do not allow file urls

Author: freekmurze

src/Browsershot.php

@@ -4,6 +4,7 @@
 
 use Spatie\Browsershot\Exceptions\CouldNotTakeBrowsershot;
 use Spatie\Browsershot\Exceptions\ElementNotFound;
+use Spatie\Browsershot\Exceptions\FileUrlNotAllowed;
 use Spatie\Browsershot\Exceptions\UnsuccessfulResponse;
 use Spatie\Image\Image;
 use Spatie\Image\Manipulations;
@@ -235,6 +236,10 @@ public function waitForFunction(string $function, $polling = self::POLLING_REQUE
 
     public function setUrl(string $url)
     {
+        if (Helpers::stringStartsWith(strtolower($url), 'file://')) {
+            throw FileUrlNotAllowed::make();
+        }
+
         $this->url = $url;
         $this->html = '';
 

src/Exceptions/FileUrlNotAllowed.php

@@ -0,0 +1,13 @@
+<?php
+
+namespace Spatie\Browsershot\Exceptions;
+
+use Exception;
+
+class FileUrlNotAllowed extends Exception
+{
+    public static function make()
+    {
+        return new static("An URL is not allow to start with file://");
+    }
+}

src/Helpers.php

@@ -0,0 +1,13 @@
+<?php
+
+namespace Spatie\Browsershot;
+
+class Helpers
+{
+    public static function stringStartsWith($haystack, $needle): bool
+    {
+        $length = strlen($needle);
+
+        return substr( $haystack, 0, $length ) === $needle;
+    }
+}

tests/BrowsershotTest.php

@@ -3,6 +3,7 @@
 use Spatie\Browsershot\Browsershot;
 use Spatie\Browsershot\Exceptions\CouldNotTakeBrowsershot;
 use Spatie\Browsershot\Exceptions\ElementNotFound;
+use Spatie\Browsershot\Exceptions\FileUrlNotAllowed;
 use Spatie\Browsershot\Exceptions\UnsuccessfulResponse;
 use Spatie\Image\Manipulations;
 use Symfony\Component\Process\Exception\ProcessFailedException;
@@ -38,6 +39,10 @@
     );
 });
 
+it('will not allow a file url', function () {
+    Browsershot::url('file://test');
+})->throws(FileUrlNotAllowed::class);
+
 it('can take a screenshot', function () {
     $targetPath = __DIR__.'/temp/testScreenshot.png';
 

tests/HelpersTest.php

@@ -0,0 +1,12 @@
+<?php
+
+use Spatie\Browsershot\Helpers;
+
+it('can determine if a string starts with a substring', function(string $haystack, $needle, $expectedResult) {
+    expect(Helpers::stringStartsWith($haystack, $needle))->toBe($expectedResult);
+})->with([
+    ['https://spatie.be', 'https://', true],
+    ['http://spatie.be', 'https://', false],
+    ['file://hey', 'file://', true],
+    ['https://spatie.be', 'file://', false],
+]);