We are using price to render HTML submitted by users of our web app. We do not want our users to be able to access local files on the server. We run prince with --no-xinclude --no-network and that helps a bit.

Problem is the users can still put in an img tag or an iframe with a local URL. It would be nice to have a --no-file-access switch that would disable all file access (except input, output, and stylesheet files specified on the command line).

One option could be to run Prince within a chroot jail, so that it can only access a very limited subset of files.