Hacker News Reader

As both a heavy phabricator user AND a graphviz lover, your comment got me quite excited....up until the part where it was removed :(

If you look through the task description on the phabricator task I linked, there is Paste file which has the contents of an extension to allow continued use of graphviz, however they state it's insecure and not supported.

This is built using Emscripten. They compiled native Graphviz to JS and there is a thin shim that renders the .dot files to the browser. Dot command gives output that makes this relatively easy.

My guess is that seccomp blacklisting file access should be enough. It wouldn't be too hard to patch graphviz to disallow file access. And/or containerising it to only have write/read access inside a single, dedicated folder.

Graphviz has code to restrict file access when used in a web server. Its in lib/common/utils.c:safefile()

But to be honest, a container approach would probably be better today.