fix(security): read Image() masks through the path allowlist, stop writeHTML() copying CSS url() and img| bullet files to the temp dir, keep the system temp dir out of the markup allowlist, check the image size probe, Annotation() attachments and setHyphenPatterns() paths against the allowlist, convert legacy img| list bullets to list-style-image; require tc-lib-pdf ^8.82.2 (v7.0.20)

Author: nicolaasuni

CHANGELOG.TXT

@@ -1,3 +1,13 @@
+7.0.20 (2026-10-24)
+	- Fixed Image() with a mask handle ($imgmask) reading the image and the mask outside the local path allowlist: both files are now read through the engine file helper, as for a plain Image() call.
+	- Fixed writeHTML() copying files referenced by CSS url() values and legacy list image bullets into the system temp directory: paths with uppercase characters were copied, without an allowlist check, to a predictable file name readable through the allowlisted temp directory. The copy is removed; the engine resolves these paths directly.
+	- Resources referenced by HTML, CSS and SVG markup are no longer read from the system temp directory. List the directory in K_ALLOWED_PATHS to allow it. Image(), ImageSVG() and the other API methods keep access to it.
+	- Image() reports an unknown size for paths outside the allowlist instead of probing the file. Annotation() file attachments and setHyphenPatterns() treat such paths as missing files.
+	- Fixed writeHTML() ignoring the legacy list-style-type:img|type|width|height|path list bullets: they are converted to list-style-image:url(path). The marker size follows the font size; the width and height fields are ignored.
+	- Requires `tecnickcom/tc-lib-pdf` ^8.82.1, which applies the path allowlist to PDF import and the host allowlist to signature timestamp requests.
+
+*************************************************
+
 7.0.15 (2026-10-03)
 	- Fixed headers and footers drawn with writeHTML() (or other flowing content) in an overridden Header() or Footer(): content placed below the automatic page break margin, such as a footer, was moved to another page. On the last page an extra page was added; on the other pages the footer was drawn at the top of the next page. The graphics state was also left unbalanced (poppler: "Restoring state when no valid states to pop").
 		- Headers and footers are now always drawn on their own page, over the full page width, also on pages with columns. Content that does not fit is clipped at the page edge, as in TCPDF 6.

README.md

@@ -244,6 +244,9 @@ configurable via `define()` constants (read by `tcpdf_autoconfig.php`, overridab
 only ever *widens* this set — paths are resolved with `realpath()`, so non-existent or
 unresolvable entries are silently ignored and traversal/symlink tricks collapse to their
 canonical prefix. There is no way to read below the built-in roots.
+Resources referenced by HTML, CSS and SVG markup (`writeHTML()`, `writeHTMLCell()`)
+use the same list without the system temp directory; list the temp directory in
+`K_ALLOWED_PATHS` to allow markup to read from it.
 
 **Remote reads.** Remote URL loading is **off by default** — the single most important
 defense against SSRF when rendering untrusted HTML/markup. To opt in, list the exact

SECURITY.md

@@ -41,7 +41,7 @@ The table below describes structural exposure in 6.x. It is not an inventory of
 | Class | CWE | Origin in TCPDF 6.x | Handling in TCPDF 7.x |
 |---|---|---|---|
 | Server-side request forgery | [CWE-918](https://cwe.mitre.org/data/definitions/918.html) | Images, fonts, and other resources are fetched from caller-supplied URLs through cURL and stream functions. | Remote loading is disabled by default; hosts must be listed in `K_ALLOWED_HOSTS`. |
-| Path traversal and local file disclosure | [CWE-22](https://cwe.mitre.org/data/definitions/22.html), [CWE-73](https://cwe.mitre.org/data/definitions/73.html) | Filesystem paths supplied by the caller are opened directly for images, fonts, ICC profiles, and templates, and for the `Output()` file destinations. | Local reads, and the `Output()` `F`/`FI`/`FD` destination, are restricted to a `realpath()` allowlist of trusted roots, widened only by `K_ALLOWED_PATHS`. The written file name is sanitized by the engine. |
+| Path traversal and local file disclosure | [CWE-22](https://cwe.mitre.org/data/definitions/22.html), [CWE-73](https://cwe.mitre.org/data/definitions/73.html) | Filesystem paths supplied by the caller are opened directly for images, fonts, ICC profiles, and templates, and for the `Output()` file destinations. | Local reads, and the `Output()` `F`/`FI`/`FD` destination, are restricted to a `realpath()` allowlist of trusted roots, widened only by `K_ALLOWED_PATHS`. Image masks follow the same allowlist. Resources referenced by HTML, CSS, and SVG markup use it without the system temp directory. The written file name is sanitized by the engine. |
 | Unsafe stream wrappers and object injection | [CWE-502](https://cwe.mitre.org/data/definitions/502.html) | Path arguments reach PHP file APIs, so wrapper schemes such as `phar://` are reachable from caller-controlled strings. | Constrained by the same path allowlist; `setAllowLocalFiles()` no longer widens access. |
 | XML external entities and entity expansion | [CWE-611](https://cwe.mitre.org/data/definitions/611.html), [CWE-776](https://cwe.mitre.org/data/definitions/776.html) | SVG input is processed by an XML parser. | SVG parsing is performed by the engine; report against `tc-lib-pdf`. |
 | Uncontrolled resource consumption | [CWE-400](https://cwe.mitre.org/data/definitions/400.html), [CWE-674](https://cwe.mitre.org/data/definitions/674.html), [CWE-1333](https://cwe.mitre.org/data/definitions/1333.html) | HTML, CSS, and SVG are parsed with recursive descent and extensive regular expressions over unbounded input. | Parsing is performed by the engine; remote downloads are capped by `K_MAX_REMOTE_SIZE`. |
@@ -69,7 +69,7 @@ Until the upgrade is complete, treat every TCPDF 6.x deployment as an accepted r
 TCPDF 7.x is deprecated and receives security fixes only. The mitigations above are defaults, not guarantees. While migration to `tc-lib-pdf` is pending, and in particular when rendering untrusted input:
 
