pdfkit 0.8.0 → 0.8.7.1

data/lib/pdfkit/pdfkit.rb

@@ -1,61 +1,74 @@
+# frozen_string_literal: true
+
 require 'shellwords'
+require 'tempfile'
 
 class PDFKit
-  class NoExecutableError < StandardError
+  class Error < StandardError; end
+
+  class NoExecutableError < Error
     def initialize
-      msg  = "No wkhtmltopdf executable found at #{PDFKit.configuration.wkhtmltopdf}\n"
-      msg << ">> Please install wkhtmltopdf - https://github.com/pdfkit/PDFKit/wiki/Installing-WKHTMLTOPDF"
+      msg = "No wkhtmltopdf executable found at #{PDFKit.configuration.wkhtmltopdf}\n" \
+            ">> Please install wkhtmltopdf - https://github.com/pdfkit/PDFKit/wiki/Installing-WKHTMLTOPDF"
       super(msg)
     end
   end
 
-  class ImproperSourceError < StandardError
+  class ImproperSourceError < Error
     def initialize(msg)
       super("Improper Source: #{msg}")
     end
   end
 
+  class ImproperWkhtmltopdfExitStatus < Error
+    def initialize(invoke)
+      super("Command failed (exitstatus=#{$?.exitstatus}): #{invoke}")
+    end
+  end
+
   attr_accessor :source, :stylesheets
-  attr_reader :options
+  attr_reader :renderer
 
   def initialize(url_file_or_html, options = {})
     @source = Source.new(url_file_or_html)
 
     @stylesheets = []
 
-    @options = PDFKit.configuration.default_options.merge(options)
-    @options.delete(:quiet) if PDFKit.configuration.verbose?
-    @options.merge! find_options_in_meta(url_file_or_html) unless source.url?
-    @options = normalize_options(@options)
+    options = PDFKit.configuration.default_options.merge(options)
+    options.delete(:quiet) if PDFKit.configuration.verbose?
+    options.merge! find_options_in_meta(url_file_or_html) unless source.url?
+    @root_url = options.delete(:root_url)
+    @protocol = options.delete(:protocol)
+    @renderer = WkHTMLtoPDF.new options
+    @renderer.normalize_options
 
-    raise NoExecutableError.new unless File.exists?(PDFKit.configuration.wkhtmltopdf)
+    raise NoExecutableError unless File.exist?(PDFKit.configuration.wkhtmltopdf)
   end
 
   def command(path = nil)
-    args = @options.to_a.flatten.compact
+    args = @renderer.options_for_command
+    shell_escaped_command = [executable, OS::shell_escape_for_os(args)].join ' '
 
-    if @source.html?
-      args << '-' # Get HTML from stdin
-    else
-      args << @source.to_s
-    end
+    # In order to allow for URL parameters (e.g. https://www.google.com/search?q=pdfkit) we do
+    # not escape the source. The user is responsible for ensuring that no vulnerabilities exist
+    # in the source. Please see https://github.com/pdfkit/pdfkit/issues/164.
+    input_for_command = @source.to_input_for_command
+    output_for_command = path ? Shellwords.shellescape(path) : '-'
 
-    args << (path || '-') # Write to file or stdout
+    "#{shell_escaped_command} #{input_for_command} #{output_for_command}"
+  end
 
-    [executable, args.shelljoin].join ' '
+  def options
+    # TODO(cdwort,sigmavirus24): Replace this with an attr_reader for @renderer instead in 1.0.0
+    @renderer.options
   end
 
   def executable
-    default = PDFKit.configuration.wkhtmltopdf
-    return default if default !~ /^\// # its not a path, so nothing we can do
-    if File.exist?(default)
-      default
-    else
-      default.split('/').last
-    end
+    PDFKit.configuration.executable
   end
 
   def to_pdf(path=nil)
+    preprocess_html
     append_stylesheets
 
     invoke = command(path)
@@ -68,7 +81,7 @@ class PDFKit
 
     # $? is thread safe per
     # http://stackoverflow.com/questions/2164887/thread-safe-external-process-in-ruby-plus-checking-exitstatus
-    raise "command failed (exitstatus=#{$?.exitstatus}): #{invoke}" if empty_result?(path, result) or !successful?($?)
+    raise ImproperWkhtmltopdfExitStatus, invoke if empty_result?(path, result) || !successful?($?)
     return result
   end
 
