Add notes on security

2 files changed, 24 insertions, 0 deletions

diff --git a/NEWS b/NEWS
index e76b2c6..6224299 100644
--- a/NEWS
+++ b/NEWS
@@ -9,6 +9,8 @@
 
 * Ignore deleted table rows.
 
+* Add notes on security.
+
 # 1.9.0
 
 * Detect checkboxes, both as complex fields and structured document tags, and
diff --git a/README.md b/README.md
index 7b14077..5561ac8 100644
--- a/README.md
+++ b/README.md
@@ -70,6 +70,10 @@ Available on [Maven Central](http://search.maven.org/#artifactdetails|org.zwobbl
 
 ### Library
 
+**Mammoth performs no sanitisation of the source document,
+and should therefore be used extremely carefully with untrusted user input.**
+See the [Security](#security) section for more information.
+
 #### Basic conversion
 
 To convert an existing .docx file to HTML,
@@ -305,6 +309,24 @@ DocumentConverter converter = new DocumentConverter()
 
 where `streamToBase64` is a function that reads an input stream and encodes it as a Base64 string.
 
+### Security
+
+Mammoth performs no sanitisation of the source document,
+and should therefore be used extremely carefully with untrusted user input.
+For instance:
+
+* Source documents can contain links with `javascript:` targets.
+  If, for instance, you allow users to upload source documents,
+  automatically convert the document into HTML,
+  and embed the HTML into your website without sanitisation,
+  this may create links that can execute arbitrary JavaScript when clicked.
+
+* Source documents may reference files outside of the source document.
+  If, for instance, you allow users to upload source documents to a server,
+  automatically convert the document into HTML on the server,
+  and embed the HTML into your website,
+  this may allow arbitrary files on the server to be read and exfiltrated.
+
 ## Writing style maps
 
 A style map is made up of a number of style mappings separated by new lines.