as there are several security issues with dompdf library, wouldn't it be nice to require dompdf V.3 ?
https://github.com/advisories/GHSA-8hg6-c449-896m

in a local test, we had issues with special characters like € oder ä, ö, ß when updating to dompdf V.3.1.6
there is an issue reported https://github.com/dompdf/dompdf/issues/3616

so updating dompdf could not always be straight foreword.

CommentFileSizeAuthor
#7 3613311-dompdf-vunerability.patch261 bytesssaba
#5 3613311-dompdf-vunerability.patch624 bytesssaba

Comments

nojj created an issue. See original summary.

nojj’s picture

nojj commented
Issue summary: View changes
larowlan’s picture

larowlan
Location 🇦🇺🏝.au GMT+10
commented

There's a security advisory out so we probably should be looking to move that way, it would require a new major.

nojj’s picture

nojj commented

looking forward to this.

ssaba’s picture

ssaba commented
StatusFileSize
new 3613311-dompdf-vunerability.patch624 bytes
ssaba’s picture

ssaba commented
ssaba’s picture

ssaba commented
StatusFileSize
new 3613311-dompdf-vunerability.patch261 bytes
hoporr’s picture

hoporr commented

During my last normal Drupal core update, composer detected that dompdf has security advisories and blocked the whole upgrade/install.

The patch here seems correct, but since this patch here runs POST composer check, it would not solve it the install problem. To really get this to work, it has to become part of the next release.

To circumvent the problem for now, and actually load up the 3+ version of dompdf, I did this:
$ composer require "dompdf/dompdf:3.1.6 as 2.0.8" --update-with-all-dependencies

nojj’s picture

nojj commented

for us composer require dompdf/dompdf:^3 -W
did the trick, but a new release requiring dompdf > 3.1.6 would be nice.