From c8888c5231718b8ab2aa510894272888f143d1a3 Mon Sep 17 00:00:00 2001 From: tannevaled Date: Sun, 4 Oct 2026 19:49:12 +0200 Subject: [PATCH] docs: document the SSRF guard requirement and the decode bounds (engine v0.4.3) Co-Authored-By: Claude Sonnet 5 --- docs/index.md | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/docs/index.md b/docs/index.md index 80b7062..42477f6 100644 --- a/docs/index.md +++ b/docs/index.md @@ -74,6 +74,17 @@ go run github.com/go-webengine/engine/cmd/render \ -url https://example.com/ -out out.png -w 1024 -h 768 ``` +## Security + +The engine fetches every resource a page names: images, stylesheets, fonts, +scripts and modules, `fetch`/XHR targets and form posts. It does **not** filter +destinations itself, so rendering an untrusted page from a machine with access to +private networks can reach internal addresses. Embedding the engine directly means +adding a dial-time guard through `Engine.Client` that refuses loopback, private and +link-local addresses; the [browserproxy](https://github.com/go-webengine/browserproxy) +service ships one. Decoding is bounded: raster images declaring more than 25 +megapixels are refused, and every fetch is size-capped. + ## Where to next - **[Architecture](architecture.md)** — the packages, the reuse-vs-build decision,