False positive "The specified HTML contains file:// or file:/. This is not allowed" exception

[IVoyt]

Browsershot v5.0.5

I have some styles in my html and the substring .box-file:hover results into false positive trigger exception

[nelo-digitalagentur]

I just ran into this because in the text of a generated PDF document there was a phrase like "visit our profile: www.face..."

[nelo-digitalagentur]

For now our solution was to extend the Browsershot class and rewrite the setHtml method like this...

class Browsershot extends \Spatie\Browsershot\Browsershot
{
    public function setHtml(string $html): static
    {
        $unsafeProtocols = $this->unsafeProtocols;
        // remove 'file:' from the list of unsafe protocols
        $unsafeProtocols = array_filter($unsafeProtocols, fn ($protocol) => $protocol !== 'file:');

        foreach ($unsafeProtocols as $protocol) {
            if (str_contains(strtolower($html), $protocol)) {
                throw HtmlIsNotAllowedToContainFile::make();
            }
        }

        $this->html = $html;
        $this->url = '';

        $this->hideBrowserHeaderAndFooter();

        return $this;
    }
}

[BoGnY]

Another workaround is to use symplify/vendor-patches package.. I used this because I already use it for modify other packages.

However, PR #911 fix this but is unmerged..

[BoGnY]

I have the same problem.. Using axios or tailwind css broke browsershot and make pdf generation unusable... file: must be removed from unsafe protocols

[freekmurze]

I'll remove file: for now, and will look for another way to fix the security issue