Skip to content
Source on GitHubVisitors

16. Security, privacy and robustness

Contents of DISL 0.5
  • No code execution. Specifications contain no executable code other than CEL, which is sandboxed, side-effect free and terminating. Plugins are code and MUST be installed through an explicit trust decision.
  • Resource limits. Runtimes MUST enforce CEL cost limits (2.5), limits on stored diagram size and element count (language.limits), hook depth (9.2), import depth (default 16) and path segment counts in custom shapes (default 10 000).
  • Sanitisation. Inline SVG (shapes, icons) MUST be sanitised: no <script>, no event handler attributes, no <foreignObject>, no external references except data URIs of images. Markdown in labels and docs MUST be rendered without raw HTML. URIs in labels and links MUST be restricted to http, https, mailto and internal references unless the specification allows more.
  • File-system facts. CEL reads nothing from the file system except through fs.exists and fs.isDirectory (12.4), which are confined to the root the runtime was given, answer only whether a path exists and is a folder, never follow network paths, and return optional.none() for anything outside that root. No other expression, context or function reads a file.
  • Remote resources. Imports, fonts, images and icons from remote URIs SHOULD carry integrity hashes; runtimes MAY block remote loading and SHOULD cache with integrity verification.
  • Privacy. env.user is empty unless the runtime is configured to expose it; DID definitions store user names in metadata only with consent (11.8). Attributes marked secret are excluded from exports, logs, telemetry and AI assistant context.
  • Integrity of stored diagrams. Unknown content is preserved (14.3); failed migrations never overwrite originals; saves are atomic.
  • Denial of service through geometry. Runtimes SHOULD cap the number of rendered sub-rows in stacking, bands in ordinal axes and grid lines per frame.

Referenced from