@@ -79,14 +92,9 @@ class PDFKit
 
   protected
 
-  # Pulled from:
-  # https://github.com/wkhtmltopdf/wkhtmltopdf/blob/ebf9b6cfc4c58a31349fb94c568b254fac37b3d3/README_WKHTMLTOIMAGE#L27
-  REPEATABLE_OPTIONS = %w[--allow --cookie --custom-header --post --post-file --run-script]
-  SPECIAL_OPTIONS = %w[cover toc]
-
   def find_options_in_meta(content)
     # Read file if content is a File
-    content = content.read if content.is_a?(File)
+    content = content.read if content.is_a?(File) || content.is_a?(Tempfile)
 
     found = {}
     content.scan(/<meta [^>]*>/) do |meta|
@@ -108,80 +116,38 @@ class PDFKit
   end
 
   def style_tag_for(stylesheet)
-    "<style>#{File.read(stylesheet)}</style>"
+    style = "<style>#{File.read(stylesheet)}</style>"
+    style = style.html_safe if style.respond_to?(:html_safe)
+    style
+  end
+
+  def preprocess_html
+    if @source.html?
+      processed_html = PDFKit::HTMLPreprocessor.process(@source.to_s, @root_url, @protocol)
+      @source = Source.new(processed_html)
+    end
   end
 
   def append_stylesheets
-    raise ImproperSourceError.new('Stylesheets may only be added to an HTML source') if stylesheets.any? && !@source.html?
+    raise ImproperSourceError, 'Stylesheets may only be added to an HTML source' if stylesheets.any? && !@source.html?
 
     stylesheets.each do |stylesheet|
       if @source.to_s.match(/<\/head>/)
-        @source = Source.new(@source.to_s.gsub(/(<\/head>)/) {|s| style_tag_for(stylesheet) + s })
+        @source = Source.new(@source.to_s.gsub(/(<\/head>)/) {|s|
+          style_tag_for(stylesheet) + (s.respond_to?(:html_safe) ? s.html_safe : s)
+        })
       else
         @source.to_s.insert(0, style_tag_for(stylesheet))
       end
     end
   end
 
-  def normalize_options(options)
-    normalized_options = {}
-
-    options.each do |key, value|
-      next if !value
-
-      # The actual option for wkhtmltopdf
-      normalized_key = normalize_arg key
-      normalized_key = "--#{normalized_key}" unless SPECIAL_OPTIONS.include?(normalized_key)
-
-      # If the option is repeatable, attempt to normalize all values
-      if REPEATABLE_OPTIONS.include? normalized_key
-        normalize_repeatable_value(normalized_key, value) do |normalized_unique_key, normalized_value|
-          normalized_options[normalized_unique_key] = normalized_value
-        end
-      else # Otherwise, just normalize it like usual
-        normalized_options[normalized_key] = normalize_value(value)
-      end
-    end
-
-    normalized_options
-  end
-
-  def normalize_arg(arg)
-    arg.to_s.downcase.gsub(/[^a-z0-9]/,'-')
-  end
-
-  def normalize_value(value)
-    case value
-    when nil
-      nil
-    when TrueClass, 'true' #ie, ==true, see http://www.ruby-doc.org/core-1.9.3/TrueClass.html
-      nil
-    when Hash
-      value.to_a.flatten.collect{|x| normalize_value(x)}.compact
-    when Array
-      value.flatten.collect{|x| x.to_s}
-    else
-      value.to_s
-    end
-  end
-
-  def normalize_repeatable_value(option_name, value)
-    case value
-    when Hash, Array
-      value.each do |(key, val)|
-        yield [[option_name, normalize_value(key)], normalize_value(val)]
-      end
-    else
-      yield [[option_name, normalize_value(value)], nil]
-    end
-  end
-
   def successful?(status)
     return true if status.success?
 
