@@ -19,14 +19,16 @@ if ($format =~ /^markdown\+$/) {
1919}
2020
2121# Validate URL and format
22−unless ($url =~ /^(https?:\/\/)?[\w#?_-]+(\.[\w#?_-]+)+[\w\/#?_.-]*$/) {
22+unless ($url =~ /^(https?:\/\/)?[\w#_-]+(\.[\w#_-]+)+[\w\/#=?_.-]*$/) {
2323 die "Illegal URL: $url\n" ;
2424}
2525unless ($format =~ /^markdown\+?|rst|latex|context|rtf|man|docbook$/) {
2626 die "Illegal format: $format\n";
2727}
2828
29−my $output = `wget -O- $url | tidy -asxhtml -utf8 | pandoc -w $format $options`;
29+# Note - pass through head to truncate file to 100K if greater.
30+# This should prevent certain kinds of DoS attacks.
31+my $output = `wget -O- $url | head -c100000 | tidy -asxhtml -utf8 | pandoc -w $format $options`;
3032if ($output =~ /^\s*$/) {
3133 print start_html,
3234 h1("No output"),