Merge pull request #1649 from CyberShadow/pull-20170510-220714

Fix Issue 17391 - SECURITY: XSS through DDOC comments
merged-on-behalf-of: Sebastian Wilzbach <sebi.wilzbach@gmail.com>

Author: dlang-bot

dcompiler.dd

@@ -424,7 +424,9 @@ dmd -cov -unittest myprog.d
       )
 
       $(SWITCH $(SWNAME -D),
-        generate $(LINK2 spec/ddoc.html, documentation) from source
+        $(P Generate $(LINK2 spec/ddoc.html, documentation) from source.)
+
+        $(P Note: mind the $(LINK2 spec/ddoc.html#security, security considerations).)
       )
 
       $(SWITCH $(SWNAME -Dd)$(I docdir),

spec/ddoc.dd

@@ -1033,6 +1033,16 @@ $(P
     generated by Ddoc.
 )
 
+$(H2 $(LNAME2 security, Security considerations))
+
+$(P
+    Note that DDoc comments may embed raw HTML, including
+    $(LT)script$(GT) tags. Be careful when publishing or distributing
+    rendered DDoc HTML generated from untrusted sources, as this may
+    allow $(LINK2 https://en.wikipedia.org/wiki/Cross-site_scripting,
+    cross-site scripting).
+)
+
 $(H2 Links to D documentation generators)
 
 $(P