[SECURITY] Properly escape HTML tags in PDF generation (CVE-2026-57535)

2026-06-25 16:40:28 +02:00
parent 53d8aa5679
commit cdeb3609f3
7 changed files with 239 additions and 213 deletions
@@ -1062,7 +1062,7 @@ class Renderer:
        except:
            logger.exception('Reshaping/Bidi fixes failed on string {}'.format(repr(text)))

-        p = Paragraph(text, style=style)
+        p = Paragraph(text, style=style)  # not using AutoEscapeParagraph is safe as we escape above
        return p, ad, lineheight

    def _draw_textcontainer(self, canvas: Canvas, op: OrderPosition, order: Order, o: dict):