diff options
Diffstat (limited to 'README.md')
| -rw-r--r-- | README.md | 26 |
1 files changed, 26 insertions, 0 deletions
@@ -73,6 +73,10 @@ The output is an HTML fragment, rather than a full HTML document, encoded with U Since the encoding is not explicitly set in the fragment, opening the output file in a web browser may cause Unicode characters to be rendered incorrectly if the browser doesn't default to UTF-8. +**Mammoth performs no sanitisation of the source document, +and should therefore be used extremely carefully with untrusted user input.** +See the [Security](#security) section for more information. + #### Images By default, images are included inline in the output HTML. @@ -111,6 +115,10 @@ For instance: ### Library +**Mammoth performs no sanitisation of the source document, +and should therefore be used extremely carefully with untrusted user input.** +See the [Security](#security) section for more information. + #### Basic conversion To convert an existing .docx file to HTML, @@ -389,6 +397,24 @@ although the fidelity of the conversion depends entirely on LibreOffice. [wmf-libreoffice-recipe]: https://github.com/mwilliamson/python-mammoth/blob/master/recipes/wmf_images.py +### Security + +Mammoth performs no sanitisation of the source document, +and should therefore be used extremely carefully with untrusted user input. +For instance: + +* Source documents can contain links with `javascript:` targets. + If, for instance, you allow users to upload source documents, + automatically convert the document into HTML, + and embed the HTML into your website without sanitisation, + this may create links that can execute arbitrary JavaScript when clicked. + +* Source documents may reference files outside of the source document. + If, for instance, you allow users to upload source documents to a server, + automatically convert the document into HTML on the server, + and embed the HTML into your website, + this may allow arbitrary files on the server to be read and exfiltrated. + ### Document transforms **The API for document transforms should be considered unstable, |