Add basic protection against PHAR deserialization

This also includes an option to disable external file references. This applies to images and fonts. External file references are allowed by default, but future version will disallow by default.

Author: bsweeney

src/Svg/Document.php

@@ -53,6 +53,8 @@ class Document extends AbstractTag
     /** @var \Sabberworm\CSS\CSSList\Document[] */
     protected $styleSheets = array();
 
+    public $allowExternalReferences = true;
+
     public function loadFile($filename)
     {
         $this->filename = $filename;

src/Svg/Style.php

@@ -139,6 +139,16 @@ public function fromStyleSheets(AbstractTag $tag, $attributes) {
                         break;
                     }
                 }
+
+                if (
+                    \array_key_exists("font-family", $styles)
+                    && (
+                        \strtolower(\substr($this->href, 0, 7)) === "phar://"
+                        || ($this->document->allowExternalReferences === false && \strtolower(\substr($this->href, 0, 5)) !== "data:")
+                    )
+                ) {
+                    unset($style["font-family"]);
+                }
             }
         }
 

src/Svg/Tag/Image.php

@@ -58,6 +58,10 @@ public function start($attributes)
 
         $this->document->getSurface()->transform(1, 0, 0, -1, 0, $height);
 
+        if (\strtolower(\substr($this->href, 0, 7)) === "phar://" || ($this->document->allowExternalReferences === false && \strtolower(\substr($this->href, 0, 5) !== "data:"))) {
+            return;
+        }
+
         $this->document->getSurface()->drawImage($this->href, $this->x, $this->y, $this->width, $this->height);
     }