     # Some of the codes: https://code.google.com/p/wkhtmltopdf/issues/detail?id=1088
     # returned when assets are missing (404): https://code.google.com/p/wkhtmltopdf/issues/detail?id=548
-    return true if status.exitstatus == 2 && error_handling?
+    return true if status.exitstatus == 2 && @renderer.error_handling?
 
     false
   end
@@ -189,11 +155,4 @@ class PDFKit
   def empty_result?(path, result)
     (path && File.size(path) == 0) || (path.nil? && result.to_s.strip.empty?)
   end
-
-  def error_handling?
-    @options.key?('--ignore-load-errors') ||
-      # wkhtmltopdf v0.10.0 beta4 replaces ignore-load-errors with load-error-handling
-      # https://code.google.com/p/wkhtmltopdf/issues/detail?id=55
-      %w(skip ignore).include?(@options['--load-error-handling'])
-  end
 end

data/lib/pdfkit/source.rb

@@ -1,23 +1,52 @@
+# frozen_string_literal: true
+
+require 'tempfile'
+require 'uri'
+
 class PDFKit
   class Source
+    SOURCE_FROM_STDIN = '-'
+
     def initialize(url_file_or_html)
       @source = url_file_or_html
+      # @source is assumed to be modifiable, so make sure it is.
+      @source = @source.dup if @source.is_a?(String) && @source.frozen?
     end
-    
+
     def url?
-      @source.is_a?(String) && @source.match(/\Ahttp/)
+      @is_url ||= @source.is_a?(String) && @source.match(/\Ahttp/)
     end
-    
+
     def file?
-      @source.kind_of?(File)
+      @is_file ||= @source.kind_of?(File) || @source.kind_of?(Tempfile)
     end
-    
+
     def html?
-      !(url? || file?)
+      @is_html ||= !(url? || file?)
     end
-    
+
+    def to_input_for_command
+      if file?
+        @source.path
+      elsif url?
+        %{"#{shell_safe_url}"}
+      else
+        SOURCE_FROM_STDIN
+      end
+    end
+
     def to_s
       file? ? @source.path : @source
     end
+
+    private
+
+    def shell_safe_url
+      url_needs_escaping? ? URI::DEFAULT_PARSER.escape(@source) : @source
+    end
+
+    def url_needs_escaping?
+      URI::DEFAULT_PARSER.escape(URI::DEFAULT_PARSER.unescape(@source)) != @source
+    end
   end
 end

data/lib/pdfkit/version.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 class PDFKit
-  VERSION = "0.8.0"
+  VERSION = '0.8.7.1'
 end

data/lib/pdfkit/wkhtmltopdf.rb

@@ -0,0 +1,82 @@
+# frozen_string_literal: true
+
+class PDFKit
+  class WkHTMLtoPDF
+    attr_reader :options
+    # Pulled from:
+    # https://github.com/wkhtmltopdf/wkhtmltopdf/blob/ebf9b6cfc4c58a31349fb94c568b254fac37b3d3/README_WKHTMLTOIMAGE#L27
+    REPEATABLE_OPTIONS = %w[--allow --cookie --custom-header --post --post-file --run-script].freeze
+    SPECIAL_OPTIONS = %w[cover toc].freeze
+
+    def initialize(options)
+      @options = options
+    end
+  
+    def normalize_options
+      # TODO(cdwort,sigmavirus24): Make this method idempotent in a future release so it can be called repeatedly
+      normalized_options = {}
+  
+      @options.each do |key, value|
+        next if !value
+  
+        # The actual option for wkhtmltopdf
+        normalized_key = normalize_arg key
+        normalized_key = "--#{normalized_key}" unless SPECIAL_OPTIONS.include?(normalized_key)
+  
+        # If the option is repeatable, attempt to normalize all values
+        if REPEATABLE_OPTIONS.include? normalized_key
+          normalize_repeatable_value(normalized_key, value) do |normalized_unique_key, normalized_value|
+            normalized_options[normalized_unique_key] = normalized_value
+          end
+        else # Otherwise, just normalize it like usual
+          normalized_options[normalized_key] = normalize_value(value)
+        end
+      end
+  
+      @options = normalized_options
+    end
+
+    def error_handling?
+      @options.key?('--ignore-load-errors') ||
+        # wkhtmltopdf v0.10.0 beta4 replaces ignore-load-errors with load-error-handling
+        # https://code.google.com/p/wkhtmltopdf/issues/detail?id=55
+        %w(skip ignore).include?(@options['--load-error-handling'])
+    end
+
+    def options_for_command
+      @options.to_a.flatten.compact
+    end
+  
+    private
+  
+    def normalize_arg(arg)
+      arg.to_s.downcase.gsub(/[^a-z0-9]/,'-')
+    end
+  
+    def normalize_value(value)
+      case value
+      when nil
+        nil
+      when TrueClass, 'true' #ie, ==true, see http://www.ruby-doc.org/core-1.9.3/TrueClass.html
+        nil
+      when Hash
+        value.to_a.flatten.collect{|x| normalize_value(x)}.compact
+      when Array
+        value.flatten.collect{|x| x.to_s}
+      else
+        (OS::host_is_windows? && value.to_s.index(' ')) ? "'#{ value.to_s }'" : value.to_s
+      end
+    end
+  
+    def normalize_repeatable_value(option_name, value)
+      case value
+      when Hash, Array
+        value.each do |(key, val)|
+          yield [[option_name, normalize_value(key)], normalize_value(val)]
+        end
+      else
+        yield [[option_name, normalize_value(value)], nil]
+      end
+    end
+  end
+end

