From c54aaeb43a7941317c1f3c119ffa92090f988820 Mon Sep 17 00:00:00 2001 From: Michael Williamson Date: Fri, 19 Sep 2025 11:15:02 +0100 Subject: Disable external file access by default --- README.md | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) (limited to 'README.md') diff --git a/README.md b/README.md index 9c34147..f2b9d48 100644 --- a/README.md +++ b/README.md @@ -377,9 +377,9 @@ Converts the source document to HTML. set `options.includeDefaultStyleMap` to `false`. * `externalFileAccess`: Source documents may reference files outside of the source document. - To disable access to any such external files during the conversion process, - set `options.externalFileAccess` to `false`. - This is highly recommended when converting untrusted user input. + Access to any such external files is disabled by default. + To enable access when converting trusted source documents, + set `options.externalFileAccess` to `true`. * `convertImage`: by default, images are converted to `` elements with the source included inline in the `src` attribute. Set this option to an [image converter](#image-converters) to override the default behaviour. @@ -541,8 +541,9 @@ For instance: and embed the HTML into your website, this may allow arbitrary files on the server to be read and exfiltrated. - To disable access to any such external files during the conversion process, - set `options.externalFileAccess` to `false`. + To avoid this issue, access to any such external files is disabled by default. + To enable access when converting trusted source documents, + set `options.externalFileAccess` to `true`. ### Document transforms -- cgit v1.2.3