Command Injection in pdfkit >=0.0.0 (CVE-2022-25765)

[denzelem]

Version 0.0.0 to 0.8.6, which is the most recent version of PDFKit when writing this issue, are affected by a command injection vulnerability. More details about the vulnerability can be found in https://security.snyk.io/vuln/SNYK-RUBY-PDFKIT-2869795.

This issue might be updated by the maintainers of this project once the vulnerability is fixed and released.

Vulnerable code

pdfkit/lib/pdfkit/source.rb

Lines 44 to 50 in 46cdf53

	def shell_safe_url
	url_needs_escaping? ? URI::DEFAULT_PARSER.escape(@source) : @source
	end
	def url_needs_escaping?
	URI::DEFAULT_PARSER.unescape(@source) == @source
	end

[serene]

Resolved by #509.