 - Leave `K_ALLOWED_HOSTS` empty unless remote resources are required, and list exact host names when they are.
-- Keep `K_ALLOWED_PATHS` as narrow as the deployment allows, and lower `K_MAX_REMOTE_SIZE` to the expected asset size.
+- Keep `K_ALLOWED_PATHS` as narrow as the deployment allows, and lower `K_MAX_REMOTE_SIZE` to the expected asset size. Do not list the system temp directory when rendering untrusted markup.
 - Use AES encryption (`setProtection()` modes 2 or 3) instead of the legacy RC4 modes.
 - Do not build embedded JavaScript, annotations, links, or form actions from unescaped user input.
 - Run PDF generation in an isolated process with restricted filesystem and network permissions.

VERSION

@@ -1 +1 @@
-7.0.19
+7.0.20

composer.json

@@ -29,7 +29,7 @@
     "require": {
         "php": ">=8.2",
         "ext-curl": "*",
-        "tecnickcom/tc-lib-pdf": "^8.81"
+        "tecnickcom/tc-lib-pdf": "^8.82"
     },
     "require-dev": {
         "carthage-software/mago": "1.57.0",

config/tcpdf_config.php

@@ -226,7 +226,9 @@
  *                     can be read. By default this covers the system temp
  *                     dir, K_PATH_MAIN, the bundled vendor directory, the
  *                     current working directory, K_PATH_FONTS, K_PATH_IMAGES
- *                     and the running script's directory.
+ *                     and the running script's directory. Resources referenced
+ *                     by HTML, CSS and SVG markup use the same list without
+ *                     the system temp dir.
  *
  *   2. REMOTE FILES - HTTP/HTTPS downloads are DISABLED unless you provide an
  *                     explicit allowlist of trusted host names. This is the
@@ -245,6 +247,8 @@
  * Array of absolute path prefixes, merged on top of the built-in defaults
  * (the defaults are always kept; this only ever widens local access).
  * Entries that do not resolve to an existing directory are ignored.
+ * Listing the system temp dir also allows HTML, CSS and SVG markup to read
+ * from it.
  */
 //define('K_ALLOWED_PATHS', ['/var/www/shared/assets/']);
 

tcpdf.php

@@ -2,7 +2,7 @@
 
 //============================================================+
 // File name    : tcpdf.php
-// Version      : 7.0.19
+// Version      : 7.0.20
 // Author       : Nicola Asuni - Tecnick.com LTD - www.tecnick.com - info@tecnick.com
 // License      : GNU-LGPL v3 (https://www.gnu.org/copyleft/lesser.html)
 // Copyright (C): 2002-2026 Nicola Asuni - Tecnick.com LTD
@@ -15,7 +15,7 @@
  * See: https://tcpdf.org
  * @package com.tecnick.tcpdf
  * @author Nicola Asuni
- * @version 7.0.19
+ * @version 7.0.20
  */
 
 // TCPDF configuration
@@ -538,6 +538,33 @@ protected function fileAllowedPaths(): array
         return array_values(array_unique($paths));
     }
 
