force template html as html code, not an url or file path

ensure that external resources are not loaded by jsdom

lib/tools.js

@@ -199,8 +199,13 @@ function prepareHtml(html, callback) {
     if (!(html || '').toString().trim()) {
         return callback(null, false);
     }
-
+    jsdom.env(false, false, {
-    jsdom.env(html, (err, win) => {
+        html,
+        features: {
+            FetchExternalResources: false, // disables resource loading over HTTP / filesystem
+            ProcessExternalResources: false // do not execute JS within script blocks
+        }
+    }, (err, win) => {
         if (err) {
             return callback(err);
         }