search

pallymore / wkhtmltopdf-binary-edge

this is forked from tolgap/wkhtmltopdf-binary .
MIT License
74 stars 33 forks source link

Fix the handling of single quotes in the wrapper script #20

Closed knu closed 4 years ago

knu commented 4 years ago

There's a flaw in how bin/wkhtmltopdf handles single quotes.

% bin/wkhtmltopdf --title "User's Guide" file:///path/to/html /tmp/output.pdf
sh: -c: line 0: unexpected EOF while looking for matching `''
sh: -c: line 1: syntax error: unexpected end of file

This can lead to security vulnerability when the user of this package passes an untrusted string to the bin/wkhtmltopdf command.