pub enum SafeMode {
Unsafe = 0,
Safe = 1,
Server = 2,
Secure = 3,
}Expand description
Controls include access and exposure of local paths during parsing.
Defaults to Self::Secure. Applications must select a lower mode to load
include targets. The CLI selects its own defaults for each command.
Fixed resource limits apply in every mode. Output converters are responsible for restrictions on stylesheets, scripts, and other rendered resources.
Variants§
Unsafe = 0
Allows local includes without a base-directory boundary.
HTTP(S) includes require caller-supplied allow-uri-read. The built-in
transport also requires the network feature; custom providers supply
their own transport. Include depth and selected text size limits still apply.
Safe = 1
Keeps local include paths beneath the effective include base directory.
The base defaults to the entry file’s parent, or the current directory for
string and reader input. crate::OptionsBuilder::with_base_dir overrides it.
For /workspace/docs/main.adoc, ../shared.adoc becomes
/workspace/docs/shared.adoc, while /tmp/shared.adoc becomes
/workspace/docs/tmp/shared.adoc; both transformations emit a warning. This
check does not resolve symlinks, so /workspace/docs/linked.adoc may point
outside the directory. HTTP(S) includes require caller permission as in Unsafe mode.
Server = 2
Applies Safe mode’s include boundary and hides local directory and home paths.
docfile exposes the entry filename instead of its full path. HTTP(S)
includes require caller permission as in Unsafe mode.
Secure = 3
Disables local and remote include reads, and hides paths as in Server mode.
Include directives become link fallbacks with source-recovery warnings.
crate::parse_file can still read the entry file selected by the caller.