SSRF and file read with wkhtmltoimage

[filefox]

I found that if wkhtmltoimage convert a http status code 302 url,it may redirect to a local host and cut the image.

for example:

<?php
     header('location:http://127.0.0.1');
?>

put it on a outer website. wkhtmltoimage whill redirect to http://127.0.0.1 and get the image.
it will be a inner site sniffer.

it also can be a file read

<?php
     header('location:file:///tmp/1.txt');
?>

this url will redirect to a local file

i need set some options to fobidden redirect.

[ashkulz]

Try using --disable-local-file-access

[odoodeveloper]

@ashkulz could u please let me know the location for this --disable-local-file-access . how to access from command line.