Merge pull request #51 from punktDe/sast

TASK: escape shell args for html2pdf
punktDe · Dec 9, 2020 · 3a37da0 · 3a37da0
2 parents c12a186 + 5bb23cc
commit 3a37da0
Showing 1 changed file with 8 additions and 8 deletions.
diff --git a/Classes/View/Export/WkHtml2PdfListView.php b/Classes/View/Export/WkHtml2PdfListView.php
@@ -274,16 +274,16 @@ private function runWkHtmlCommand($htmlDocument, $html)
         }
 
         $wkCommand = '"' . $this->cmd . '"'
-            . ($addFooter ? ' --footer-html ' . $htmlDocument . '.footer.html' : '')
-            . ($addHeader ? ' --header-html ' . $htmlDocument . '.header.html' : '')
-            . (($this->additionalWkhtmlParams !== null) ? ' ' . $this->additionalWkhtmlParams : '')
-            . (($this->copies > 1) ? ' --copies ' . $this->copies : '')        // number of copies
-            . ' --orientation ' . $this->orient                                // orientation
-            . ' --page-size ' . $this->size                                    // page size
+            . ($addFooter ? ' --footer-html ' . escapeshellarg($htmlDocument) . '.footer.html' : '')
+            . ($addHeader ? ' --header-html ' . escapeshellarg($htmlDocument) . '.header.html' : '')
+            . (($this->additionalWkhtmlParams !== null) ? ' ' . escapeshellarg($this->additionalWkhtmlParams) : '')
+            . (($this->copies > 1) ? ' --copies ' . escapeshellarg($this->copies) : '')        // number of copies
+            . ' --orientation ' . escapeshellarg($this->orient)                                // orientation
+            . ' --page-size ' . escapeshellarg($this->size)                                    // page size
             . ($this->toc ? ' --toc' : '')                                        // table of contents
             . ($this->grayscale ? ' --grayscale' : '')                            // grayscale
-            . (($this->title != '') ? ' --title "' . $this->title . '"' : '')    // title
-            . ' "' . $htmlDocument . '" -';
+            . (($this->title != '') ? ' --title "' . escapeshellarg($this->title) . '"' : '')    // title
+            . ' "' . escapeshellarg($htmlDocument) . '" -';
 
 
         $this->pdf = $this->pipeExec($wkCommand);