Whitelist PDF context options (#5924)

tests/Pdf/MPdfConverterTest.php

@@ -37,4 +37,56 @@ class MPdfConverterTest extends KernelTestCase
         preg_match('/\/Creator \((.*)\)/', $result, $matches);
         self::assertCount(2, $matches);
     }
+
+    public function testAssociatedFilesPathIsStripped(): void
+    {
+        $kernel = self::bootKernel();
+        $cacheDir = $kernel->getContainer()->getParameter('kernel.cache_dir');
+
+        // Plant a sentinel on disk that an attacker would try to exfiltrate via
+        // mPDF's `SetAssociatedFiles`. The legitimate ZUGFeRD path uses
+        // `content` (pre-read bytes); we additionally pass `path` to confirm
+        // it is stripped before reaching mPDF.
+        $sentinelPath = tempnam(sys_get_temp_dir(), 'kimai-pdf-leak-');
+        self::assertNotFalse($sentinelPath);
+        $sentinelBytes = 'KIMAI_LEAK_SENTINEL_' . bin2hex(random_bytes(8));
+        file_put_contents($sentinelPath, $sentinelBytes);
+
+        $legitimateContent = 'KIMAI_LEGITIMATE_CONTENT_' . bin2hex(random_bytes(8));
+
+        try {
+            $sut = new MPdfConverter((new FileHelperFactory($this))->create(), $cacheDir);
+            $result = $sut->convertToPdf('<h1>Test</h1>', [
+                'associated_files' => [
+                    [
+                        'name' => 'attachment.txt',
+                        'mime' => 'text/plain',
+                        'description' => 'mixed entry',
+                        'AFRelationship' => 'Alternative',
+                        'path' => $sentinelPath,
+                        'content' => $legitimateContent,
+                    ],
+                ],
+            ]);
+        } finally {
+            @unlink($sentinelPath);
+        }
+
+        self::assertNotEmpty($result);
+
+        // Decompress every FlateDecode stream in the produced PDF. The
+        // sentinel must not appear; the explicitly-supplied `content` must.
+        $allDecompressed = '';
+        if (preg_match_all('/stream\r?\n(.*?)\r?\nendstream/s', $result, $streams) > 0) {
+            foreach ($streams[1] as $stream) {
+                $decoded = @gzuncompress($stream);
+                if ($decoded !== false) {
+                    $allDecompressed .= $decoded;
+                }
+            }
+        }
+        self::assertStringNotContainsString($sentinelBytes, $result);
+        self::assertStringNotContainsString($sentinelBytes, $allDecompressed);
+        self::assertStringContainsString($legitimateContent, $allDecompressed);
+    }
 }

tests/Pdf/PdfContextTest.php

@@ -25,12 +25,40 @@ class PdfContextTest extends TestCase
         self::assertNull($sut->getOption('unknown'));
     }
 
-    public function testSetterAndGetter(): void
+    public function testAllowedKeysRoundTrip(): void
     {
         $sut = new PdfContext();
 
-        self::assertNull($sut->getOption('unknown'));
+        $sut->setOption('margin_top', '12');
+        $sut->setOption('format', 'A4-P');
+        $sut->setOption('PDFA', true);
+        $sut->setOption('fonts', ['custom' => ['R' => 'custom.ttf']]);
+
+        self::assertEquals('12', $sut->getOption('margin_top'));
+        self::assertEquals('A4-P', $sut->getOption('format'));
+        self::assertTrue($sut->getOption('PDFA'));
+        self::assertEquals(['custom' => ['R' => 'custom.ttf']], $sut->getOption('fonts'));
+        self::assertCount(4, $sut->getOptions());
+    }
+
+    /**
+     * Templates running in the Twig sandbox must not be able to push the
+     * file-disclosure sinks (`associated_files` with `path`, `additional_xmp_rdf`)
+     * or arbitrary mPDF config keys through PdfContext.
+     */
+    public function testForbiddenAndUnknownKeysAreDropped(): void
+    {
+        $sut = new PdfContext();
+
+        $sut->setOption('associated_files', [['path' => '/etc/passwd']]);
+        $sut->setOption('additional_xmp_rdf', '<rdf:Description/>');
+        $sut->setOption('tempDir', '/tmp');
         $sut->setOption('unknown', 'foo');
-        self::assertEquals('foo', $sut->getOption('unknown'));
+
+        self::assertNull($sut->getOption('associated_files'));
+        self::assertNull($sut->getOption('additional_xmp_rdf'));
+        self::assertNull($sut->getOption('tempDir'));
+        self::assertNull($sut->getOption('unknown'));
+        self::assertEmpty($sut->getOptions());
     }
 }

tests/phpstan.neon

@@ -1668,7 +1668,7 @@ parameters:
 
         -
             message: "#^Parameter \\#2 \\$cacheDirectory of class App\\\\Pdf\\\\MPdfConverter constructor expects string, array\\|bool\\|float\\|int\\|string\\|null given\\.$#"
-            count: 1
+            count: 2
             path: Pdf/MPdfConverterTest.php
 
         -