diff options
Diffstat (limited to 'README.md')
| -rw-r--r-- | README.md | 11 |
1 files changed, 6 insertions, 5 deletions
@@ -291,9 +291,9 @@ Converts the source document to HTML. pass `include_default_style_map=False`. * Source documents may reference files outside of the source document. - To disable access to any such external files during the conversion process, - pass `external_file_access=False`. - This is highly recommended when converting untrusted user input. + Access to any such external files is disabled by default. + To enable access when converting trusted source documents, + pass `external_file_access=True`. * `convert_image`: by default, images are converted to `<img>` elements with the source included inline in the `src` attribute. Set this argument to an [image converter](#image-converters) to override the default behaviour. @@ -420,8 +420,9 @@ For instance: and embed the HTML into your website, this may allow arbitrary files on the server to be read and exfiltrated. - To disable access to any such external files during the conversion process, - pass `external_file_access=False`. + To avoid this issue, access to any such external files is disabled by default. + To enable access when converting trusted source documents, + pass `external_file_access=True`. ### Document transforms |