From a7981717b343dd09ece3962d36ebaf15e6852c4b Mon Sep 17 00:00:00 2001
From: pcworld <0188801@gmail.com>
Date: Mon, 9 Apr 2018 02:45:50 +0200
Subject: [PATCH] addImage docs: Warn about user-generated strings

---
 docs/elements.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/elements.rst b/docs/elements.rst
index c73ffa06..f2637ac9 100644
--- a/docs/elements.rst
+++ b/docs/elements.rst
@@ -234,7 +234,7 @@ To add an image, use the ``addImage`` method to sections, headers, footers, text
 
     $section->addImage($src, [$style]);
 
-- ``$src``. String path to a local image, URL of a remote image or the image data, as a string.
+- ``$src``. String path to a local image, URL of a remote image or the image data, as a string. Warning: Do not pass user-generated strings here, as that would allow an attacker to read arbitrary files or perform server-side request forgery by passing file paths or URLs instead of image data.
 - ``$style``. See :ref:`image-style`.
 
 Examples: