every mode. Output converters are responsible for restrictions on stylesheets, scripts, and other rendered resources.
Variants§
Unsafe = 0
Allows local includes without a base-directory boundary.
HTTP(S) includes still require caller-supplied allow-uri-read and the
network feature. Include depth, response size, and other limits still apply.
Safe = 1
Keeps local include paths beneath the effective include base directory.
The base defaults to the entry file’s parent, or the current directory for
string and reader input. crate::OptionsBuilder::with_base_dir overrides it.
For /workspace/docs/main.adoc, ../shared.adoc becomes
/workspace/docs/shared.adoc, while /tmp/shared.adoc becomes
/workspace/docs/tmp/shared.adoc; both transformations emit a warning. This
check does not resolve symlinks, so /workspace/docs/linked.adoc may point
outside the directory. HTTP(S) includes require caller permission as in Unsafe mode.
Server = 2
Applies Safe mode’s include boundary and hides local directory and home paths.
docfile exposes the entry filename instead of its full path. HTTP(S)
includes still require caller permission and the network feature.
Secure = 3
Disables local and remote include reads, and hides paths as in Server mode.
Include directives become link fallbacks with source-recovery warnings.
crate::parse_file can still read the entry file selected by the caller.