Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Certain text in the summaries can cause latex tools to error out. #33

Open
ghost opened this issue Nov 26, 2019 · 1 comment
Open

Certain text in the summaries can cause latex tools to error out. #33

ghost opened this issue Nov 26, 2019 · 1 comment

Comments

@ghost
Copy link

ghost commented Nov 26, 2019

This sequence in the report*.tex file:
\begin{tabular}{|p{16cm}|}\rowcolor[HTML]{F8A102} \begin{tabular}{@{}p{15cm}>{\raggedleft\arraybackslash}
p{0.5cm}@{}}\textbf{CVE-2019-9947 Medium (4.3)} & \href{https://nvd.nist.gov/vuln/detail/CVE-2019-9947}{\large \faicon{link}}\end{tabular}\
Summary:An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the path component of a URL that lacks a ? character) followed by an HTTP header or a Redis command. This is similar to the CVE-2019-9740 query string issue.\ \hline \end{tabular} \end{figure}

causes pdflatex to error out with this:
! Undefined control sequence.
\n

l.425 ...ument to urllib.request.urlopen with \r\n
(specifically in the path...

Obviously, it's interpreting the text in the summary as an attempted control sequence. Given that you're effectively pulling those from outside sources, it seems like you're going to need to do some escaping before dropping them into the tex output.

@marius-udubasa
Copy link

I was able to have a quick pdf quality result by just pasting the tex file content (you can import the file too) into the online tool from here https://www.overleaf.com/ and then using Recompile and pdf download

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant