Maruan Sahyoun created PDFBOX-6242:
--------------------------------------
Summary: XFDF export allows characters illegal in XML 1.0
Key: PDFBOX-6242
URL: https://issues.apache.org/jira/browse/PDFBOX-6242
Project: PDFBox
Issue Type: Bug
Components: PDModel
Affects Versions: 3.0.8 PDFBox, 2.0.37, 4.0.0
Reporter: Maruan Sahyoun
Assignee: Maruan Sahyoun
XFDF export is intended to produce XML 1.0-safe output but has two gaps:
* C0 control characters (e.g. 0x00–0x08, 0x0B, 0x0C, 0x0E–0x1F) are not
filtered. They're written verbatim since they aren't one of the five escaped
special characters. These code points are outside the legal Char production in
the XML 1.0 spec, and per the XML errata, a numeric character reference to an
illegal code point (e.g. ) is equally non-well-formed — so there's no fix by
escaping alone; these characters must be rejected, stripped, or replaced.
* The method iterates by UTF-16 char, not by Unicode code point.
Supplementary-plane characters are represented as surrogate pairs in Java; each
surrogate half is > 0x7e and gets emitted as its own &#N; reference, where N
falls in 0xD800–0xDFFF. Surrogate values are explicitly excluded from the legal
Char range, so this also produces non-well-formed XML.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
