From 1494d3c3a6283a00701ac452b8a9a5f8f2f4e9dd Mon Sep 17 00:00:00 2001
From: Michael Williamson <mike@zwobble.org>
Date: Wed, 10 Sep 2025 15:55:27 +0100
Subject: Support disabling external file access

---
 README.md | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

(limited to 'README.md')

diff --git a/README.md b/README.md
index b0d6d49..79a49b3 100644
--- a/README.md
+++ b/README.md
@@ -230,6 +230,18 @@ var options = {
 };
 ```
 
+#### External file access
+
+Source documents may reference files outside of the source document.
+To disable access to any such external files during the conversion process,
+set `options.externalFileAccess` to `false`:
+
+```javascript
+var options = {
+    externalFileAccess: false
+};
+```
+
 #### Custom image handlers
 
 By default, images are converted to `<img>` elements with the source included inline in the `src` attribute.
@@ -536,6 +548,9 @@ For instance:
   and embed the HTML into your website,
   this may allow arbitrary files on the server to be read and exfiltrated.
 
+  To disable access to any such external files during the conversion process,
+  set `options.externalFileAccess` to `false`.
+
 ### Document transforms
 
 **The API for document transforms should be considered unstable,
-- 
cgit v1.2.3