From b25456835a412fdfca6b4f8706d495fb7773f433 Mon Sep 17 00:00:00 2001 From: Julien Neuhart Date: Fri, 5 Jun 2020 11:52:17 +0200 Subject: [PATCH] sanitizing filename parameter of toHTML function --- internal/pkg/printer/markdown.go | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/internal/pkg/printer/markdown.go b/internal/pkg/printer/markdown.go index 97f5d797..bbbeea7b 100644 --- a/internal/pkg/printer/markdown.go +++ b/internal/pkg/printer/markdown.go @@ -3,15 +3,14 @@ package printer import ( "bytes" "fmt" - "html/template" - "io/ioutil" - "path/filepath" - "github.com/microcosm-cc/bluemonday" "github.com/russross/blackfriday/v2" "github.com/thecodingmachine/gotenberg/internal/pkg/xerror" "github.com/thecodingmachine/gotenberg/internal/pkg/xlog" "github.com/thecodingmachine/gotenberg/internal/pkg/xrand" + "html/template" + "io/ioutil" + "path/filepath" ) // NewMarkdownPrinter returns a Printer which @@ -58,6 +57,7 @@ type templateData struct { func markdownToHTML(dirPath, filename string) (template.HTML, error) { const op string = "printer.markdownToHTML" + filename = filepath.Base(filename) fpath := fmt.Sprintf("%s/%s", dirPath, filename) b, err := ioutil.ReadFile(fpath) if err != nil {