Security for rst->html

- disallow includes and raw html
- http://docutils.sourceforge.net/docs/howto/security.html

darcs-hash:20090701050141-82ea9-7c548a15dc4427c248871eb3eec43fa88c8a0f17.gz

1 files changed, 3 insertions, 1 deletions

diff --git a/writers.py b/writers.py
index d237c07..57cf7b0 100644
--- a/writers.py
+++ b/writers.py
@@ -312,5 +312,7 @@ class HTMLfromRST(object):
     def format(self, M):
         import docutils.core
         rst = RST().format(M)
-        rstToHTML = docutils.core.publish_string(rst, writer_name='html')
+        rstToHTML = docutils.core.publish_string(rst, writer_name='html',
+                             settings_overrides={'file_insertion_enabled': 0,
+                                                 'raw_enabled': 0})
         return rstToHTML