[tryton-commits] [tryton] [8.0] Restrict protocols allowed for weasyprint to http(s)

[Cédric Krier]

details:   https://code.tryton.org/tryton/commit/46185b14a13b
branch:    8.0
user:      Cédric Krier <c...@b2ck.com>
date:      Tue Aug 04 10:38:45 2026 +0200
description:
        Restrict protocols allowed for weasyprint to http(s)

        Closes #14947
        (grafted from 7c72806c98c07bb4ccb1f5f1b84954350541ec3a)
diffstat:

 trytond/CHANGELOG                |  1 +
 trytond/pyproject.toml           |  2 +-
 trytond/trytond/report/report.py |  7 ++++++-
 3 files changed, 8 insertions(+), 2 deletions(-)

diffs (37 lines):

diff -r 9ff4a22447cc -r 46185b14a13b trytond/CHANGELOG
--- a/trytond/CHANGELOG Thu Jul 30 16:37:30 2026 +0200
+++ b/trytond/CHANGELOG Tue Aug 04 10:38:45 2026 +0200
@@ -1,3 +1,4 @@
+* Restrict protocols allowed for weasyprint to http(s) (issue14947)
 
 Version 8.0.7 - 2026-07-15
 --------------------------
diff -r 9ff4a22447cc -r 46185b14a13b trytond/pyproject.toml
--- a/trytond/pyproject.toml    Thu Jul 30 16:37:30 2026 +0200
+++ b/trytond/pyproject.toml    Tue Aug 04 10:38:45 2026 +0200
@@ -60,7 +60,7 @@
     'pillow',
     'pydot',
     ]
-weasyprint = ['weasyprint']
+weasyprint = ['weasyprint >= 68.0']
 
 [project.scripts]
 trytond = 'trytond.cli:main'
diff -r 9ff4a22447cc -r 46185b14a13b trytond/trytond/report/report.py
--- a/trytond/trytond/report/report.py  Thu Jul 30 16:37:30 2026 +0200
+++ b/trytond/trytond/report/report.py  Tue Aug 04 10:38:45 2026 +0200
@@ -414,7 +414,12 @@
         if (input_format in {'html', 'xhtml'}
                 and output_format == 'pdf'):
             if weasyprint := _lazy_import('weasyprint'):
-                return output_format, weasyprint.HTML(string=data).write_pdf()
+                return output_format, weasyprint.HTML(
+                    string=data,
+                    url_fetcher=weasyprint.URLFetcher(
+                        allowed_protocols={'http', 'https'},
+                        ),
+                    ).write_pdf()
 
         if (input_format == 'xml'
                 and output_format == 'html'