From 8414cd718f4501bef48ecab42f5a83f1c7a0fd80 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Krier?= <ced@b2ck.com>
Date: Fri, 24 Jul 2026 10:49:42 +0200
Subject: [PATCH] Restrict protocols allowed for weasyprint to http(s)

Closes #14947
---
 trytond/CHANGELOG                | 1 +
 trytond/pyproject.toml           | 2 +-
 trytond/trytond/report/report.py | 7 ++++++-
 3 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/trytond/CHANGELOG b/trytond/CHANGELOG
index 724f794165..ced75559ed 100644
--- a/trytond/CHANGELOG
+++ b/trytond/CHANGELOG
@@ -1,3 +1,4 @@
+* Restrict protocols allowed for weasyprint to http(s) (issue14947)
 * Add search attribute to XML record tag
 * Enforce access right on the email template record (issue14907)
 * Add ModelAccessProxy (issue14907)
diff --git a/trytond/pyproject.toml b/trytond/pyproject.toml
index 87aac58973..502754da42 100644
--- a/trytond/pyproject.toml
+++ b/trytond/pyproject.toml
@@ -58,7 +58,7 @@ test = [
     'pillow',
     'pydot',
     ]
-weasyprint = ['weasyprint']
+weasyprint = ['weasyprint >= 68.0']
 
 [project.scripts]
 trytond = 'trytond.cli:main'
diff --git a/trytond/trytond/report/report.py b/trytond/trytond/report/report.py
index 075515da3e..0be547314c 100644
--- a/trytond/trytond/report/report.py
+++ b/trytond/trytond/report/report.py
@@ -413,7 +413,12 @@ class Report(URLMixin, PoolBase):
         if (input_format in {'html', 'xhtml'}
                 and output_format == 'pdf'):
             if weasyprint := _lazy_import('weasyprint'):
-                return output_format, weasyprint.HTML(string=data).write_pdf()
+                return output_format, weasyprint.HTML(
+                    string=data,
+                    url_fetcher=weasyprint.URLFetcher(
+                        allowed_protocols={'http', 'https'},
+                        ),
+                    ).write_pdf()
 
         if (input_format == 'xml'
                 and output_format == 'html'