Lini 1.1.0

Lini can now compile source it did not write. A rendering service like Kroki pipes a stranger's diagram into lini - and serves the SVG back, so this release adds a flag that keeps that source away from the server's disk, and closes the two ways it could reach the reader's browser through the output.

cargo install lini

It is a minor bump for the new flag, and for two inputs that used to compile and now error (below). Nothing else in SPEC.md moved, and every sample renders byte-identical to 1.0.6.

--no-fs

An |image| with a local path is read from disk and embedded. That is right for your own file and wrong for a server: the source could name any file the server can read and get it back inside the SVG, and even the error answered whether a path existed — no such file and permission denied are not the same reply.

lini - --no-fs refuses every local path before it is joined or opened, so a file that exists and one that does not give the same error. URLs and data: URIs work as before, and so do assets a host hands over as bytes, which is how the browser build has always worked. --theme takes the built-ins and the light/dark pairs only, so a theme name a service forwards cannot be a path either. In the library it is Options::no_fs. See the CLI.

A string can no longer end the <style> element

Rule values and variables were written into the <style> body as they were. A font named "A & B" made the SVG malformed XML, and a string holding </style><script>…</script><style> closed the element and put a script in the document, one that runs when the SVG is opened on its own.

The body is escaped like any other character data now. Engine CSS never contains <, > or &, so no existing output changes. Besides the snapshots, I compiled every string in every sample with injection payloads in it, live and --static: 7,024 outputs, all well-formed, none with markup of its own. 1.0.6 fails that same run 8 times.

An href cannot run code

href: "javascript:alert(1)" made a node into a link that runs script in whatever page shows the figure. A javascript:, vbscript: or data: URL is now an error at its declaration, read the way a browser's URL parser reads it, so case, padding and a tab inside the scheme don't hide one. Pages, mailto:, fragments, relative paths and app links like obsidian:// are untouched. See the property ledger.

Downstream

lini-wasm@1.1.0 carries both fixes to every JavaScript host; its API did not move, and a browser has no filesystem for --no-fs to switch off. mdbook-lini@0.5.5 follows.