From 6253adaba15a72f5310970d180e7f5b1c13a3242 Mon Sep 17 00:00:00 2001 From: pcworld <0188801@gmail.com> Date: Mon, 9 Apr 2018 02:47:16 +0200 Subject: [PATCH] Warn about parsing user-generated HTML --- src/PhpWord/Shared/Html.php | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/PhpWord/Shared/Html.php b/src/PhpWord/Shared/Html.php index d8a10b57..3f34968d 100644 --- a/src/PhpWord/Shared/Html.php +++ b/src/PhpWord/Shared/Html.php @@ -34,6 +34,8 @@ class Html * Add HTML parts. * * Note: $stylesheet parameter is removed to avoid PHPMD error for unused parameter + * Warning: Do not pass user-generated HTML here, as that would allow an attacker to read arbitrary + * files or perform server-side request forgery by passing local file paths or URLs in . * * @param \PhpOffice\PhpWord\Element\AbstractContainer $element Where the parts need to be added * @param string $html The code to parse