Unable to extend from http endpoints in Structurizr

[Zatura24]

Starting of, thank you for this amazing piece of software.

As of version 29.1 we are no longer able to render Structurizr DSL's which use http urls using workspace extension: https://docs.structurizr.com/dsl/cookbook/workspace-extension/

From what I can see, Structurizr added a new http client which by default does not allow any http urls: https://github.com/structurizr/structurizr/blob/2514c612e0c1273f6cc83e94974771621ea5b93a/structurizr-client/src/main/java/com/structurizr/http/HttpClient.java#L27

This http client is used inside the workspace parser: https://github.com/structurizr/structurizr/blob/98c633fbc59736392948e976f3780ab9fdb40c68/structurizr-dsl/src/main/java/com/structurizr/dsl/WorkspaceParser.java#L50

It is possible to overwrite the http client for the StructurizrDslParser (https://github.com/structurizr/structurizr/blob/98c633fbc59736392948e976f3780ab9fdb40c68/structurizr-dsl/src/main/java/com/structurizr/dsl/StructurizrDslParser.java#L1473) which would be needed to allow http urls again.

The Structurizr application itself uses a system property (https://github.com/structurizr/structurizr/blob/98c633fbc59736392948e976f3780ab9fdb40c68/structurizr-application/src/main/java/com/structurizr/configuration/StructurizrProperties.java#L20C1-L20C90) to configure the allowed urls. Would something like this be possible for Kroki as well?

[simonbrowndotje]

v5.x of the Structurizr DSL blocks network calls by default, so you'll need to modify this configuration if you'd like to allow network calls. For example:

StructurizrDslParser structurizrDslParser = new StructurizrDslParser();
structurizrDslParser.getHttpClient().allow(".*");

(see https://github.com/structurizr/java/blob/master/structurizr-client/src/main/java/com/structurizr/http/HttpClient.java#L115)

Similarly, the old StructurizrDslParser.setRestricted(boolean) method has been deprecated in favour of finer-grained settings.

[Zatura24]

Thanks for confirming Simon. I assume Kroki could do something similar to the Structurizr application where a method is implemented to set allowed network urls based on an environment variable like this: https://github.com/structurizr/structurizr/blob/bf00811ae2d737b1905b62fdeb32a81ea6ea8f7f/structurizr-application/src/main/java/com/structurizr/configuration/Configuration.java#L322-L333