fix: WeasyPrint URL fetcher + attachment improvements + webhook error propagation + WebSocket conversation check + RLS disabled on system tables (bootstrap fix)

app/plugins/builtins/report_generator/pdf_generator.py

@@ -130,9 +130,23 @@ def render_template_string(template_content: str, data: dict[str, Any]) -> str:
     return template.render(**data)
 
 
+def _safe_url_fetcher(url: str, timeout: int = 10) -> dict:
+    """URL fetcher that only allows data: URIs and blocks external resources.
+
+    Prevents SSRF and local file access via WeasyPrint.
+    """
+    if url.startswith('data:'):
+        from weasyprint import default_url_fetcher
+        return default_url_fetcher(url, timeout)
+    # Block all external URLs (http, https, file, etc.)
+    raise ValueError(f"External resource blocked by URL fetcher: {url}")
+
+
 def generate_pdf(html_content: str) -> bytes:
     """Generate a PDF from HTML content using WeasyPrint.
 
+    Uses a safe URL fetcher that blocks external resources (SSRF protection).
+
     Args:
         html_content: Valid HTML string
 
@@ -141,7 +155,7 @@ def generate_pdf(html_content: str) -> bytes:
     """
     from weasyprint import HTML
 
-    pdf = HTML(string=html_content).write_pdf()
+    pdf = HTML(string=html_content, url_fetcher=_safe_url_fetcher).write_pdf()
     return pdf