{"action":"created","issue":{"url":"https://api.github.com/repos/pdfkit/pdfkit/issues/312","labels_url":"https://api.github.com/repos/pdfkit/pdfkit/issues/312/labels{/name}","comments_url":"https://api.github.com/repos/pdfkit/pdfkit/issues/312/comments","events_url":"https://api.github.com/repos/pdfkit/pdfkit/issues/312/events","html_url":"https://github.com/pdfkit/pdfkit/pull/312","id":93411775,"number":312,"title":"Do not shellescape URLs since it borks params ","user":{"login":"cdwort","id":1014482,"avatar_url":"https://avatars.githubusercontent.com/u/1014482?v=3","gravatar_id":"","url":"https://api.github.com/users/cdwort","html_url":"https://github.com/cdwort","followers_url":"https://api.github.com/users/cdwort/followers","following_url":"https://api.github.com/users/cdwort/following{/other_user}","gists_url":"https://api.github.com/users/cdwort/gists{/gist_id}","starred_url":"https://api.github.com/users/cdwort/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cdwort/subscriptions","organizations_url":"https://api.github.com/users/cdwort/orgs","repos_url":"https://api.github.com/users/cdwort/repos","events_url":"https://api.github.com/users/cdwort/events{/privacy}","received_events_url":"https://api.github.com/users/cdwort/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/pdfkit/pdfkit/labels/ready","name":"ready","color":"00c5fe"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2015-07-07T01:06:55Z","updated_at":"2015-07-07T01:38:05Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/pdfkit/pdfkit/pulls/312","html_url":"https://github.com/pdfkit/pdfkit/pull/312","diff_url":"https://github.com/pdfkit/pdfkit/pull/312.diff","patch_url":"https://github.com/pdfkit/pdfkit/pull/312.patch"},"body":"Fixes #166\r\n\r\nCurrent Functionality (master):\r\n\r\n```\r\n>> PDFKit.new('https://www.google.com/search?q=pdfkit').command\r\nwkhtmltopdf ... https://www.google.com/search\\\\?q\\\\=pdfkit\r\n```\r\n\r\nNew Functionality (this PR):\r\n\r\n```\r\n>> PDFKit.new('https://www.google.com/search?q=pdfkit').command\r\nwkhtmltopdf ... https://www.google.com/search?q=pdfkit\r\n```\r\n\r\nTo accomplish this, this PR walks back some security measures implemented in #164.\r\n* We no longer escape URLs\r\n* We no longer escape HTML coming through middleware.\r\n\r\nI don't know enough about bash exploits, so forgive the poor examples below.\r\n\r\nThis would impact those using PDFKit who allow raw user input in the URL (e.g. `www.mysite.com/echo /etc/passwd`) or in the HTML (e.g. `\"<p>Your PDF Content: echo /etc/passwd</p>\"` ).\r\n\r\nOn the other hand, I think we need to support query parameters. So, unless someone sees a better this solution, I'd say let's fix this."},"comment":{"url":"https://api.github.com/repos/pdfkit/pdfkit/issues/comments/119042506","html_url":"https://github.com/pdfkit/pdfkit/pull/312#issuecomment-119042506","issue_url":"https://api.github.com/repos/pdfkit/pdfkit/issues/312","id":119042506,"user":{"login":"sigmavirus24","id":240830,"avatar_url":"https://avatars.githubusercontent.com/u/240830?v=3","gravatar_id":"","url":"https://api.github.com/users/sigmavirus24","html_url":"https://github.com/sigmavirus24","followers_url":"https://api.github.com/users/sigmavirus24/followers","following_url":"https://api.github.com/users/sigmavirus24/following{/other_user}","gists_url":"https://api.github.com/users/sigmavirus24/gists{/gist_id}","starred_url":"https://api.github.com/users/sigmavirus24/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sigmavirus24/subscriptions","organizations_url":"https://api.github.com/users/sigmavirus24/orgs","repos_url":"https://api.github.com/users/sigmavirus24/repos","events_url":"https://api.github.com/users/sigmavirus24/events{/privacy}","received_events_url":"https://api.github.com/users/sigmavirus24/received_events","type":"User","site_admin":false},"created_at":"2015-07-07T01:38:05Z","updated_at":"2015-07-07T01:38:05Z","body":"Spaces are always encoded in a URI as either `%20` or `+` so that gives us some assurances that we won't be subject to shell injection attacks. That said, I'd like @wuest's opinion too since she has a far more keen mind for this stuff than I do."}}