data/lib/pdfkit.rb

@@ -1,4 +1,10 @@
+# frozen_string_literal: true
+
 require 'pdfkit/source'
 require 'pdfkit/pdfkit'
 require 'pdfkit/middleware'
+require 'pdfkit/html_preprocessor'
+require 'pdfkit/os'
 require 'pdfkit/configuration'
+require 'pdfkit/wkhtmltopdf'
+require 'pdfkit/version'

data/pdfkit.gemspec

@@ -11,20 +11,22 @@ Gem::Specification.new do |s|
   s.homepage    = "https://github.com/pdfkit/pdfkit"
   s.summary     = "HTML+CSS -> PDF"
   s.description = "Uses wkhtmltopdf to create PDFs using HTML"
-
-  s.rubyforge_project = "pdfkit"
+  s.license     = "MIT"
 
   s.files         = `git ls-files`.split("\n")
   s.test_files    = `git ls-files -- {test,spec,features}/*`.split("\n")
   s.executables   = `git ls-files -- bin/*`.split("\n").map{ |f| File.basename(f) }
   s.require_paths = ["lib"]
 
-  # Developmnet Dependencies
-  s.add_development_dependency(%q<activesupport>, [">= 3.0.8"])
+  s.required_ruby_version = ">= 2.5"
+
+  s.requirements << "wkhtmltopdf"
+
+  # Development Dependencies
+  s.add_development_dependency(%q<activesupport>, [">= 4.1.11"])
   s.add_development_dependency(%q<mocha>, [">= 0.9.10"])
   s.add_development_dependency(%q<rack-test>, [">= 0.5.6"])
-  s.add_development_dependency(%q<i18n>, ["~>0.6.11"]) # Ruby 1.9.2 compatibility
-  s.add_development_dependency(%q<rake>, ["~>0.9.2"])
-  s.add_development_dependency(%q<rdoc>, ["~> 4.0.1"])
+  s.add_development_dependency(%q<rake>, [">= 12.3.3"])
+  s.add_development_dependency(%q<rdoc>, [">= 4.0.1"])
   s.add_development_dependency(%q<rspec>, ["~> 3.0"])
 end

data/spec/configuration_spec.rb

@@ -1,28 +1,78 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe PDFKit::Configuration do
   subject { PDFKit::Configuration.new }
   describe "#wkhtmltopdf" do
-    it "can be configured" do
-      subject.wkhtmltopdf = '/my/bin/wkhtmltopdf'
-      expect(subject.wkhtmltopdf).to eql '/my/bin/wkhtmltopdf'
-    end
+    context "when explicitly configured" do
+      it "uses configured value and don't detect" do
+        expect(subject).not_to receive(:default_wkhtmltopdf)
+        subject.wkhtmltopdf = "./Gemfile" # Need a file which exists
+        expect(subject.wkhtmltopdf).to eq("./Gemfile")
+      end
 
