html to pdf using puppeteer

//npm init -y
//npm install --save puppeteer
//usage: node script.js /path/to/input.html /path/to/output.pdf


//script.js
const puppeteer = require('puppeteer');

(async () => {
  
  let fileinput = process.argv[2];
  let fileoutput = process.argv[3];
  const browser = await puppeteer.launch();
  const page = await browser.newPage();
  await page.goto('file:///${fileinput}', {waitUntil: 'networkidle'});
  await page.pdf({path: fileoutput, format: 'A4'});

  browser.close();
})();

Good note, @djm. Another kind of user-entered URL to avoid is http://localhost:port or http://127.x.x.x:port or others with a similar meaning. This can have unintended consequences including discovering and manipulating any services that may be running locally on the server or its network.

An example of a function that handles validating URLs in this way: https://github.com/WordPress/wordpress-develop/blob/4.9.8/src/wp-includes/http.php#L506-L582

And then there are IPv6 addresses to account for too...