Remote Resources

By default tc-lib-pdf does not fetch remote URLs. Images, fonts, and SVG files referenced by HTTP or HTTPS are blocked unless you explicitly allow the originating hosts. Local file reads are split between internal library IO and markup-originated resource loads, with separate allowlists.

How Remote Access Is Controlled

Remote access is configured through the optional fileOptions array passed as the last argument to the Tcpdf constructor (and forwarded to initClassObjects()).

$pdf = new \Com\Tecnick\Pdf\Tcpdf(
    unit: 'mm',
    fileOptions: [
        'allowedHosts' => ['cdn.example.com', 'assets.myapp.io'],
    ],
);

Only the listed host names are permitted. Any attempt to load a resource from an unlisted host is silently blocked.

The same list applies to signature network requests: the Time Stamping Authority host set with setSignTimeStamp() and the OCSP and CRL endpoints used for LTV material must be listed, otherwise the request is refused. The timestamp request follows no redirects and uses HTTP or HTTPS only. See /docs/digital-signatures/.

An entry takes one of two forms: example.com constrains the host only and matches it on any port, while example.com:8080 names one origin and matches only that port. A URL that omits the port is matched against the scheme default, so example.com:443 matches https://example.com/. An IPv6 host must be listed in its bracketed form ([::1], [::1]:8080) and an internationalized domain as its A-label (punycode) form. Matching is case-insensitive and a trailing root dot is ignored.

Redirects are refused unless CURLOPT_MAXREDIRS is positive; when they are allowed, each Location target is validated against allowedHosts before it is followed. A redirect that is not followed is reported as a failed read, never as content.

Restricting Local Paths

The allowedPaths key controls which local path prefixes may be read by the shared file helper for internal library IO, such as temp-backed signing flows, fonts, PDF import sources, and other explicit file operations.

• If you omit allowedPaths, tc-lib-pdf computes a default trusted set.
• If you pass allowedPaths, your list replaces the defaults (it is not merged).

The computed defaults come from trusted local roots, including:

• The system temp directory.
• The tc-lib-pdf package root.
• The vendor/tecnickcom directory holding the sibling tecnickcom packages, when tc-lib-pdf is itself installed as a Composer dependency.
• K_PATH_FONTS when that constant is defined and resolves to a real path.

Paths outside these roots, such as project asset directories, are rejected until you list them explicitly.

These defaults are returned by Com\Tecnick\Pdf\Base::defaultFileAllowedPaths().

The markupAllowedPaths key controls which local path prefixes may be read when resources are referenced by rendered HTML, CSS, or SVG markup.

• If you omit markupAllowedPaths and provide allowedPaths, tc-lib-pdf reuses your explicit allowedPaths list for markup.
• If you omit both keys, tc-lib-pdf computes a stricter markup default that excludes the system temp directory.
• If you pass markupAllowedPaths, your list replaces markup defaults (it is not merged).

The stricter markup defaults are returned by Com\Tecnick\Pdf\Base::defaultMarkupAllowedPaths().

Windows absolute paths with drive letters are supported as long as they are absolute and match a trusted root after path normalization. You can supply them in native form (C:\...) or normalized form (C:/...); using the same canonical format for both the allowlist and the resource path is the safest option.

$pdf = new \Com\Tecnick\Pdf\Tcpdf(
    unit: 'mm',
    fileOptions: [
        'allowedPaths' => [
            (string) realpath(sys_get_temp_dir()),
            (string) realpath(__DIR__ . '/../storage/pdf-assets'),
            (string) realpath(__DIR__ . '/../vendor/tecnickcom/tc-lib-pdf-font/target/fonts'),
        ],
        'markupAllowedPaths' => [
            (string) realpath(__DIR__ . '/../storage/pdf-assets'),
            (string) realpath(__DIR__ . '/../vendor/tecnickcom/tc-lib-pdf-font/target/fonts'),
        ],
    ],
);

When you override allowedPaths, include every local directory needed for trusted internal operations, such as temp-backed signature files, image fixtures, custom font directories, and cache-backed assets.

When you override markupAllowedPaths, include only directories that should be reachable from rendered markup.

TCPDF 7.x

tecnickcom/tcpdf 7.x configures the same file layer through constants defined before tcpdf.php is loaded: K_ALLOWED_HOSTS for remote hosts, K_ALLOWED_PATHS for local directories, K_MAX_REMOTE_SIZE, and K_CURLOPTS. K_ALLOWED_PATHS is merged on top of the built-in roots (the system temp directory, K_PATH_MAIN, the vendor/tecnickcom directory, the working directory, K_PATH_FONTS, K_PATH_IMAGES, and the directory of the running script) and never narrows them.

Resources referenced by HTML, CSS, and SVG markup in writeHTML() and writeHTMLCell() use the same list without the system temp directory. List the temp directory in K_ALLOWED_PATHS to allow markup to read from it; leave it out when rendering untrusted markup. Image(), including its mask image, Annotation() file attachments, and setHyphenPatterns() read only paths inside the allowlist.

define('K_ALLOWED_HOSTS', ['cdn.example.com']);
define('K_ALLOWED_PATHS', ['/var/www/shared/assets/']);
require_once 'vendor/autoload.php';

fileOptions Reference

Example: Pinning TLS and Setting a Short Timeout

$pdf = new \Com\Tecnick\Pdf\Tcpdf(
    unit: 'mm',
    fileOptions: [
        'allowedHosts'  => ['cdn.example.com'],
        'allowedPaths'  => [
            (string) realpath(sys_get_temp_dir()),
            (string) realpath(__DIR__ . '/../storage/pdf-assets'),
            (string) realpath(__DIR__ . '/../vendor/tecnickcom/tc-lib-pdf-font/target/fonts'),
        ],
        'markupAllowedPaths' => [
            (string) realpath(__DIR__ . '/../storage/pdf-assets'),
            (string) realpath(__DIR__ . '/../vendor/tecnickcom/tc-lib-pdf-font/target/fonts'),
        ],
        'maxRemoteSize' => 10 * 1024 * 1024,
        'curlopts'      => [
            CURLOPT_TIMEOUT        => 10,
            CURLOPT_CONNECTTIMEOUT => 5,
        ],
        'fixedCurlOpts' => [
            CURLOPT_SSL_VERIFYPEER => true,
            CURLOPT_SSL_VERIFYHOST => 2,
        ],
    ],
);

Operational Guidance

• Prefer explicit host allowlists rather than wildcards.
• Configure allowedPaths for trusted internal operations and markupAllowedPaths for rendered markup paths.
• Keep markupAllowedPaths narrower than allowedPaths when possible.
• Keep maxRemoteSize conservative when users can influence asset URLs.
• Use fixedCurlOpts when you need organization-wide TLS constraints that downstream code must not weaken.
• Treat remote resource access as an integration boundary, not a convenience default.

Related Guides

• Fonts and local font preparation: /docs/fonts/
• Digital signature workflows: /docs/digital-signatures/
• PDF import behavior and constraints: /docs/pdf-import/

Previous: /docs/enums/

Overview: /docs/

Next: /docs/digital-signatures/