-    # This test documents existing functionality. Feel free to fix.
-    it "can be poorly configured" do
-      subject.wkhtmltopdf = 1234
-      expect(subject.wkhtmltopdf).to eql 1234
+      it "falls back to detected binary if configured path doesn't exists" do
+        expect(subject).to receive(:default_wkhtmltopdf).twice.and_return("/bin/fallback")
+        expect(subject).to receive(:warn).with(/No executable found/)
+        subject.wkhtmltopdf = "./missing-file" # Need a file which doesn't exist
+        expect(subject.wkhtmltopdf).to eq("/bin/fallback")
+      end
     end
 
     context "when not explicitly configured" do
-      it "detects the existance of bundler" do
-        # Test assumes bundler is installed in your test environment
-        expect(subject).to receive(:`).with('bundle exec which wkhtmltopdf').and_return('c:\windows\path.exe')
-        subject.wkhtmltopdf
+      context "when running inside bundler" do
+        # Simulate the presence of bundler even if it's not here
+        before { stub_const("Bundler::GemfileError", Class) }
+
+        it "detects the existance of bundler" do
+          expect(subject).to receive(:`).with('bundle exec which wkhtmltopdf').and_return("c:\\windows\\path.exe\n")
+          expect(subject.wkhtmltopdf).to eq('c:\windows\path.exe')
+        end
+
+        it "falls back if bundler path fails" do
+          # This happens when there is a wrong (buggy) version of bundler for example
+          expect(subject).to receive(:`).with('bundle exec which wkhtmltopdf').and_return("")
+          expect(subject).to receive(:`).with('which wkhtmltopdf').and_return("c:\\windows\\path.exe\n")
+          expect(subject.wkhtmltopdf).to eq('c:\windows\path.exe')
+        end
+
+        it "returns last line of 'bundle exec which' output" do
+          # Happens when the user does not have a HOME directory on their system and runs bundler < 2
+          expect(subject).to receive(:`).with('bundle exec which wkhtmltopdf').and_return(<<~EOT
+            `/home/myuser` is not a directory.
+            Bundler will use `/tmp/bundler/home/myuser' as your home directory temporarily.
+            /usr/bin/wkhtmltopdf
+          EOT
+          )
+          expect(subject.wkhtmltopdf).to eq('/usr/bin/wkhtmltopdf')
+        end
+      end
+
+      context "when running without bundler" do
+        # Simulate the absence of bundler even if it's there
+        before { hide_const("Bundler::GemfileError") }
+
+        it "detects the existance of bundler" do
+          expect(subject).not_to receive(:`).with('bundle exec which wkhtmltopdf')
+          expect(subject).to receive(:`).with('which wkhtmltopdf').and_return('c:\windows\path.exe')
+          expect(subject.wkhtmltopdf).to eq('c:\windows\path.exe')
+        end
       end
     end
   end
 
+  describe "#executable" do
+    it "returns wkhtmltopdf by default" do
+      expect(subject.executable).to eql subject.wkhtmltopdf
+    end
+
+    it "uses xvfb-run wrapper when option of using xvfb is configured" do
+      expect(subject).to receive(:using_xvfb?).and_return(true)
+      expect(subject.executable).to include 'xvfb-run'
+    end
+  end
+
   describe "#default_options" do
     it "sets defaults for the command options" do
       expect(subject.default_options[:disable_smart_shrinking]).to eql false
@@ -40,6 +90,13 @@ describe PDFKit::Configuration do
       expect(subject.default_options[:quiet]).to eql false
       expect(subject.default_options[:is_awesome]).to eql true
     end
+
+    it "merges additional options with existing defaults" do
+      subject.default_options = { quiet: false, is_awesome: true }
+      expect(subject.default_options[:quiet]).to eql false
+      expect(subject.default_options[:is_awesome]).to eql true
+      expect(subject.default_options[:disable_smart_shrinking]).to eql false
+    end
   end
 
   describe "#root_url" do
@@ -64,6 +121,22 @@ describe PDFKit::Configuration do
     end
   end
 
