diff options
| author | Steve Klabnik <steve@steveklabnik.com> | 2015-04-16 15:43:56 -0400 |
|---|---|---|
| committer | Steve Klabnik <steve@steveklabnik.com> | 2015-04-16 23:50:12 -0400 |
| commit | 3ca83a79bf6fcd019ab53e1b10a83663c6b3a34d (patch) | |
| tree | 63a8bc8440931233c60009f27bacf3071e5dea1c /src | |
| parent | 00a8d65ef3389164f1c71ec95f686530fdfc9d9d (diff) | |
| download | rust-3ca83a79bf6fcd019ab53e1b10a83663c6b3a34d.tar.gz rust-3ca83a79bf6fcd019ab53e1b10a83663c6b3a34d.zip | |
Make note of possible XSS in Rustdoc
Fixes #24160
Diffstat (limited to 'src')
| -rw-r--r-- | src/doc/trpl/documentation.md | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/src/doc/trpl/documentation.md b/src/doc/trpl/documentation.md index 06071a8f15f..9c56ab11dbc 100644 --- a/src/doc/trpl/documentation.md +++ b/src/doc/trpl/documentation.md @@ -560,3 +560,13 @@ This sets a few different options, with a logo, favicon, and a root URL. - `--html-before-content FILE`: includes the contents of FILE directly after `<body>`, before the rendered content (including the search bar). - `--html-after-content FILE`: includes the contents of FILE after all the rendered content. + +## Security note + +The Markdown in documentation comments is placed without processing into +the final webpage. Be careful with literal HTML: + +```rust +/// <script>alert(document.cookie)</script> +# fn foo() {} +``` |