Server-side Request Forgery (SSRF) via img tags in reportlab
All versions of package reportlab at time of writing are vulnerable to Server-side Request Forgery (SSRF) via img tags. In order to reduce risk, use trustedSchemes & trustedHosts (see in Reportlab's documentation)Steps to reproduce by Karan Bamal:Download and install the latest package of reportlabGo to demos -> odyssey -> dodysseyIn the text file odyssey.txt that needs to be converted to pdf inject `<img src="http://127.0.0.1:5000" valign="top"/>`Create a nc listener `nc -lp 5000`Run python3 dodyssey.pyYou will get a hit on your nc showing we have successfully proceded to send a server side requestdodyssey.py will show error since there is no img file on the url, but we are able to do SSRF