wkhtmltopdf depends on insecure version of qtwebkit

[antifuchs]

I recently tried updating my nixpkgs to the 22.11 release, and that has failed to build with a pretty scary-sounding security warning:

Known issues:

• QtWebkit upstream is unmaintained and receives no security updates, see https://blogs.gnome.org/mcatanzaro/2022/[11](https://github.com/antifuchs/home/actions/runs/3625647463/jobs/6113911308#step:4:12)/04/stop-using-qtwebkit/

Looks like joex uses wkhtmltopdf, which in turn depends on qtwebkit from qt5, and that hasn't been updated in several years. It also seems that wkhtmltopdf isn't maintained either: wkhtmltopdf/wkhtmltopdf#5160.

Overall, this is a pretty unfortunate situation, especially because I know of no good alternative tool off-hand.

[eikek]

Yes that's right. It has been unmaintained for quite a while now. As of the latest version of docspell, you can use weasyprint instead, but the results are way poorer than wkhtmltopdf. The docker compose files use weasyprint as default now.

For now I personally don't care that much about the security concerns in wkhtmltopdf wrt how I use it on joex, so I will keep using it for now. FWIW docspell strips the input html a bit using this jsoup based whitelist. But of course, if there is a good alternative, I'd like to switch as well.

[antifuchs]

Ah, that makes sense - as docspell/joex is currently not installable on 22.11 due to this, would it make sense to adjust the module to use weasyprint instead, despite the lower quality?

[antifuchs]

(Oops, you can already customize what thing to use instead of wkhtmltopdf, with the joex.convert.wkhtmltopdf module. Oops.

[antifuchs]

For a more sustainable way to print to PDF, I hear these days, the way to do it is via headless chrome (there exist some node.js libraries out there) - https://blog.grio.com/2020/08/understanding-pdf-generation-with-headless-chrome.html has a blog post with some ideas on how to do this as a one-off script. Maybe it's time somebody wrote this as a real product, like wkhtmltopdf was.

[eikek]

Ah right, you can configure it currently by overwriting the settings for the wkhtmltopdf. But… it seems I forgot to add new settings regarding weasyprint 😅

Also thanks for the link using chromium. It looks interesting but can also be quite heavy maybe

[VTimofeenko]

@antifuchs do you happen to have a config with weasyprint instead of wkhtmltopdf?

The warning can be suppressed by adding qtwebengine as in the Docspell nix flake check here.

[antifuchs]

Thanks for the link, allowlisting the package does seem to work - but I would much rather just disable HTML conversion entirely (all my documents go into docspell as PDFs). I haven't been able to do so yet - it seems that whenever I override any attribute in the wkhtmltopdf attribute set, it invalidates all other attributes around it, for example:

error: attribute 'orcmypdf' missing

       at /nix/store/d4xhri3h3jbnm9ym3yn7jvdwgs2p0vgv-source/nix/modules/joex.nix:1370:25:

         1369|               });
         1370|               default = defaults.convert.orcmypdf;
             |                         ^
         1371|               description = ''
       Did you mean ocrmypdf?

[eikek]

@antifuchs I think you should be able to set wkhtmlpdf.command.program to something non-existing and this would cause html->pdf conversion to fail.

[VTimofeenko]

error: attribute 'orcmypdf' missing

Oh, this is a typo in the module. I created a PR to fix it.

[eikek]

error: attribute 'orcmypdf' missing

Oh, this is a typo in the module. I created a PR to fix it.

Thank you!