docs: Added better security warning about SAFE_FOR_XML to README

cure53 · Jun 25, 2024 · 9978cec · 9978cec
1 parent fa542df
commit 9978cec
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/README.md b/README.md
@@ -181,6 +181,9 @@ const clean = DOMPurify.sanitize(dirty, {SAFE_FOR_TEMPLATES: true});
 
 
 // change how e.g. comments containing risky HTML characters are treated.
+// be very careful, this setting should only be set to `false` if you really only handle 
+// HTML and nothing else, no SVG, MathML or the like. 
+// Otherwise, changing from `true` to `false` will lead to XSS in this or some other way.
 const clean = DOMPurify.sanitize(dirty, {SAFE_FOR_XML: false});
 ```