🛡️ Security and Prevention

Mitigation strategies against injection vulnerabilities and Denial of Service (DoS).

The report generation engine processes dynamically inputted data. To protect the integrity of the infrastructure and isolate rendering, strict controls were implemented at both the controller layer and the views.

🛑 Denial of Service (DoS) Mitigation

The generation of PDF files requires building a Document Object Model (DOM) in the web server’s RAM before the final rendering via Dompdf. An attack that intentionally sends hundreds of thousands of records could exhaust the container’s memory.

To avoid this scenario, a dynamic volume validation rule was implemented:

// Dynamic limit control in ReportController.php
$maxItems = $formatoSolicitado === 'pdf' ? 100 : 50000;

$validated = $request->validate([
    'formato'    => 'required|string|in:pdf,csv',
    // ...
    'data.items' => "nullable|array|max:{$maxItems}",
]);

💉 HTML Injection and SSRF Prevention

There is an inherent risk when rendering PDFs from external data: if the detalle field of a transaction contains malicious HTML tags (such as <script>, <iframe> or <link>), the engine could attempt to interpret them, leading to HTML Injection or Server-Side Request Forgery (SSRF).

The architecture neutralizes this threat by delegating sanitization to the native syntax of Laravel Blade:

<td>{{ $item['detalle'] ?? $t['no_detail'] }}</td>

By using the double curly brace syntax , the framework automatically passes the string through PHP’s native htmlspecialchars() function before injecting it into the DOM. This converts any special character into harmless entities (e.g. < becomes <), ensuring that the content is interpreted strictly as plain text and never as executable markup.