7 ms·
Unfortunately, the "sensible defaults" don't seem to check input URLs correctly and allow file:// URLs. Just try ?url=file:///etc/passwd on the demo instance.
by erdbeerkaese 9y ago
Unfortunately, the "sensible defaults" don't seem to check input URLs correctly and allow file:// URLs.
Just try ?url=file:///etc/passwd on the demo instance.
That seems to be a quite common issue with services like this built on generic libraries.
- homero 9y agoI've moved all my pdf to client side. Less security and processing on the server. http://pdfmake.org/#/gettingstarted http://pdfmake.org/#/gettingstarted
- adrianpike 9y agoIs there a browser support matrix somewhere? This looks real promising but we need to support IE9. :(
- woebtz 9y agoAlso consider non-Western languages (CJK, Russian, Arabic). My team got bit by this when we discovered we couldn't render emoji's client-side.
- dotmanish 9y agoInteresting. There's jsPDF as well which is similar: https://github.com/MrRio/jsPDF https://github.com/MrRio/jsPDF
- leesalminen 9y agoDoes anyone have advice on rendering wide tables (with lots of text) with this library? We have a constant cat ant mouse game with this library.
- welder 9y agoThen you can't send pdfs in emails or pre-cache pdfs...
- welder 9y agoOn second thought, if you're ok with linking to PDFs instead of attaching them in emails then you can pre-cache all content needed to generate PDFs. Besides email attachments, I can't think of a use-case for server side generating PDFs.
- kimmobru 9y agoOh wow, that's a bit embarrassing :) The urls are now restricted to http and https only. Thanks for noticing!
- rocky1138 9y agoConsider adding FTP. It might be better to blacklist file:// rather than trying to have a comprehensive whitelist.
- nothrabannosir 9y agoNot sure if this is sound advice. Blacklisting is a cat and mouse game, especially for security. The risk of a missing entry on a blacklist is worse than on a whitelist.
- qw 9y agoI am not at a computer noe, so I can’t test it, but do you take redirects into account? I hope you are not just whitelisting the initial URL, but also any URL’s it redirects to. If you don’t already, you should probably just disable redirects in whatever library you use.
- kimmobru 9y agoI gave this a thought for a moment. Since we're using a real browser, there are huge amount of different ways to get the browser display a file:// link. Redirect is one, window.location.href is another, etc. The service shouldn't be run publicly in the internet for real use cases. If you do, the server should be designed in a way that it's not dangerous if the web server user gets read access to file system. I added a warning about this in the top of the README.
- cutcss 9y agoYou are using Chrome headless therefore you can use group policy to add "file://" to the URL blacklist; see http://www.chromium.org/administrators/policy-list-3#URLBlacklist http://www.chromium.org/administrators/policy-list-3#URLBlac...
- katastic 9y agoThat didn't work for me. Was it patched already? {"status":400,"statusText":"Bad Request","errors":[{"field":["url"],"location":"query","messages":["\"url\" must be a valid uri with a scheme matching the http|https pattern"],"types":["string.uriCustomScheme"]}]}