+  describe "#using_xvfb?" do
+    it "can be configured to true" do
+      subject.use_xvfb = true
+      expect(subject.using_xvfb?).to eql true
+    end
+
+    it "defaults to false" do
+      expect(subject.using_xvfb?).to eql false
+    end
+
+    it "can be configured to false" do
+      subject.use_xvfb = false
+      expect(subject.using_xvfb?).to eql false
+    end
+  end
+
   describe "#verbose?" do
     it "can be configured to true" do
       subject.verbose = true

data/spec/html_preprocessor_spec.rb

@@ -0,0 +1,71 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe PDFKit::HTMLPreprocessor do
+  describe "#process" do
+    let(:preprocessor) { PDFKit::HTMLPreprocessor }
+    let(:root_url) { 'http://example.com/' }  # This mirrors Middleware#root_url's response
+    let(:protocol) { 'http' }
+
+    it "correctly parses host-relative url with single quotes" do
+      original_body = %{<html><head><link href='/stylesheets/application.css' media='screen' rel='stylesheet' type='text/css' /></head><body><img alt='test' src="/test.png" /></body></html>}
+      body = preprocessor.process original_body, root_url, protocol
+      expect(body).to eq("<html><head><link href='http://example.com/stylesheets/application.css' media='screen' rel='stylesheet' type='text/css' /></head><body><img alt='test' src=\"http://example.com/test.png\" /></body></html>")
+    end
+
+    it "correctly parses host-relative url with double quotes" do
+      original_body = %{<link href="/stylesheets/application.css" media="screen" rel="stylesheet" type="text/css" />}
+      body = preprocessor.process original_body, root_url, protocol
+      expect(body).to eq("<link href=\"http://example.com/stylesheets/application.css\" media=\"screen\" rel=\"stylesheet\" type=\"text/css\" />")
+    end
+
+    it "correctly parses protocol-relative url with single quotes" do
+      original_body = %{<link href='//fonts.googleapis.com/css?family=Open+Sans:400,600' rel='stylesheet' type='text/css'>}
+      body = preprocessor.process original_body, root_url, protocol
+      expect(body).to eq("<link href='http://fonts.googleapis.com/css?family=Open+Sans:400,600' rel='stylesheet' type='text/css'>")
+    end
+
+    it "correctly parses protocol-relative url with double quotes" do
+      original_body = %{<link href="//fonts.googleapis.com/css?family=Open+Sans:400,600" rel='stylesheet' type='text/css'>}
+      body = preprocessor.process original_body, root_url, protocol
+      expect(body).to eq("<link href=\"http://fonts.googleapis.com/css?family=Open+Sans:400,600\" rel='stylesheet' type='text/css'>")
+    end
+
+    it "correctly parses multiple tags where first one is root url" do
+      original_body = %{<a href='/'><img src='/logo.jpg' ></a>}
+      body = preprocessor.process original_body, root_url, protocol
+      expect(body).to eq "<a href='http://example.com/'><img src='http://example.com/logo.jpg' ></a>"
+    end
+
+    it "returns the body even if there are no valid substitutions found" do
+      original_body = "NO MATCH"
+      body = preprocessor.process original_body, root_url, protocol
+      expect(body).to eq("NO MATCH")
+    end
+
+    context 'when root_url is nil' do
+      it "returns the body safely, without interpolating" do
+        original_body = %{<link href='//fonts.googleapis.com/css?family=Open+Sans:400,600' rel='stylesheet' type='text/css'><a href='/'><img src='/logo.jpg'></a>}
+        body = preprocessor.process original_body, nil, protocol
+        expect(body).to eq(%{<link href='http://fonts.googleapis.com/css?family=Open+Sans:400,600' rel='stylesheet' type='text/css'><a href='/'><img src='/logo.jpg'></a>})
+      end
+    end
+
+    context 'when protocol is nil' do
+      it "returns the body safely, without interpolating" do
+        original_body = %{<link href='//fonts.googleapis.com/css?family=Open+Sans:400,600' rel='stylesheet' type='text/css'><a href='/'><img src='/logo.jpg'></a>}
+        body = preprocessor.process original_body, root_url, nil
+        expect(body).to eq(%{<link href='//fonts.googleapis.com/css?family=Open+Sans:400,600' rel='stylesheet' type='text/css'><a href='http://example.com/'><img src='http://example.com/logo.jpg'></a>})
+      end
+    end
+
+    context 'when root_url and protocol are both nil' do
+      it "returns the body safely, without interpolating" do
+        original_body = %{<link href='//fonts.googleapis.com/css?family=Open+Sans:400,600' rel='stylesheet' type='text/css'><a href='/'><img src='/logo.jpg'></a>}
+        body = preprocessor.process original_body, nil, nil
+        expect(body).to eq original_body
+      end
+    end
+  end
+end