jjsm01/kimai2
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

Whitelist PDF context options (#5924)

Browse Source
This commit is contained in:
Kevin Papst
2026-04-26 09:28:28 +02:00
committed by GitHub
parent 3b051e4aa5
commit 7a559a09e6
6 changed files with 126 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
tests/Pdf/PdfContextTest.php
View File

@@ -25,12 +25,40 @@ class PdfContextTest extends TestCase
self::assertNull($sut->getOption('unknown'));
}
public function testSetterAndGetter(): void
public function testAllowedKeysRoundTrip(): void
{
$sut = new PdfContext();
self::assertNull($sut->getOption('unknown'));
$sut->setOption('margin_top', '12');
$sut->setOption('format', 'A4-P');
$sut->setOption('PDFA', true);
$sut->setOption('fonts', ['custom' => ['R' => 'custom.ttf']]);
self::assertEquals('12', $sut->getOption('margin_top'));
self::assertEquals('A4-P', $sut->getOption('format'));
self::assertTrue($sut->getOption('PDFA'));
self::assertEquals(['custom' => ['R' => 'custom.ttf']], $sut->getOption('fonts'));
self::assertCount(4, $sut->getOptions());
}
/**
* Templates running in the Twig sandbox must not be able to push the
* file-disclosure sinks (`associated_files` with `path`, `additional_xmp_rdf`)
* or arbitrary mPDF config keys through PdfContext.
*/
public function testForbiddenAndUnknownKeysAreDropped(): void
{
$sut = new PdfContext();
$sut->setOption('associated_files', [['path' => '/etc/passwd']]);
$sut->setOption('additional_xmp_rdf', '<rdf:Description/>');
$sut->setOption('tempDir', '/tmp');
$sut->setOption('unknown', 'foo');
self::assertEquals('foo', $sut->getOption('unknown'));
self::assertNull($sut->getOption('associated_files'));
self::assertNull($sut->getOption('additional_xmp_rdf'));
self::assertNull($sut->getOption('tempDir'));
self::assertNull($sut->getOption('unknown'));
self::assertEmpty($sut->getOptions());
}
}