Disable external file access by default

1 files changed, 7 insertions, 3 deletions

diff --git a/README.md b/README.md
index 358a265..42b12a2 100644
--- a/README.md
+++ b/README.md
@@ -255,9 +255,9 @@ Methods:
   if the document contains an embedded style map, then it is combined with the default style map.
   Call this to ignore any embedded style maps.
 
-* `DocumentConvert disableExternalFileAccess()`: Source documents may reference files outside of the source document.
-  Call this to disable access to any such external files during the conversion process.
-  This is highly recommended when converting untrusted user input.
+* `DocumentConverter enableExternalFileAccess()`: Source documents may reference files outside of the source document.
+  Access to any such external files is disabled by default.
+  Call this to enable access when converting trusted source documents.
 
 * `DocumentConverter preserveEmptyParagraphs()`: by default, empty paragraphs are ignored.
   Call this to preserve empty paragraphs in the output.
@@ -330,6 +330,10 @@ For instance:
   automatically convert the document into HTML on the server,
   and embed the HTML into your website,
   this may allow arbitrary files on the server to be read and exfiltrated.
+* 
+  To avoid this issue, access to any such external files is disabled by default.
+  To enable access when converting trusted source documents,
+  call `enableExternalFileAccess()`.
 
 ## Writing style maps