From 5ba5be0aac2ea5198a37d6cbfc76f47d8c0a08c3 Mon Sep 17 00:00:00 2001
From: lacatoire <la.catoire@gmail.com>
Date: Fri, 18 Sep 2026 10:10:04 +0200
Subject: [PATCH] [Sync-En] DOMDocument::xinclude(): add a warning about
 untrusted input

---
 reference/dom/domdocument/xinclude.xml | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/reference/dom/domdocument/xinclude.xml b/reference/dom/domdocument/xinclude.xml
index f03dd615a7..3c1dd5faa2 100644
--- a/reference/dom/domdocument/xinclude.xml
+++ b/reference/dom/domdocument/xinclude.xml
@@ -1,6 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<!-- EN-Revision: c1f37a6c270aadbbb3da56a3973ffd62197adf2b Maintainer: yannick Status: ready -->
-<!-- Reviewed: yes -->
+<!-- EN-Revision: a8093165f0158ce673d98310e0874eeea4c9de68 Maintainer: yannick Status: ready -->
 <refentry xml:id="domdocument.xinclude" xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink">
  <refnamediv>
   <refname>DOMDocument::xinclude</refname>
@@ -23,6 +22,15 @@
     peut produire des résultats non attendus si le fichier XML inclus a une DTD attachée.
    </para>
   </note>
+  <warning>
+    <simpara>
+      Il est recommandé de ne pas appeler cette méthode sur du XML non fiable,
+      car les XIncludes peuvent inclure des fichiers provenant de sites web
+      externes (lorsque l'attribut <literal>href</literal> est une URL) ou des
+      fichiers locaux arbitraires (lorsque l'attribut <literal>href</literal>
+      utilise <literal>file://</literal>).
+    </simpara>
+  </warning>
  </refsect1>
  <refsect1 role="parameters">
   &reftitle.parameters;