+    /**
+     * Local paths resources referenced by HTML, CSS and SVG markup may be read
+     * from: the fileAllowedPaths() entries without the system temp directory,
+     * unless K_ALLOWED_PATHS lists that directory.
+     *
+     * @return array<int, string>
+     */
+    protected function fileMarkupAllowedPaths(): array
+    {
+        $paths = $this->fileAllowedPaths();
+        $temp = realpath(sys_get_temp_dir());
+        if ($temp === false) {
+            return $paths;
+        }
+
+        // @mago-expect analysis:redundant-logical-operation
+        if (defined('K_ALLOWED_PATHS') && is_array(K_ALLOWED_PATHS)) {
+            foreach (K_ALLOWED_PATHS as $extrapath) {
+                if (is_string($extrapath) && $extrapath !== '' && realpath($extrapath) === $temp) {
+                    return $paths;
+                }
+            }
+        }
+
+        return array_values(array_filter($paths, static fn(string $path): bool => $path !== $temp));
+    }
+
     /**
      * Assemble the file-access options handed to the engine's shared file
      * helper (tc-lib-file). These drive the upstream security sandbox that
@@ -546,6 +573,8 @@ protected function fileAllowedPaths(): array
      *
      * The mapping is configuration-driven:
      *  - allowedPaths  <- built-in defaults + K_ALLOWED_PATHS (local reads)
+     *  - markupAllowedPaths <- allowedPaths without the system temp directory
+     *                     (local reads triggered by HTML, CSS and SVG markup)
      *  - allowedHosts  <- K_ALLOWED_HOSTS (remote HTTP/HTTPS reads; empty
      *                     disables remote loading entirely — the safe default)
      *  - maxRemoteSize <- K_MAX_REMOTE_SIZE (byte cap on remote downloads)
@@ -556,14 +585,18 @@ protected function fileAllowedPaths(): array
      *
      * @return array{
      *   allowedPaths: array<int, string>,
+     *   markupAllowedPaths: array<int, string>,
      *   allowedHosts?: array<int, string>,
      *   maxRemoteSize?: int,
      *   curlopts?: array<int, bool|int|string>,
      * }
      */
     protected function fileOptions(): array
     {
-        $options = ['allowedPaths' => $this->fileAllowedPaths()];
+        $options = [
+            'allowedPaths' => $this->fileAllowedPaths(),
+            'markupAllowedPaths' => $this->fileMarkupAllowedPaths(),
+        ];
 
         // Remote URL loading is disabled by default in the upstream library:
         // an empty (or unset) host allowlist keeps it disabled. Populate
@@ -1997,6 +2030,14 @@ protected function resolveLocalFile(string $file): string
         return $real === false ? $file : $real;
     }
 
+    /**
+     * Whether a local file exists inside the engine path allowlist.
+     */
+    protected function isAllowedLocalFile(string $file): bool
+    {
+        return $file !== '' && $this->engine()->file->isAllowedFile($file) && is_file($file);
+    }
+
     /**
      * Register an external link annotation for the given rectangle.
      */
@@ -3397,7 +3438,7 @@ public function Annotation($_x, $_y, $_w, $_h, $_text, $_opt = ['Subtype' => 'Te
             $key = strtolower((string) $key);
             if ($key === 'fs' && is_string($val)) {
                 $val = $this->resolveLocalFile($val);
-                if (!is_file($val)) {
+                if (!$this->isAllowedLocalFile($val)) {
                     // The legacy implementation silently skipped attachments
                     // whose source file cannot be read.
                     return;
@@ -4453,8 +4494,9 @@ public function Image(
      * alpha channel, then return the merged PNG content. The engine's import
      * path then splits that alpha back out into a /SMask (the only soft-mask
      * mechanism tc-lib-pdf-image exposes), reproducing legacy's separate-mask
-     * Image() call. Returns null when the images cannot be read (caller falls
-     * back to the unmasked file).
+     * Image() call. Both files are read through the engine file helper, so the
+     * path allowlist applies. Returns null when the images cannot be read
+     * (caller falls back to the unmasked file).
      *
      * Mask polarity follows the PDF soft-mask convention used by legacy: a
      * white mask pixel is fully opaque, a black one fully transparent.
@@ -4465,13 +4507,15 @@ protected function mergeImageAlphaMask(string $basefile, string $maskfile): ?str
             return null;
         }
 
-        if (!is_readable($basefile) || !is_readable($maskfile)) {
+        $filehelper = $this->engine()->file;
+        try {
+            $basedata = $filehelper->getLocalFileData($basefile);
+            $maskdata = $filehelper->getLocalFileData($maskfile);
+        } catch (\Throwable) {
             return null;
         }
 
-        $basedata = file_get_contents($basefile);
-        $maskdata = file_get_contents($maskfile);
-        if ($basedata === false || $maskdata === false) {
+        if (!is_string($basedata) || $basedata === '' || !is_string($maskdata) || $maskdata === '') {
             return null;
         }
 
@@ -4523,6 +4567,7 @@ protected function mergeImageAlphaMask(string $basefile, string $maskfile): ?str
 
