pjfanning opened a new pull request, #1460: URL: https://github.com/apache/poi/pull/1460
Same issue as #1455, but for `WordToFoConverter`: `processHyperlink` copied the HYPERLINK field target into the `external-destination` of `fo:basic-link` without any check. Now the FO converter applies the same `WordToHtmlUtils.isSafeHyperlink` check as the HTML converter. A target like `javascript:` keeps its text but is not emitted as a link. Links to http(s), mailto, file, relative paths, etc. are unchanged. How much this matters depends on the FO processor: - FOP writes a non-file target as a PDF `/URI` action. Mainstream PDF viewers (Acrobat, pdf.js) don't run `javascript:` URIs, so the PDF case is mostly harmless. - FO is not only rendered to PDF, though (e.g. FO → HTML/RTF), and the check costs nothing, so the FO converter now behaves the same as the HTML converter. Note: in FOP, a `file:` / drive / UNC target that does not end in `.pdf` becomes a PDF `/Launch` action. Viewers prompt for or block these, and Word documents legitimately link to local files, so this PR leaves them alone. Users who want to drop them could use the validator proposed in #1459, once it is also available on the FO converter. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
