From c54aaeb43a7941317c1f3c119ffa92090f988820 Mon Sep 17 00:00:00 2001 From: Michael Williamson Date: Fri, 19 Sep 2025 11:15:02 +0100 Subject: Disable external file access by default --- NEWS | 3 ++- README.md | 11 ++++++----- lib/options-reader.js | 2 +- test/mammoth.tests.js | 12 ++++++------ 4 files changed, 15 insertions(+), 13 deletions(-) diff --git a/NEWS b/NEWS index 65daefc..2b7fd2b 100644 --- a/NEWS +++ b/NEWS @@ -2,7 +2,8 @@ * Ignore style definitions using a style ID that has already been used. -* Support disabling external file accesses using the externalFileAccess option. +* Disable external file accesses by default. External file access can be enabled + using the externalFileAccess option. * Handle numbering levels defined without an index. diff --git a/README.md b/README.md index 9c34147..f2b9d48 100644 --- a/README.md +++ b/README.md @@ -377,9 +377,9 @@ Converts the source document to HTML. set `options.includeDefaultStyleMap` to `false`. * `externalFileAccess`: Source documents may reference files outside of the source document. - To disable access to any such external files during the conversion process, - set `options.externalFileAccess` to `false`. - This is highly recommended when converting untrusted user input. + Access to any such external files is disabled by default. + To enable access when converting trusted source documents, + set `options.externalFileAccess` to `true`. * `convertImage`: by default, images are converted to `` elements with the source included inline in the `src` attribute. Set this option to an [image converter](#image-converters) to override the default behaviour. @@ -541,8 +541,9 @@ For instance: and embed the HTML into your website, this may allow arbitrary files on the server to be read and exfiltrated. - To disable access to any such external files during the conversion process, - set `options.externalFileAccess` to `false`. + To avoid this issue, access to any such external files is disabled by default. + To enable access when converting trusted source documents, + set `options.externalFileAccess` to `true`. ### Document transforms diff --git a/lib/options-reader.js b/lib/options-reader.js index 4768159..a3f3903 100644 --- a/lib/options-reader.js +++ b/lib/options-reader.js @@ -63,7 +63,7 @@ var defaultStyleMap = exports._defaultStyleMap = [ ]; var standardOptions = exports._standardOptions = { - externalFileAccess: true, + externalFileAccess: false, transformDocument: identity, includeDefaultStyleMap: true, includeEmbeddedStyleMap: true diff --git a/test/mammoth.tests.js b/test/mammoth.tests.js index 06cf62f..038cbdf 100644 --- a/test/mammoth.tests.js +++ b/test/mammoth.tests.js @@ -309,27 +309,27 @@ test('src of inline images can be changed using readAsBuffer()', function() { }); }); -test('images stored outside of document are included in output', function() { +test('when external file access is enabled then images stored outside of document are included in output', function() { var docxPath = path.join(__dirname, "test-data/external-picture.docx"); - return mammoth.convertToHtml({path: docxPath}).then(function(result) { + return mammoth.convertToHtml({path: docxPath}, {externalFileAccess: true}).then(function(result) { assert.equal(result.value, '

'); assert.deepEqual(result.messages, []); }); }); -test('error if images stored outside of document are specified when passing file without path', function() { +test('when external file access is enabled then error if images stored outside of document are specified when passing file without path', function() { var docxPath = path.join(__dirname, "test-data/external-picture.docx"); var buffer = fs.readFileSync(docxPath); - return mammoth.convertToHtml({buffer: buffer}).then(function(result) { + return mammoth.convertToHtml({buffer: buffer}, {externalFileAccess: true}).then(function(result) { assert.equal(result.value, ''); assert.equal(result.messages[0].message, "could not find external image 'tiny-picture.png', path of input document is unknown"); assert.equal(result.messages[0].type, "error"); }); }); -test('error if images stored outside of document are specified when external file access is disabled', function() { +test('given external file access is disabled by default then error if images stored outside of document are specified', function() { var docxPath = path.join(__dirname, "test-data/external-picture.docx"); - return mammoth.convertToHtml({path: docxPath}, {externalFileAccess: false}).then(function(result) { + return mammoth.convertToHtml({path: docxPath}).then(function(result) { assert.equal(result.value, ''); assert.equal(result.messages[0].message, "could not read external image 'tiny-picture.png', external file access is disabled"); assert.equal(result.messages[0].type, "error"); -- cgit v1.2.3