diff options
Diffstat (limited to 'README.md')
| -rw-r--r-- | README.md | 10 |
1 files changed, 7 insertions, 3 deletions
@@ -255,9 +255,9 @@ Methods: if the document contains an embedded style map, then it is combined with the default style map. Call this to ignore any embedded style maps. -* `DocumentConvert disableExternalFileAccess()`: Source documents may reference files outside of the source document. - Call this to disable access to any such external files during the conversion process. - This is highly recommended when converting untrusted user input. +* `DocumentConverter enableExternalFileAccess()`: Source documents may reference files outside of the source document. + Access to any such external files is disabled by default. + Call this to enable access when converting trusted source documents. * `DocumentConverter preserveEmptyParagraphs()`: by default, empty paragraphs are ignored. Call this to preserve empty paragraphs in the output. @@ -330,6 +330,10 @@ For instance: automatically convert the document into HTML on the server, and embed the HTML into your website, this may allow arbitrary files on the server to be read and exfiltrated. +* + To avoid this issue, access to any such external files is disabled by default. + To enable access when converting trusted source documents, + call `enableExternalFileAccess()`. ## Writing style maps |