[tryton-commits] [tryton] [7.0] Restrict protocols allowed for weasyprint to http(s)

[Cédric Krier]

details:   https://code.tryton.org/tryton/commit/1325abbac88e
branch:    7.0
user:      Cédric Krier <c...@b2ck.com>
date:      Fri Jul 24 10:49:42 2026 +0200
description:
        Restrict protocols allowed for weasyprint to http(s)

        Closes #14947
        (grafted from 7c72806c98c07bb4ccb1f5f1b84954350541ec3a)
diffstat:

 trytond/CHANGELOG                |  1 +
 trytond/setup.py                 |  2 +-
 trytond/trytond/report/report.py |  7 ++++++-
 3 files changed, 8 insertions(+), 2 deletions(-)

diffs (37 lines):

diff -r ae4d58b01422 -r 1325abbac88e trytond/CHANGELOG
--- a/trytond/CHANGELOG Mon Jul 27 10:39:01 2026 +0200
+++ b/trytond/CHANGELOG Fri Jul 24 10:49:42 2026 +0200
@@ -1,3 +1,4 @@
+* Restrict protocols allowed for weasyprint to http(s) (issue14947)
 
 Version 7.0.54 - 2026-07-15
 ---------------------------
diff -r ae4d58b01422 -r 1325abbac88e trytond/setup.py
--- a/trytond/setup.py  Mon Jul 27 10:39:01 2026 +0200
+++ b/trytond/setup.py  Fri Jul 24 10:49:42 2026 +0200
@@ -154,7 +154,7 @@
         'BCrypt': ['passlib[bcrypt]'],
         'Argon2': ['passlib[argon2]'],
         'html2text': ['html2text'],
-        'weasyprint': ['weasyprint'],
+        'weasyprint': ['weasyprint >= 68.0'],
         'coroutine': ['gevent>=1.1'],
         'image': ['pillow'],
         'barcode': ['python-barcode[images]'],
diff -r ae4d58b01422 -r 1325abbac88e trytond/trytond/report/report.py
--- a/trytond/trytond/report/report.py  Mon Jul 27 10:39:01 2026 +0200
+++ b/trytond/trytond/report/report.py  Fri Jul 24 10:49:42 2026 +0200
@@ -386,7 +386,12 @@
         if (weasyprint
                 and input_format in {'html', 'xhtml'}
                 and output_format == 'pdf'):
-            return output_format, weasyprint.HTML(string=data).write_pdf()
+            return output_format, weasyprint.HTML(
+                string=data,
+                url_fetcher=weasyprint.URLFetcher(
+                    allowed_protocols={'http', 'https'},
+                    ),
+                ).write_pdf()
 
         if input_format == output_format and output_format in MIMETYPES:
             return output_format, data