[SECURITY] Disable outbound and file access for reportlab (CVE-2026-57535)

2026-06-25 16:40:00 +02:00
parent e2661f304d
commit 80601cc013
2 changed files with 57 additions and 0 deletions
@@ -29,3 +29,8 @@ class PretixHelpersConfig(AppConfig):
    def ready(self):
        from .monkeypatching import monkeypatch_all_at_ready
        monkeypatch_all_at_ready()
+
+        # Ensure reportlab does not make any calls to the internet
+        from reportlab import rl_config
+        rl_config.trustedHosts = []
+        rl_config.trustedSchemes = ['data']