使用laravel-dompdf生成PDF时采用服务器路径加载图片是否安全？

Great question! Let’s break down the security of your current approach and share safer alternatives that fix the PDF image display issue while keeping your app protected.

First off, directly using unvalidated absolute file system paths like /home/shashank/work/jobs/storage/app/{{$photo}} carries clear security risks:

• If the $photo variable is user-controllable (even indirectly, like through form inputs or URL parameters), attackers could use path-traversal tricks (e.g., ../../../../.env) to access sensitive server files—think configuration files, private user data, or system-level documents.
• Exposing your server’s internal directory structure also gives attackers extra context to target your app, which is never a good practice.

Better (and safer) solutions for Dompdf image loading in Laravel #

The reason your route/controller approach works in the browser but not in Dompdf is likely that Dompdf can’t resolve relative URLs or internal routes properly during PDF generation. Here are two secure fixes:

1. Use Laravel’s public storage link (recommended) #

Laravel has a built-in way to make storage files web-accessible without exposing server paths:

• Run this artisan command to create a symbolic link from public/storage to storage/app/public:

  php artisan storage:link
  

• Store your images in storage/app/public (or a subdirectory within it).
• In your PDF view, generate a web-accessible URL using asset() or Storage::url():

  <img src="{{ asset('storage/' . $photo) }}" alt="User Photo">
  <!-- OR -->
  <img src="{{ Storage::url($photo) }}" alt="User Photo">
  

This works for both the browser and Dompdf (since it uses a standard HTTP URL), and keeps your server’s internal paths completely hidden.

2. Validate and sanitize absolute paths (if you must use local files) #

If you can’t use the public storage link (e.g., for private, non-web-accessible files), you need to strictly validate the path to block traversal attacks:

• First, ensure the file exists only within your allowed storage directory:

  // In your controller or view logic
  $baseDir = realpath(storage_path('app'));
  $fullPath = realpath(storage_path('app/' . $photo));
  
  // Check that the resolved path is within the allowed directory
  if ($fullPath === false || strpos($fullPath, $baseDir) !== 0) {
      // Reject the request—invalid path or file doesn't exist
      abort(403);
  }
  
  // Optional: Validate file extension to restrict to image types
  $allowedExts = ['jpg', 'jpeg', 'png', 'gif'];
  $fileExt = strtolower(pathinfo($fullPath, PATHINFO_EXTENSION));
  if (!in_array($fileExt, $allowedExts)) {
      abort(403);
  }
  

• Then pass the validated $fullPath to your view for Dompdf to use. This ensures even if $photo is tampered with, attackers can’t access files outside your storage directory.

Final takeaway #

Your current approach isn’t safe unless you add strict validation. The public storage link method is the most straightforward and secure way to fix both the PDF image display issue and the security concern.

内容的提问来源于stack exchange，提问作者Shashank Singh Solanki