Assigning it to samli@ (as an owner of rendertron)

In case it helps, these are some of the affected lines of the source:

LFI: 
https://github.com/GoogleChrome/rendertron/blob/master/src/main.js#L110
 https://github.com/GoogleChrome/rendertron/blob/master/src/main.js#L118
  https://github.com/GoogleChrome/rendertron/blob/master/src/renderer.js#L217-L221

XSS:
https://github.com/GoogleChrome/rendertron/blob/master/src/main.js#L105-L106
https://github.com/GoogleChrome/rendertron/blob/master/src/main.js#L129-L130

Also some possible fixes:
- Errors could be set to a more generic string (remove any variables / template strings)
- Filtering remote URL's on request may help

----------

Just caught a couple more issues, you may want to remove node_modules from being exposed, this can leak path information in installed package.json files.

Example: http://localhost:3000/node_modules/@google-cloud/common/package.json

Also noticed the route '/_ah/stop' is exposed allowing any user to stop the application.  Not sure if I would call this a DoS, but it effectively stops the service, and is available to any user.

Thanks for reporting these, I'll take a look as soon as I can.

If it's allowed, I'd be happy to contribute a PR towards some of these fixes!

PRs definitely welcome. I'll also be taking a look soon.

So I started on a PR for this, the description of the PR does not include any security information yet as this ticket view is not public yet.  Tried to keep the PR as general as possible, additionally contributing some style changes.

This is the PR on GitHub I've contributed to - https://github.com/GoogleChrome/rendertron/pull/88

The PR I've submitted covers the security checks I've tested for:
- 2 LFI on /screenshot & /render
- 2 XSS on /screenshot & /render
- DoS from /_ah/stop (stop now only works in development)
- Information Leak from /node_modules directory being overly exposed

It's important to note the tests will need to be changed for this.  They're currently failing locally and in CI because they rely on 'file://' for statusCode and shadow DOM tests.  The next step would be to setup a small mock server to test these against, this could be setup with a module such as nock.

P.S.:
It looks like someone else had also caught the XSS bug and submitted a fix, but this is not related or exposed from any work I've done so far - https://github.com/GoogleChrome/rendertron/pull/87

Hope this helps!

Fixed the tests to work in CI using the existing mock server as well as any small linting issues.

Thanks for the PR. I've added some comments with just some nits to fix up. #87 is redundant after your PR, correct?

Also unrelated, but do you have any opinion on this PR?
 https://github.com/GoogleChrome/rendertron/pull/80 

Thanks for the quick review on the PR, I'll push an update soon with those changes!

For #80, I'd probably disable it by default but expose the option to the developer or user with a warning. 

Also #87 would be redundant.

PR has been merged and deployed. Verified per repro steps in #1.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot