search

alvarcarto / url-to-pdf-api

Web page PDF/PNG rendering done right. Self-hosted service for rendering receipts, invoices, or any content.
MIT License
7.01k stars 774 forks source link

Security issue #6

Closed rakanalh closed 6 years ago

rakanalh commented 6 years ago

https://url-to-pdf-api.herokuapp.com/api/render?url=file:///etc/passwd

Actually shows the content of the file... as mentioned by erdbeerkaese, here: https://news.ycombinator.com/item?id=15408217

kimmobrunfeldt commented 6 years ago

Thank you for opening the issue! Fixed in https://github.com/alvarcarto/url-to-pdf-api/commit/af5f96cc06fda90ea1dab5756e508aa11e139080