0.5.3 cannot handle windows paths with spaces

[damphyr]

wkhtmltopdf on Windows by default installs itself under C:\Program Files\wkhtmltopdf

Using the config block to point to this path results in an error when the command is put together because it needs "" around the command.

When I set the config option as '"c:/Program Files/wkhtmltopdf/wkhtmltopdf.exe"' then the File.exists? check on line 31 fails. Leaving it empty bombs out because of the use of 'which' to find the correct command and various other combinations ended up in bitter failure.

0.5.2 works.

[damphyr]

Test and patch once I get off work, unless this has already been solved

[damphyr]

This gist allows you to reproduce the error with 0.5.3

[sigmavirus24]

@damphyr is this fixed in 0.5.4? If not could you try reverting the change on this line to see if it fixes it?

[jdearl]

Reverting from 0.5.4 to 0.5.2 worked for me, and also fixed not being able to have spaces in options like :header_center => "Document #{number}".

[sigmavirus24]

So the issue arises from the usage of Array#shelljoin (provided by shellwords).

1.9.3-p448 :001 > require 'shellwords'
 => true
1.9.3-p448 :002 > p = ["C:/Program Files/ruby/ruby.exe", "foo"]
 => ["C:/Program Files/ruby/ruby.exe", "foo"]
1.9.3-p448 :003 > p.shelljoin
 => "C:/Program\\ Files/ruby/ruby.exe foo"

The problem is that not using Array#shelljoin results in a vulnerability. It's clear (to me) that the problem here is the fact that the path to wkhtmltopdf has a space which then becomes c:/Program\ Files/wkhtmltopdf/wkhtmltopdf. The first exception you're seeing @damphyr is not coming from File.exists? It comes from popen not being able to find the executable at this new path. (File.exists? works because it checks the path before it has the \ inserted.)

One solution to this is to exclude the path for wkhtmltopdf from the array when using Array#shelljoin. This will prevent the \ from being inserted. I'm just curious if there are reasons why this behaviour might actually be desirable though because I'd like to prevent PDFKit from generating another CVE.