fix: gotenberg_font_face quotes escaped in HTML context (#267)

Author: marilenaRM

README.md

@@ -377,6 +377,7 @@ sensiolabs_gotenberg:
 - [UPGRADE FROM 1.0.0 to 1.1.0](./UPGRADE-1.1.md)
 - [UPGRADE FROM 1.1.0 to 1.2.0](./UPGRADE-1.2.md)
 - [UPGRADE FROM 1.2.0 to 1.3.0](./UPGRADE-1.3.md)
+- [UPGRADE FROM 1.3.0 to 1.4.0](./UPGRADE-1.4.md)
 
 ## Credits
 

UPGRADE-1.4.md

@@ -1,5 +1,15 @@
 # UPGRADE FROM 1.3.0 to 1.4.0
 
 ## Breaking changes
-
 * `AbstractBuilder::getHeadersBag()` now retains `Gotenberg-Webhook-Extra-Http-Headers` as an array until the payload is built. Code reading this value directly must expect an array instead of a JSON string.
+
+## Bug Fixes
+* `gotenberg_font_face()` is now declared `is_safe` for both `html` and `css` Twig contexts.
+  Previously, using it inside a `<style>` tag would cause Twig's HTML auto-escaping to convert
+  double quotes to `&quot;`, producing invalid CSS. If you were using the `| raw` filter as a
+  workaround, you can now remove it.
+
+  ```diff
+    - <style>{{ gotenberg_font_face('fonts/my-font.woff2', 'MyFont') | raw }}</style>
+    + <style>{{ gotenberg_font_face('fonts/my-font.woff2', 'MyFont') }}</style>
+  ```

src/Twig/GotenbergExtension.php

@@ -12,7 +12,7 @@ public function getFunctions(): array
         return [
             new TwigFunction('gotenberg_asset', [GotenbergRuntime::class, 'getAssetUrl']),
             new TwigFunction('gotenberg_font_style_tag', [GotenbergRuntime::class, 'getFontStyleTag'], ['is_safe' => ['html']]),
-            new TwigFunction('gotenberg_font_face', [GotenbergRuntime::class, 'getFontFace'], ['is_safe' => ['css']]),
+            new TwigFunction('gotenberg_font_face', [GotenbergRuntime::class, 'getFontFace'], ['is_safe' => ['html', 'css']]),
         ];
     }
 }

tests/Twig/GotenbergRuntimeTest.php

@@ -2,25 +2,28 @@
 
 namespace Sensiolabs\GotenbergBundle\Tests\Twig;
 
+use PHPUnit\Framework\Attributes\DataProvider;
 use PHPUnit\Framework\Attributes\TestWith;
 use PHPUnit\Framework\TestCase;
 use Sensiolabs\GotenbergBundle\Builder\BuilderAssetInterface;
+use Sensiolabs\GotenbergBundle\Twig\GotenbergExtension;
 use Sensiolabs\GotenbergBundle\Twig\GotenbergRuntime;
 use Symfony\Component\Asset\Packages;
 use Symfony\Component\AssetMapper\AssetMapperRepository;
+use Twig\Environment;
+use Twig\Loader\ArrayLoader;
+use Twig\RuntimeLoader\FactoryRuntimeLoader;
 
 class GotenbergRuntimeTest extends TestCase
 {
     public function testGetAsset(): void
     {
-        $runtime = new GotenbergRuntime();
         $builder = $this->createMock(BuilderAssetInterface::class);
-        $builder
-            ->expects($this->once())
-            ->method('addAsset')
-            ->with('foo')
-        ;
+        $builder->expects($this->once())->method('addAsset')->with('foo');
+
+        $runtime = new GotenbergRuntime();
         $runtime->setBuilder($builder);
+
         $this->assertSame('foo', $runtime->getAssetUrl('foo'));
     }
 
