From 750a5bd6f103c816281fddb6dca91a55a0617829 Mon Sep 17 00:00:00 2001 From: Michael Williamson Date: Fri, 19 Sep 2025 11:20:28 +0100 Subject: Disable external file access by default --- README.md | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) (limited to 'README.md') diff --git a/README.md b/README.md index 616f0a7..3d5a613 100644 --- a/README.md +++ b/README.md @@ -291,9 +291,9 @@ Converts the source document to HTML. pass `include_default_style_map=False`. * Source documents may reference files outside of the source document. - To disable access to any such external files during the conversion process, - pass `external_file_access=False`. - This is highly recommended when converting untrusted user input. + Access to any such external files is disabled by default. + To enable access when converting trusted source documents, + pass `external_file_access=True`. * `convert_image`: by default, images are converted to `` elements with the source included inline in the `src` attribute. Set this argument to an [image converter](#image-converters) to override the default behaviour. @@ -420,8 +420,9 @@ For instance: and embed the HTML into your website, this may allow arbitrary files on the server to be read and exfiltrated. - To disable access to any such external files during the conversion process, - pass `external_file_access=False`. + To avoid this issue, access to any such external files is disabled by default. + To enable access when converting trusted source documents, + pass `external_file_access=True`. ### Document transforms -- cgit v1.2.3