CVE-2024-28184: Insufficient Information (NVD-CWE-noinfo)
value: WeasyPrint helps web developers to create PDF documents. Since version 61.0, there's a vulnerability which allows attaching content of arbitrary files and URLs to a generated PDF document, even if `url_fetcher` is configured to prevent access to files and URLs. This vulnerability has been patched in version 61.2.

CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-09T01:15Z
Repository: https://github.com/Kozea/WeasyPrint
Language: Python
Files changed: weasyprint/html.py, weasyprint/pdf/__init__.py, weasyprint/pdf/anchors.py
Commit date: 2024-03-07 22:51:34 +0100
Commit message: Use document’s url_fetcher for attachments

Also force HTML attachments to be detected as URLs so that url_fetcher is
always used.

Diff: diff --git a/weasyprint/html.py b/weasyprint/html.py
index 9289e7a1..02bfeeec 100644
--- a/weasyprint/html.py
+++ b/weasyprint/html.py
@@ -279,11 +279,13 @@ def get_html_metadata(html):
             url = get_url_attribute(element, 'href', html.base_url)
             attachment_title = element.get('title', None)
             if url is None:
                 LOGGER.error('Missing href in <link rel="attachment">')
             else:
-                attachment = Attachment(url=url, description=attachment_title)
+                attachment = Attachment(
+                    url=url, description=attachment_title,
+                    url_fetcher=html.url_fetcher)
                 attachments.append(attachment)
     return {
         'title': title,
         'description': description,
         'generator': generator,
diff --git a/weasyprint/pdf/__init__.py b/weasyprint/pdf/__init__.py
index da6845e6..2809b5bb 100644
--- a/weasyprint/pdf/__init__.py
+++ b/weasyprint/pdf/__init__.py
@@ -247,11 +247,12 @@ def generate_pdf(document, target, zoom, **options):
     # Embedded files
     attachments = metadata.attachments.copy()
     if options['attachments']:
         for attachment in options['attachments']:
             if not isinstance(attachment, Attachment):
-                attachment = Attachment(attachment)
+                attachment = Attachment(
+                    attachment, url_fetcher=document.url_fetcher)
             attachments.append(attachment)
     pdf_attachments = []
     for attachment in attachments:
         pdf_attachment = write_pdf_attachment(pdf, attachment, compress)
         if pdf_attachment is not None:
diff --git a/weasyprint/pdf/anchors.py b/weasyprint/pdf/anchors.py
index 3a62892f..8c1f0237 100644
--- a/weasyprint/pdf/anchors.py
+++ b/weasyprint/pdf/anchors.py
@@ -250,12 +250,14 @@ def add_annotations(links, matrix, document, pdf, page, annot_files, compress):
             # to embed a file multiple times of course, so keep a reference
             # to every embedded URL and reuse the object number.
             # TODO: Use the title attribute as description. The comment
             # above about multiple regions won't always be correct, because
             # two links might have the same href, but different titles.
+            attachment = Attachment(
+                url=annot_target, url_fetcher=document.url_fetcher)
             annot_files[annot_target] = write_pdf_attachment(
-                pdf, Attachment(annot_target), compress)
+                pdf, attachment, compress)
         annot_file = annot_files[annot_target]
         if annot_file is None:
             continue
         rectangle = (
             *matrix.transform_point(*rectangle[:2]),

Vulnerable code:                 attachment = Attachment(url=url, description=attachment_title)
                attachment = Attachment(attachment)
                pdf, Attachment(annot_target), compress)
Fixed code:                 attachment = Attachment(
                    url=url, description=attachment_title,
                    url_fetcher=html.url_fetcher)
                attachment = Attachment(
                    attachment, url_fetcher=document.url_fetcher)
            attachment = Attachment(
                url=annot_target, url_fetcher=document.url_fetcher)
                pdf, attachment, compress)