Whitelist PDF context options (#5924)

src/Pdf/MPdfConverter.php

@@ -120,6 +120,19 @@ final class MPdfConverter implements HtmlToPdfConverter
         $mpdf->creator = Constants::SOFTWARE;
 
         if (\count($associatedFiles) > 0) {
+            // remove "path" so mPDF will not use file_get_contents() on local files
+            // callers must pre-read and pass the bytes via "content"
+            $associatedFiles = array_map(static function ($entry): array {
+                if (!\is_array($entry)) {
+                    return [];
+                }
+
+                if (\array_key_exists('path', $entry)) {
+                    unset($entry['path']);
+                }
+
+                return $entry;
+            }, $associatedFiles);
             $mpdf->SetAssociatedFiles($associatedFiles);
         }
 

src/Pdf/PdfContext.php

@@ -15,10 +15,27 @@ namespace App\Pdf;
  */
 final class PdfContext
 {
+    /**
+     * Keys that may be set from inside a (sandboxed) Twig template.
+     *
+     * Sinks that read the local filesystem inside mPDF (e.g. `associated_files`
+     * with a `path` entry, or `additional_xmp_rdf`) must NOT appear here. Those
+     * remain reachable via InvoiceModel::setOption() from PHP code.
+     */
+    private const ALLOWED_KEYS = [
+        'filename', 'mode', 'format', 'orientation', 'default_font', 'default_font_size', 'fonts',
+        'margin_left', 'margin_right', 'margin_top', 'margin_bottom', 'margin_header', 'margin_footer',
+        'setAutoTopMargin', 'setAutoBottomMargin', 'PDFA', 'PDFAauto', 'useActiveForms',
+    ];
+
     private array $options = [];
 
     public function setOption(string $key, string|int|array|null|bool $value): void
     {
+        if (!\in_array($key, self::ALLOWED_KEYS, true)) {
+            return;
+        }
+
         $this->options[$key] = $value;
     }