Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

added 'text:' image format specifier #1

Open
wants to merge 2 commits into
base: master
Choose a base branch
from

Conversation

l4yton
Copy link

@l4yton l4yton commented Jul 1, 2020

No description provided.

@allanlw
Copy link
Owner

allanlw commented Jul 1, 2020

That's insane! Awesome, thank you!

There's a typo in your example, but this one worked for me with convert test.svg test.png:

<svg width="800" height="800">
  <image width="800" height="800" href="text:/etc/passwd"/>
</svg>

I guess I put a note at the top that says:

All of these methods specify a URI, which can be absolute or relative. File and HTTP protocol are important to test, but it could also support other protocols depending on the implementation (e.g. PHP stream schemes), including javascript: and data:.

But perhaps it'd be better to have a section for schemes like this, especially because ImageMagick seems much more relevant than PHP stuff.

@l4yton
Copy link
Author

l4yton commented Jul 2, 2020

I guess putting the note on top would make sense, but I'm not sure about having an extra section for this. I've only found text: to be a useful scheme in exploitation and being SVG/ImageMagick specific. If there are more, I guess it would make sense though.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants