Author: tilman
Date: Thu Aug 20 10:26:48 2026
New Revision: 1937265
Log:
PDFBOX-2941: escape font name
Modified:
pdfbox/branches/3.0/debugger/src/main/java/org/apache/pdfbox/debugger/streampane/tooltip/FontToolTip.java
Modified:
pdfbox/branches/3.0/debugger/src/main/java/org/apache/pdfbox/debugger/streampane/tooltip/FontToolTip.java
==============================================================================
---
pdfbox/branches/3.0/debugger/src/main/java/org/apache/pdfbox/debugger/streampane/tooltip/FontToolTip.java
Thu Aug 20 10:17:16 2026 (r1937264)
+++
pdfbox/branches/3.0/debugger/src/main/java/org/apache/pdfbox/debugger/streampane/tooltip/FontToolTip.java
Thu Aug 20 10:26:48 2026 (r1937265)
@@ -63,10 +63,54 @@ final class FontToolTip implements ToolT
}
if (font != null)
{
- markup = "<html>" + font.getName() + "</html>";
+ markup = "<html>" + escapeHtml(font.getName()) + "</html>";
}
}
+ /**
+ * Escape a document-derived string so that Swing's HTML renderer treats
it as inert text. Font
+ * names come straight from the PDF (the /BaseFont entry) and may contain
arbitrary characters,
+ * including markup such as <img> tags whose URLs Swing would fetch
when the tooltip is
+ * shown.
+ *
+ * @param text the raw text, may be null
+ * @return the escaped text, or null if text was null
+ */
+ private static String escapeHtml(String text)
+ {
+ if (text == null)
+ {
+ return null;
+ }
+ StringBuilder sb = new StringBuilder(text.length());
+ for (int i = 0; i < text.length(); i++)
+ {
+ char c = text.charAt(i);
+ switch (c)
+ {
+ case '<':
+ sb.append("<");
+ break;
+ case '>':
+ sb.append(">");
+ break;
+ case '&':
+ sb.append("&");
+ break;
+ case '"':
+ sb.append(""");
+ break;
+ case '\'':
+ sb.append("'");
+ break;
+ default:
+ sb.append(c);
+ break;
+ }
+ }
+ return sb.toString();
+ }
+
private String extractFontReference(String rowText)
{
return rowText.trim().split(" ")[0].substring(1);
