Make note of possible XSS in Rustdoc

Fixes #24160
2015-04-16 15:43:56 -04:00 · 2015-04-16 15:43:56 -04:00 · 3ca83a79bf
parent 00a8d65ef3
commit 3ca83a79bf
1 changed files with 10 additions and 0 deletions
--- a/src/doc/trpl/documentation.md
+++ b/src/doc/trpl/documentation.md
@ -560,3 +560,13 @@ This sets a few different options, with a logo, favicon, and a root URL.
 - `--html-before-content FILE`: includes the contents of FILE directly after
  `<body>`, before the rendered content (including the search bar).
 - `--html-after-content FILE`: includes the contents of FILE after all the rendered content.
+
+## Security note
+
+The Markdown in documentation comments is placed without processing into
+the final webpage. Be careful with literal HTML:
+
+```rust
+/// <script>alert(document.cookie)</script>
+# fn foo() {}
+```