From 8216e5ae1770955ad2400cee764c7f8ec56483bf Mon Sep 17 00:00:00 2001 From: Michael Williamson Date: Wed, 10 Sep 2025 16:25:23 +0100 Subject: Recommend external_file_access=False with untrusted user input --- README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README.md b/README.md index a698eab..616f0a7 100644 --- a/README.md +++ b/README.md @@ -293,6 +293,7 @@ Converts the source document to HTML. * Source documents may reference files outside of the source document. To disable access to any such external files during the conversion process, pass `external_file_access=False`. + This is highly recommended when converting untrusted user input. * `convert_image`: by default, images are converted to `` elements with the source included inline in the `src` attribute. Set this argument to an [image converter](#image-converters) to override the default behaviour. -- cgit v1.2.3