How safe is wp_remote_get and writing to filesystem? - php

Question

I am creating a plugin which makes an API call to a book keeping service and I am integrating it with WooCommerce.
After the order is created I am using woocommerce_email_order_details hook to execute my API call using $response = wp_remote_post( $post_url );, where $post_url is modified so that it all works with the API.
Within this response is also a pdf which I am saving to a folder in the uploads folder using WP_Filesystem() API. This part looks like this:
$response = wp_remote_post( $post_url );
if ( is_wp_error( $response ) ) {
$error_code = wp_remote_retrieve_response_code( $response );
$error_message = wp_remote_retrieve_response_message( $response );
return new WP_Error( $error_code, $error_message );
}
$body = json_decode( $response['body'] );
$pdf_link = esc_url( $body->order->pdf );
$pdf_name = esc_html( $body->order->order_number );
$pdf_get = wp_remote_get( $pdf_link );
if ( is_wp_error( $pdf_get ) ) {
$error_code = wp_remote_retrieve_response_code( $pdf_get );
$error_message = wp_remote_retrieve_response_message( $pdf_get );
return new WP_Error( $error_code, $error_message );
}
$pdf_contents = $pdf_get['body'];
$pdf_name = 'order-' . $pdf_name . '.pdf';
$upload_dir = wp_upload_dir();
$new_dir = $upload_dir['basedir'] . '/orders/' . date( 'Y' ) . '/' . date( 'm' );
if ( ! file_exists( $new_dir ) ) {
wp_mkdir_p( $new_dir );
}
global $wp_filesystem;
if ( empty( $wp_filesystem ) ) {
require_once( ABSPATH . '/wp-admin/includes/file.php' );
WP_Filesystem();
}
$wp_filesystem->put_contents(
$new_dir . '/' . $pdf_name,
$pdf_contents,
FS_CHMOD_FILE // predefined mode settings for WP files.
);
I've tested this with a live link on my local server and it all works.
One thing I don't think I can do is escape the contents of a pdf before saving it because that would break it. Even though this is something that the API of the book keeping service sends me, I don't want to assume anything and take it for granted.
What I am most interested in is: is this safe? Are there any possible vectors of attack here, because I wouldn't want to put my client at a risk.