     /**
      * Return the pixel size of an image file or '@'-prefixed data stream.
+     * Files outside the path allowlist report an unknown size.
      *
      * @return array{0: int, 1: int} Width and height in pixels (0 when unknown).
      */
@@ -4531,7 +4576,7 @@ protected function imagePixelSize(string $file): array
         if ($file !== '' && $file[0] === '@') {
             $info = getimagesizefromstring(substr($file, 1));
         } else {
-            $info = is_file($file) ? getimagesize($file) : false;
+            $info = $this->isAllowedLocalFile($file) ? getimagesize($file) : false;
         }
 
         return is_array($info) ? [(int) $info[0], (int) $info[1]] : [0, 0];
@@ -7516,28 +7561,6 @@ protected function absolutizeMarkupPath(string $source): string
         return $real === false ? $source : $real;
     }
 
-    /**
-     * Return a markup resource path that survives CSS lowercasing.
-     *
-     * CSS values are lowercased by the engine parser, so paths used in CSS
-     * context are copied to a lowercase temporary file when necessary.
-     */
-    protected function cssSafeMarkupPath(string $source): string
-    {
-        $source = $this->absolutizeMarkupPath($source);
-        if ($source === strtolower($source) || !is_file($source)) {
-            return $source;
-        }
-
-        $ext = strtolower(pathinfo($source, PATHINFO_EXTENSION));
-        $copy = rtrim(sys_get_temp_dir(), '/') . '/tcpdf_css_' . md5($source) . ($ext !== '' ? '.' . $ext : '');
-        if (!is_file($copy)) {
-            copy($source, $copy);
-        }
-
-        return $copy;
-    }
-
     /**
      * Flatten styled inline elements that contain nested inline children.
      *
@@ -7640,8 +7663,10 @@ static function (array $match): string {
      * - vertical align attributes are dropped from images inside tables
      *   (the engine would overlap them with the row borders);
      * - '@'-prefixed base64 image data is rewritten to a data URI;
-     * - relative local image paths are made absolute (src attributes,
-     *   CSS url() values and the legacy img| list-bullet syntax);
+     * - relative local image paths are made absolute (src attributes and
+     *   CSS url() values);
+     * - the legacy list-style-type:img|type|width|height|path bullet syntax
+     *   becomes list-style-image:url(path);
      * - legacy page anchors (href="#N" or href="#N,y") become internal
      *   links to page N at ordinate y;
      * - malformed hexadecimal colors, silently coerced by the legacy
@@ -7692,13 +7717,16 @@ protected function normalizeHtmlMarkup(string $html): string
         );
         $html = (string) preg_replace_callback(
             '/url\(["\']?([^"\')]+)["\']?\)/',
-            fn(array $match): string => "url('" . $this->cssSafeMarkupPath($match[1] ?? '') . "')",
+            fn(array $match): string => "url('" . $this->absolutizeMarkupPath($match[1] ?? '') . "')",
             $html,
         );
-        // Legacy custom list bullet syntax: list-style-type:img|ext|w|h|path
+        // Legacy custom list bullet syntax: list-style-type:img|ext|w|h|path.
+        // The engine sizes list-style-image markers from the font size.
         $html = (string) preg_replace_callback(
-            '/(img\|[^|;"\'<>]*\|[^|;"\'<>]*\|[^|;"\'<>]*\|)([^;"\'<>]+)/',
-            fn(array $match): string => ($match[1] ?? '') . $this->cssSafeMarkupPath($match[2] ?? ''),
+            '/list-style-type\s*:\s*img\|[^|;"\'<>]*\|[^|;"\'<>]*\|[^|;"\'<>]*\|([^;"\'<>]+)/i',
+            fn(array $match): string => (
+                "list-style-image:url('" . $this->absolutizeMarkupPath(trim($match[1] ?? '')) . "')"
+            ),
             $html,
         );
 
@@ -8519,7 +8547,7 @@ public function hyphenateText(
             }
 
             $file = $this->resolveLocalFile($_patterns);
-            if (is_file($file)) {
+            if ($this->isAllowedLocalFile($file)) {
                 $eng->setTexHyphenPatterns($eng->loadTexHyphenPatterns($file));
             }
         } elseif (is_array($_patterns) && $_patterns !== []) {

tcpdf_autoconfig.php

@@ -297,7 +297,8 @@
 // directory, K_PATH_FONTS, K_PATH_IMAGES and the running script directory).
 // The built-in defaults are always included; this only ever widens access.
 // Must be defined before this file is loaded. Entries that do not resolve to
-// an existing directory are ignored.
+// an existing directory are ignored. Listing the system temp dir also allows
+// HTML, CSS and SVG markup to read from it.
 if (!defined('K_ALLOWED_PATHS')) {
     define('K_ALLOWED_PATHS', []);
 }