diff options
Diffstat (limited to 'README.md')
| -rw-r--r-- | README.md | 22 |
1 files changed, 22 insertions, 0 deletions
@@ -66,6 +66,10 @@ Install-Package Mammoth ### Library +**Mammoth performs no sanitisation of the source document, +and should therefore be used extremely carefully with untrusted user input.** +See the [Security](#security) section for more information. + #### Basic conversion To convert an existing .docx file to HTML, @@ -299,6 +303,24 @@ var converter = new DocumentConverter() where `StreamToBase64` is a function that reads a stream and encodes it as a Base64 string. +### Security + +Mammoth performs no sanitisation of the source document, +and should therefore be used extremely carefully with untrusted user input. +For instance: + +* Source documents can contain links with `javascript:` targets. + If, for instance, you allow users to upload source documents, + automatically convert the document into HTML, + and embed the HTML into your website without sanitisation, + this may create links that can execute arbitrary JavaScript when clicked. + +* Source documents may reference files outside of the source document. + If, for instance, you allow users to upload source documents to a server, + automatically convert the document into HTML on the server, + and embed the HTML into your website, + this may allow arbitrary files on the server to be read and exfiltrated. + ## Writing style maps A style map is made up of a number of style mappings separated by new lines. |