@@ -4842,6 +4842,36 @@ which you can modify according to your needs, do
48424842
48434843[lua]: http://www.lua.org
48444844
4845+A note on security
4846+==================
4847+
4848+If you use pandoc to convert user-contributed content in a web
4849+application, here are some things to keep in mind:
4850+
4851+1. Although pandoc itself will not create or modify any files other
4852+ than those you explicitly ask it create (with the exception
4853+ of temporary files used in producing PDFs), a filter or custom
4854+ writer could in principle do anything on your file system. Please
4855+ audit filters and custom writers very carefully before using them.
4856+
4857+2. If your application uses pandoc as a Haskell library (rather than
4858+ shelling out to the executable), it is possible to use it in a mode
4859+ that fully isolates pandoc from your file system, by running the
4860+ pandoc operations in the `PandocPure` monad. See the document
4861+ [Using the pandoc API](http://pandoc.org/using-the-pandoc-api.html)
4862+ for more details.
4863+
4864+3. Pandoc's parsers can exhibit pathological performance on some
4865+ corner cases. It is wise to put any pandoc operations under
4866+ a timeout, to avoid DOS attacks that exploit these issues.
4867+
4868+4. The HTML generated by pandoc is not guaranteed to be safe.
4869+ If `raw_html` is enabled for the Markdown input, users can
4870+ inject arbitrary HTML. Even if `raw_html` is disabled,
4871+ users can include dangerous content in attributes for
4872+ headers, spans, and code blocks. To be safe, you should
4873+ run all the generated HTML through an HTML sanitizer.
4874+
48454875Authors
48464876=======
48474877