Security
Headlines
HeadlinesLatestCVEs

Headline

CVE-2022-41706: GitHub - spatie/browsershot: Convert HTML to an image, PDF or string

Browsershot version 3.57.2 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the URL protocol passed to the Browsershot::url method.

CVE
#web#google#js#git#java#pdf#chrome

Convert a webpage to an image or pdf using headless Chrome

The package can convert a webpage to an image or pdf. The conversion is done behind the scenes by Puppeteer which controls a headless version of Google Chrome.

Here’s a quick example:

use Spatie\Browsershot\Browsershot;

// an image will be saved Browsershot::url(‘https://example.com’)->save($pathToImage);

It will save a pdf if the path passed to the save method has a pdf extension.

// a pdf will be saved Browsershot::url(‘https://example.com’)->save(‘example.pdf’);

You can also use an arbitrary html input, simply replace the url method with html:

Browsershot::html(‘<h1>Hello world!!</h1>’)->save(‘example.pdf’);

If your HTML input is already in a file locally use the :

Browsershot::htmlFromFilePath(‘/local/path/to/file.html’)->save(‘example.pdf’);

Browsershot also can get the body of an html page after JavaScript has been executed:

Browsershot::url(‘https://example.com’)->bodyHtml(); // returns the html of the body

If you wish to retrieve an array list with all of the requests that the page triggered you can do so:

$requests = Browsershot::url(‘https://example.com’) ->triggeredRequests();

foreach ($requests as $request) { $url = $request[‘url’]; //https://example.com/ }

Support us

Learn how to create a package like this one, by watching our premium video course:

We invest a lot of resources into creating best in class open source packages. You can support us by buying one of our paid products.

We highly appreciate you sending us a postcard from your hometown, mentioning which of our package(s) you are using. You’ll find our address on our contact page. We publish all received postcards on our virtual postcard wall.

Documentation

All documentation is available on our documentation site.

Contributing

Please see CONTRIBUTING for details.

Security

If you’ve found a bug regarding security please mail [email protected] instead of using the issue tracker.

Alternatives

If you’re not able to install Node and Puppeteer, take a look at v2 of browsershot, which uses Chrome headless CLI to take a screenshot. v2 is not maintained anymore, but should work pretty well.

If using headless Chrome does not work for you take a look at at v1 of this package which uses the abandoned PhantomJS binary.

Credits

  • Freek Van der Herten
  • All Contributors

And a special thanks to Caneco for the logo ✨

License

The MIT License (MIT). Please see License File for more information.

Related news

GHSA-8c2c-jxwj-jqgf: Browsershot does not validate URL protocols passed to Browsershot URL method

Browsershot version 3.57.2 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the URL protocol passed to the Browsershot::url method.

CVE: Latest News

CVE-2023-50976: Transactions API Authorization by oleiman · Pull Request #14969 · redpanda-data/redpanda
CVE-2023-6905
CVE-2023-6903
CVE-2023-6904
CVE-2023-3907