fix(security): PdfReportWriter — strip stylesheet/font hooks + assert sandbox flags

Dompdf 3.1 has a history of SSRF / file-disclosure CVEs
(CVE-2022-41343, CVE-2023-23924). The current writer correctly sets
`isRemoteEnabled=false` and `isPhpEnabled=false`, but two gaps
remained:

1. `<link rel="stylesheet">` and `@font-face` source declarations
   are honoured even with `isRemoteEnabled=false` because Dompdf
   resolves `file://` URLs locally. A stylesheet/font reference
   smuggled into the dashboard payload could read arbitrary FS
   paths. Strip both before handing HTML to Dompdf.
2. The sandbox flags are easy to lose in a future config refactor.
   Assert both are false at runtime; throw if they drift.

A `composer audit` step in CI (reviewer's third recommendation) is
already covered by the existing quality workflow's
`Security (composer)` job — verified separately.

Refs: #1419 review (concern 12) — discussion_r3187494519

Author: rubenvdlinde

lib/Service/Reporting/PdfReportWriter.php

@@ -57,6 +57,22 @@ public function write(array $dashboard, array $resolvedWidgets): string
     {
         $html = $this->htmlWriter->write(dashboard: $dashboard, resolvedWidgets: $resolvedWidgets);
 
+        // SECURITY: strip `<link rel="stylesheet">` and `@font-face`
+        // src declarations before handing HTML to Dompdf. Dompdf
+        // honours `file://` URLs even when `isRemoteEnabled=false`,
+        // so a stylesheet/font reference smuggled through the
+        // dashboard payload could read arbitrary files off the FS.
+        $html = preg_replace(
+            '#<link[^>]+rel\s*=\s*["\']?stylesheet["\']?[^>]*>#i',
+            '',
+            $html
+        ) ?? $html;
+        $html = preg_replace(
+            '#@font-face\s*\{[^}]*\}#i',
+            '',
+            $html
+        ) ?? $html;
+
         $options = new Options();
         // No remote stylesheet/image fetches — keeps the renderer hermetic.
         $options->set('isRemoteEnabled', false);
@@ -66,6 +82,16 @@ public function write(array $dashboard, array $resolvedWidgets): string
         $options->set('defaultPaperSize', 'A4');
         $options->set('defaultPaperOrientation', 'portrait');
 
+        // SECURITY: assert sandbox flags didn't drift via a future
+        // refactor. Dompdf has a history of SSRF / file-disclosure
+        // CVEs (CVE-2022-41343, CVE-2023-23924); these flags are the
+        // primary mitigation and must stay false.
+        if ($options->getIsRemoteEnabled() !== false || $options->getIsPhpEnabled() !== false) {
+            throw new \RuntimeException(
+                'PdfReportWriter sandbox configuration drifted; remote-fetch / PHP execution must remain disabled.'
+            );
+        }
+
         $dompdf = new Dompdf($options);
         $dompdf->loadHtml($html, 'UTF-8');
         $dompdf->setPaper('A4', 'portrait');