Hello! Earlier this year I found an interesting logic quirk in an open source library, and now I wrote a medium article about it.

This is my first article ever, so any feedback is appreciated.

TLDR: mPDF is an open source PHP library for generating PDFs from HTML. Because of some logic quirks, it is possible to trigger web requests by providing it with a crafted input, even in cases where it is sanitized.

This post is not about a vulnerability! Just an unexpected behavior I found when researching an open source lib. (It was rejected by MITRE for a CVE)