@@ -34,14 +37,12 @@ public function testGetAssetThrowsWhenBuilderIsNotSet(): void
 
     public function testGetFontFace(): void
     {
-        $runtime = new GotenbergRuntime();
         $builder = $this->createMock(BuilderAssetInterface::class);
-        $builder
-            ->expects($this->once())
-            ->method('addAsset')
-            ->with('foo.ttf')
-        ;
+        $builder->expects($this->once())->method('addAsset')->with('foo.ttf');
+
+        $runtime = new GotenbergRuntime();
         $runtime->setBuilder($builder);
+
         $this->assertSame(
             '@font-face {font-family: "my_font";src: url("foo.ttf");}',
             $runtime->getFontFace('foo.ttf', 'my_font'),
@@ -50,14 +51,12 @@ public function testGetFontFace(): void
 
     public function testGetFontStyleTag(): void
     {
-        $runtime = new GotenbergRuntime();
         $builder = $this->createMock(BuilderAssetInterface::class);
-        $builder
-            ->expects($this->once())
-            ->method('addAsset')
-            ->with('foo.ttf')
-        ;
+        $builder->expects($this->once())->method('addAsset')->with('foo.ttf');
+
+        $runtime = new GotenbergRuntime();
         $runtime->setBuilder($builder);
+
         $this->assertSame(
             '<style>@font-face {font-family: "my_font";src: url("foo.ttf");}</style>',
             $runtime->getFontStyleTag('foo.ttf', 'my_font'),
@@ -180,4 +179,57 @@ public function testGetAssetUrlWhenMissingAssetMapperRepositoryAndPackages(): vo
 
         $this->assertSame('origin.png', $path);
     }
+
+    /**
+     * @return iterable<string, array{string, string}>
+     */
+    public static function provideFontRenderingCases(): iterable
+    {
+        yield 'gotenberg_font_face renders correctly inside a style tag' => [
+            '<style>{{ gotenberg_font_face("foo.ttf", "my_font") }}</style>',
+            '<style>@font-face {font-family: "my_font";src: url("foo.ttf");}</style>',
+        ];
+        yield 'gotenberg_font_style_tag renders correctly in html context' => [
+            '{{ gotenberg_font_style_tag("foo.ttf", "my_font") }}',
+            '<style>@font-face {font-family: "my_font";src: url("foo.ttf");}</style>',
+        ];
+        yield 'gotenberg_font_face escapes html tags in path inside a style tag' => [
+            '<style>{{ gotenberg_font_face("fonts/<script>alert(1).ttf", "my_font") }}</style>',
+            '<style>@font-face {font-family: "my_font";src: url("&lt;script&gt;alert(1).ttf");}</style>',
+        ];
+        yield 'gotenberg_font_style_tag escapes html tags in path' => [
+            '{{ gotenberg_font_style_tag("fonts/<script>alert(1).ttf", "my_font") }}',
+            '<style>@font-face {font-family: "my_font";src: url("&lt;script&gt;alert(1).ttf");}</style>',
+        ];
+        yield 'gotenberg_font_face escapes html injection in name inside a style tag' => [
+            '<style>{{ gotenberg_font_face("foo.ttf", "</style><script>alert(\'xss\')</script>") }}</style>',
+            '<style>@font-face {font-family: "&lt;/style&gt;&lt;script&gt;alert(&#039;xss&#039;)&lt;/script&gt;";src: url("foo.ttf");}</style>',
+        ];
+        yield 'gotenberg_font_style_tag escapes html injection in name' => [
+            '{{ gotenberg_font_style_tag("foo.ttf", "</style><script>alert(\'xss\')</script>") }}',
+            '<style>@font-face {font-family: "&lt;/style&gt;&lt;script&gt;alert(&#039;xss&#039;)&lt;/script&gt;";src: url("foo.ttf");}</style>',
+        ];
+        yield 'applying e("css") filter to gotenberg_font_face output destroys the css rule structure' => [
+            '<style>{{ gotenberg_font_face("foo.ttf", "my_font") | e("css") }}</style>',
+            '<style>\40 font\2D face\20 \7B font\2D family\3A \20 \22 my\5F font\22 \3B src\3A \20 url\28 \22 foo\2E ttf\22 \29 \3B \7D </style>',
+        ];
+    }
+
+    #[DataProvider('provideFontRenderingCases')]
+    public function testFontRendering(string $template, string $expected): void
+    {
+        $builder = $this->createMock(BuilderAssetInterface::class);
+        $builder->method('addAsset');
+
+        $runtime = new GotenbergRuntime();
+        $runtime->setBuilder($builder);
+
+        $twig = new Environment(new ArrayLoader(), ['autoescape' => 'html']);
+        $twig->addExtension(new GotenbergExtension());
+        $twig->addRuntimeLoader(new FactoryRuntimeLoader([
+            GotenbergRuntime::class => static fn () => $runtime,
+        ]));
+
+        $this->assertSame($expected, $twig->createTemplate($template)->render([]));
+    }
 }