Add notes on security

Author: mwilliamson

NEWS

@@ -9,6 +9,8 @@
 
 * Ignore deleted table rows.
 
+* Add notes on security.
+
 # 1.9.1
 
 * Ignore AlternateContent elements when there is no Fallback element.

README.md

@@ -73,6 +73,10 @@ The output is an HTML fragment, rather than a full HTML document, encoded with U
 Since the encoding is not explicitly set in the fragment,
 opening the output file in a web browser may cause Unicode characters to be rendered incorrectly if the browser doesn't default to UTF-8.
 
+**Mammoth performs no sanitisation of the source document,
+and should therefore be used extremely carefully with untrusted user input.**
+See the [Security](#security) section for more information.
+
 #### Images
 
 By default, images are included inline in the output HTML.
@@ -111,6 +115,10 @@ For instance:
 
 ### Library
 
+**Mammoth performs no sanitisation of the source document,
+and should therefore be used extremely carefully with untrusted user input.**
+See the [Security](#security) section for more information.
+
 #### Basic conversion
 
 To convert an existing .docx file to HTML,
@@ -389,6 +397,24 @@ although the fidelity of the conversion depends entirely on LibreOffice.
 
 [wmf-libreoffice-recipe]: https://github.com/mwilliamson/python-mammoth/blob/master/recipes/wmf_images.py
 
+### Security
+
+Mammoth performs no sanitisation of the source document,
+and should therefore be used extremely carefully with untrusted user input.
+For instance:
+
+* Source documents can contain links with `javascript:` targets.
+  If, for instance, you allow users to upload source documents,
+  automatically convert the document into HTML,
+  and embed the HTML into your website without sanitisation,
+  this may create links that can execute arbitrary JavaScript when clicked.
+
+* Source documents may reference files outside of the source document.
+  If, for instance, you allow users to upload source documents to a server,
+  automatically convert the document into HTML on the server,
+  and embed the HTML into your website,
+  this may allow arbitrary files on the server to be read and exfiltrated.
+
 ### Document transforms
 
 **The API for document transforms should be considered unstable,