3 ms·
Take note: most of these HTML to PDF renderers run a headless browser. Does that pose a security concern to you? It might. Are you accepting any data from the
by dsr_ 6y ago
Take note: most of these HTML to PDF renderers run a headless browser.
Does that pose a security concern to you? It might. Are you accepting any data from the outside? Are you requesting anything from the outside world? Does your rendering browser have a place to write any data?
- cjcampbell 6y agoMentioned some guidance in a separate thread, but encoding/sanitization of dynamic content is crucial. Also, dig into the options for the tool and disable features that aren’t needed. As an example, wkhtmltopdf enables you to disable local file inclusion except for predetermined locations.