Security: prevent SSRF in mPDF remote asset fetch via injected IP-filtered HTTP clien

See advisory GHSA-6xgw-x5v2-mhx7

Author: AngelFQC

public/main/inc/lib/pdf.lib.php

@@ -2,6 +2,7 @@
 
 /* See license terms in /license.txt */
 
+use Chamilo\CoreBundle\Component\Mpdf\SafeMpdfHttpClient;
 use Chamilo\CoreBundle\Framework\Container;
 use Masterminds\HTML5;
 use Mpdf\HTMLParserMode;
@@ -85,7 +86,9 @@ public function __construct(
         if ($value) {
             $params['img_dpi'] = $value;
         }
-        $this->pdf = new Mpdf($params);
+        // SSRF protection: route mPDF's remote asset fetches through an
+        // IP-filtered HTTP client (blocks loopback/private/reserved/metadata).
+        $this->pdf = new Mpdf($params, SafeMpdfHttpClient::container());
     }
 
     /**

src/CoreBundle/Component/Mpdf/SafeMpdfHttpClient.php

@@ -0,0 +1,59 @@
+<?php
+
+/* For licensing terms, see /license.txt */
+
+declare(strict_types=1);
+
+namespace Chamilo\CoreBundle\Component\Mpdf;
+
+use Chamilo\CoreBundle\Helpers\SafeHttpClientHelper;
+use Mpdf\Container\SimpleContainer;
+use Mpdf\Http\ClientInterface;
+use Mpdf\PsrHttpMessageShim\Response;
+use Mpdf\PsrHttpMessageShim\Stream;
+use Psr\Http\Message\RequestInterface;
+use Symfony\Contracts\HttpClient\Exception\ExceptionInterface;
+
+/**
+ * SSRF-safe HTTP client for mPDF (advisory 22.5).
+ *
+ * When rendering user-authored HTML to PDF, mPDF fetches remote `<img src>` /
+ * `@import url()` server-side through its AssetFetcher; the bundled cURL/socket
+ * clients have no private-IP filtering, so a student embedding
+ * `<img src="http://169.254.169.254/...">` in a portfolio item and exporting to
+ * PDF triggers a server-side request to an internal host. Passing
+ * `new Mpdf($config, SafeMpdfHttpClient::container())` routes every remote asset
+ * fetch through SafeHttpClientHelper, which refuses loopback/private/reserved
+ * targets, validates each redirect hop and speaks only http(s). Public images
+ * keep loading unchanged.
+ */
+final class SafeMpdfHttpClient implements ClientInterface
+{
+    /**
+     * Ready-to-use mPDF container that overrides only the HTTP client.
+     */
+    public static function container(): SimpleContainer
+    {
+        return new SimpleContainer(['httpClient' => new self()]);
+    }
+
+    public function sendRequest(RequestInterface $request): Response
+    {
+        $response = new Response();
+
+        try {
+            $remote = SafeHttpClientHelper::create()->request('GET', (string) $request->getUri());
+            $statusCode = $remote->getStatusCode();
+            // false: read the body regardless of HTTP status (AssetFetcher checks 2xx itself).
+            $content = $remote->getContent(false);
+        } catch (ExceptionInterface $e) {
+            // Blocked, unreachable or transport error: empty response so mPDF skips the asset.
+            return $response;
+        }
+
+        return $response
+            ->withStatus($statusCode)
+            ->withBody(Stream::create($content))
+        ;
+    }
+}

src/CoreBundle/Controller/AttendanceController.php

@@ -4,6 +4,7 @@
 
 namespace Chamilo\CoreBundle\Controller;
 
+use Chamilo\CoreBundle\Component\Mpdf\SafeMpdfHttpClient;
 use Chamilo\CoreBundle\Entity\Course;
 use Chamilo\CoreBundle\Entity\CourseRelUser;
 use Chamilo\CoreBundle\Entity\Session;
@@ -296,7 +297,7 @@ public function exportToPdf(int $id, Request $request): Response
             $mpdf = new Mpdf([
                 'orientation' => 'L',
                 'tempDir' => api_get_path(SYS_ARCHIVE_PATH).'mpdf/',
-            ]);
+            ], SafeMpdfHttpClient::container());
             $mpdf->WriteHTML($html);
 
             return new Response(

src/CoreBundle/Controller/CertificateController.php

@@ -6,6 +6,7 @@
 
 namespace Chamilo\CoreBundle\Controller;
 
+use Chamilo\CoreBundle\Component\Mpdf\SafeMpdfHttpClient;
 use Chamilo\CoreBundle\Entity\GradebookCertificate;
 use Chamilo\CoreBundle\Entity\User;
 use Chamilo\CoreBundle\Framework\Container;
@@ -69,7 +70,7 @@ public function downloadPdf(string $hash): Response
             $mpdf = new Mpdf([
                 'format' => 'A4',
                 'tempDir' => api_get_path(SYS_ARCHIVE_PATH).'mpdf/',
-            ]);
+            ], SafeMpdfHttpClient::container());
             $mpdf->WriteHTML($html);
             $pdfBinary = $mpdf->Output('', Destination::STRING_RETURN);
 

src/CoreBundle/Controller/StudentPublicationController.php

@@ -8,6 +8,7 @@
 
 use Chamilo\CoreBundle\AiProvider\AiProviderFactory;
 use Chamilo\CoreBundle\AiProvider\AiTaskGraderService;
+use Chamilo\CoreBundle\Component\Mpdf\SafeMpdfHttpClient;
 use Chamilo\CoreBundle\Entity\CourseRelUser;
 use Chamilo\CoreBundle\Entity\ResourceNode;
 use Chamilo\CoreBundle\Entity\Session;
@@ -387,7 +388,7 @@ public function exportPdf(
         try {
             $mpdf = new Mpdf([
                 'tempDir' => api_get_path(SYS_ARCHIVE_PATH).'mpdf/',
-            ]);
+            ], SafeMpdfHttpClient::container());
             $mpdf->WriteHTML($html);
 
             return new Response(