From 8ac505b7bbfae94e01a49c7d60fe6176414d0379 Mon Sep 17 00:00:00 2001 From: Michael Williamson Date: Sat, 2 Aug 2025 16:31:29 +0100 Subject: Add notes on security --- NEWS | 2 ++ README.md | 22 ++++++++++++++++++++++ 2 files changed, 24 insertions(+) diff --git a/NEWS b/NEWS index e76b2c6..6224299 100644 --- a/NEWS +++ b/NEWS @@ -9,6 +9,8 @@ * Ignore deleted table rows. +* Add notes on security. + # 1.9.0 * Detect checkboxes, both as complex fields and structured document tags, and diff --git a/README.md b/README.md index 7b14077..5561ac8 100644 --- a/README.md +++ b/README.md @@ -70,6 +70,10 @@ Available on [Maven Central](http://search.maven.org/#artifactdetails|org.zwobbl ### Library +**Mammoth performs no sanitisation of the source document, +and should therefore be used extremely carefully with untrusted user input.** +See the [Security](#security) section for more information. + #### Basic conversion To convert an existing .docx file to HTML, @@ -305,6 +309,24 @@ DocumentConverter converter = new DocumentConverter() where `streamToBase64` is a function that reads an input stream and encodes it as a Base64 string. +### Security + +Mammoth performs no sanitisation of the source document, +and should therefore be used extremely carefully with untrusted user input. +For instance: + +* Source documents can contain links with `javascript:` targets. + If, for instance, you allow users to upload source documents, + automatically convert the document into HTML, + and embed the HTML into your website without sanitisation, + this may create links that can execute arbitrary JavaScript when clicked. + +* Source documents may reference files outside of the source document. + If, for instance, you allow users to upload source documents to a server, + automatically convert the document into HTML on the server, + and embed the HTML into your website, + this may allow arbitrary files on the server to be read and exfiltrated. + ## Writing style maps A style map is made up of a number of style mappings separated by new lines. -- cgit v1.2.3