[jira] [Closed] (OFBIZ-13684) Replace OpenPDF (com.lowagie) with Apache PDFBox and drop the OpenPDF dependency

["Mridul Pathak (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/OFBIZ-13684?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Mridul Pathak closed OFBIZ-13684.
---------------------------------
    Fix Version/s: Upcoming Branch
       Resolution: Fixed

> Replace OpenPDF (com.lowagie) with Apache PDFBox and drop the OpenPDF dependency
> --------------------------------------------------------------------------------
>
>                 Key: OFBIZ-13684
>                 URL: https://issues.apache.org/jira/browse/OFBIZ-13684
>             Project: OFBiz
>          Issue Type: Improvement
>          Components: content, framework/security
>    Affects Versions: Upcoming Branch
>            Reporter: Mridul Pathak
>            Assignee: Mridul Pathak
>            Priority: Minor
>             Fix For: Upcoming Branch
>
>
> OFBiz uses two PDF libraries: Apache PDFBox 3.0.8, which is a direct dependency and also the base of Mustang, and OpenPDF 1.4.2 ({{com.lowagie}}). OpenPDF is only kept for old code in {{PdfSurveyServices}} (survey <-> PDF AcroForm services) and {{SecuredUpload}} ({{isPdfFile}} probe and the JavaScript rejection in {{isValidPdfFile}}). Its newer lines don't fit trunk: 2.1.0+ requires Java 21, and 3.0 renames the package to {{org.openpdf}}.
> Port both classes to PDFBox and remove OpenPDF from {{gradle/libs.versions.toml}} and {{dependencies.gradle}}.
> Acceptance criteria:
> * All survey PDF services in {{services_survey.xml}} keep their inputs, outputs and behaviour.
> * The PDFBox-based JavaScript rejection in {{SecuredUpload}} is at least as strict as the current {{PdfReader.getJavaScript()}} check, and also covers action-based JavaScript (OpenAction, document/page additional actions, annotation actions).
> * No remaining {{com.lowagie}} dependency, direct or transitive.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)