4 ms·
Hi, I bootstrapped this simple website. Let me know what you think :)
by shashanoid 6y ago
Hi, I bootstrapped this simple website. Let me know what you think :)
- mhasbini 6y agoI tried it with a bit complex pdf structure and it worked like charm +1. Would love to learn more about the underlying techniques/tech.
- dellinspiron 6y agoIt just calls https://github.com/pdf2htmlEX/pdf2htmlEX https://github.com/pdf2htmlEX/pdf2htmlEX on the server.
- echan00 6y agoWhat calls what?
- chipperyman573 6y agoYou could create a file named ; echo 'hi'; # and it appears as if it would probably run anything you put between ; and # (in this case it will echo hi). Unless the filename is sanitized, which it appears to not be.
- hombre_fatal 6y agohttps://github.com/shashanoid/Simpdf/blob/1557bf838a8debeee1a6f21c12ee3e91c420b855/backend/run.py#L31 https://github.com/shashanoid/Simpdf/blob/1557bf838a8debeee1... Btw, arbitrary code execution vuln here, OP.
- deleted 6y ago[deleted]
- parhamn 6y agoYeah. Switch array & args disable the shell. I hope they’re not running that locally as the download script suggests. But then you still have a bunch of other security issues. Shrug.
- miccah 6y agoI'm investigating the same. The upload endpoint uses secure_filename to get the filename used in that func. I'm not familiar with it, but the docs say it could return an empty string.
- shashanoid 6y agoHey, there's nothing complex going on. I'm using a tool to convert pdf to html, and it does a phenomenal job.
- saradhi 6y agoWhat's up with requirements. That's a lot and I don't see all being used. did you line them for new features?
- koulvi 6y agoI used this to delete a few pages from a pdf file. However, I can't download the edited version. The "save and download" option is just resulting in opening another blank webpage.