Headline
CVE-2022-41706: GitHub - spatie/browsershot: Convert HTML to an image, PDF or string
Browsershot version 3.57.2 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the URL protocol passed to the Browsershot::url method.
Convert a webpage to an image or pdf using headless Chrome
The package can convert a webpage to an image or pdf. The conversion is done behind the scenes by Puppeteer which controls a headless version of Google Chrome.
Here’s a quick example:
use Spatie\Browsershot\Browsershot;
// an image will be saved Browsershot::url(‘https://example.com’)->save($pathToImage);
It will save a pdf if the path passed to the save method has a pdf extension.
// a pdf will be saved Browsershot::url(‘https://example.com’)->save(‘example.pdf’);
You can also use an arbitrary html input, simply replace the url method with html:
Browsershot::html(‘<h1>Hello world!!</h1>’)->save(‘example.pdf’);
If your HTML input is already in a file locally use the :
Browsershot::htmlFromFilePath(‘/local/path/to/file.html’)->save(‘example.pdf’);
Browsershot also can get the body of an html page after JavaScript has been executed:
Browsershot::url(‘https://example.com’)->bodyHtml(); // returns the html of the body
If you wish to retrieve an array list with all of the requests that the page triggered you can do so:
$requests = Browsershot::url(‘https://example.com’) ->triggeredRequests();
foreach ($requests as $request) { $url = $request[‘url’]; //https://example.com/ }
Support us
Learn how to create a package like this one, by watching our premium video course:
We invest a lot of resources into creating best in class open source packages. You can support us by buying one of our paid products.
We highly appreciate you sending us a postcard from your hometown, mentioning which of our package(s) you are using. You’ll find our address on our contact page. We publish all received postcards on our virtual postcard wall.
Documentation
All documentation is available on our documentation site.
Contributing
Please see CONTRIBUTING for details.
Security
If you’ve found a bug regarding security please mail [email protected] instead of using the issue tracker.
Alternatives
If you’re not able to install Node and Puppeteer, take a look at v2 of browsershot, which uses Chrome headless CLI to take a screenshot. v2 is not maintained anymore, but should work pretty well.
If using headless Chrome does not work for you take a look at at v1 of this package which uses the abandoned PhantomJS binary.
Credits
- Freek Van der Herten
- All Contributors
And a special thanks to Caneco for the logo ✨
License
The MIT License (MIT). Please see License File for more information.
Related news
Browsershot version 3.57.2 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the URL protocol passed to the Browsershot::url method.