One thing you can do with a style sheet is load in a font-family and include a link to a font file.Here, I will be writing about two pdf creation PHP Classes. This can either be inline with the tag or via a style sheet. The best part with this functionality is that it will format the PDF output using straight HTML tags. It provides fairly simple and easy to use functionality, removing what would otherwise be a very mundane task for a commonly used piece of functionality. (Optional) Setup the paper size and orientation

Furthermore, in versions loadHtml('hello world') However, bear in mind that this could be a breaking change. Alternatively, restricting access to the Composer install location is also a good option, depending on what libraries are being used and what functionality is needed in the application.įor dompdf versions => 0.8.6, the $isRemoteEnabled setting can be disabled to prevent loading of custom fonts through font-face CSS rules. A potential solution could be to prohibit the loading of custom font styles into the PDF generation process or even restricting write access to the font cache folder.

The dompdf PHP composer page alone has nearly 50 million installs since its initial release to the PHP package manager in 2014.Īt the time of writing this, there is currently no fix for this vulnerability. In their reporting, they outlined a way that code could be loaded into an application and then remotely executed during a PDF being generated.ĭompdf is used quite extensively within the PHP ecosystem, and is used within over 59,000 open sourced platforms and projects. Recently, researchers from Positive Security published findings identifying a major remote code execution (RCE) vulnerability in dompdf, a popular PDF generation library.

Php pdf creator