dedalozzo/pygmentize

Pygmentize is a wrapper to `pygmentize`, the command line interface provided by Pygments, a python syntax highlighter.

pygmentize's Issues

[Security] Remote Code Execution

$highlight = Pygmentize::highlight('<?php phpinfo();', ';uname -a #');
print_r($highlight);

This will produce the following output:

Darwin Micheals-MBP 16.1.0 Darwin Kernel Version 16.1.0: Thu Oct 13 21:26:57 PDT 2016; root:xnu-3789.21.3~60/RELEASE_X86_64 x86_64

The problem lines appear to be here: https://github.com/dedalozzo/pygmentize/blob/master/src/Pygmentize/Pygmentize.php#L48-L51

This particular issue can be resolved with escapeshellcmd:

$proc = proc_open(self::PIGMENTS_BINARY.escapeshellcmd($args), $dspec, $pipes);

Package not getting installed

I am trying to install this package.
I am getting these errors.

ERROR: Could not find a version that satisfies the requirement pygmentize==2.0 (from versions: none)
ERROR: No matching distribution found for pygmentize

I've looked this issue, but the problem there was absence of pygments.

If I issue the suggested command, I'm getting this result -

Requirement already satisfied: pygments in ./.local/lib/python3.6/site-packages (2.4.2)

I've also PHP installed. (version 7.2.19)

Having these dependencies installed also is not resulting in the successful installation.

Installation instructions for Windows

The installation instructions for pygmentize are written for Linux users but there is no information about how to install Composer or pygmentize on Windows, for example. This is a problem because pygmentize is required for the minted package in LaTeX, which is otherwise easily available on Windows except for its dependency on pygmentize.