diff --git a/index.js b/index.js index 4fa6231..2740e31 100644 --- a/index.js +++ b/index.js @@ -8,6 +8,13 @@ var util = require("util"); var exec = require("child_process").exec; function PDFImage(pdfFilePath, options) { + // validating the file path for invalid characters to prevent remote code execution + var filter_chars = /[!";|`$()&<>]/; + if (filter_chars.test(pdfFilePath)) { + console.log("\nERROR: The file path contains invalid characters\n"); + return; + } + if (!options) options = {}; this.pdfFilePath = pdfFilePath;