For generating PDFs in our web application we have a simple service that accepts a chunk of HTML from the client, wraps it in a standard template, does a couple of simple transforms (like replacing image URLs with inline base64 strings) and renders it as a PDF.
For testing and debugging it is often useful to see what HTML is getting passed to the PDF generator after the wrapping/transform step. However, I'm not entirely convinced that adding this option isn't going to expose some sort of security issue.
If a user is allowed to POST a chunk of arbitrary HTML that gets returned back to them, is there some way that an attacker could take advantage of this?