[RELEASE] iText 9.0.0

SECURITY.md

@@ -0,0 +1,39 @@
+# iText Security Policy
+
+## Reporting a Vulnerability
+
+We are committed to maintaining the security of our software. If you discover a security vulnerability, we encourage you to report it to us as soon as possible.
+
+To report a vulnerability, please visit our [Vulnerability Reporting Page](https://itextpdf.com/report-vulnerability), or email [[email protected]]([email protected]). If you do not receive a response in 2 business days, please follow up as we may not have received your message.
+
+We follow the procedure of Coordinated Vulnerability Disclosure (CVD) and, to protect the ecosystem, we request that those reporting do the same. Please visit the above page for more information, and follow the steps below to ensure that your report is handled promptly and appropriately:
+
+1. **Do not disclose the vulnerability publicly** until we have had a chance to address it.
+2. **Provide a detailed description** of the vulnerability, including steps to reproduce it, if possible.
+3. **Include any relevant information** such as the version of iText Core you are using, your operating system, and any other pertinent details.
+
+## Security Updates and Patches
+
+ When a vulnerability is reported, we will:
+
+1. **Investigate and verify** the vulnerability.
+2. **Develop and test** a fix for the vulnerability.
+3. **Release a patch** as soon as possible.
+
+## Known Vulnerabilities
+
+The iText Knowledge Base has a page for known [Common Vulnerabilities and Exposures](https://kb.itextpdf.com/itext/cves) (CVEs), please check it to ensure your vulnerability has not already been disclosed or addressed.
+
+## Supported product lines
+
+See [Compatibility Matrix](https://kb.itextpdf.com/itext/compatibility-matrix)
+
+## Security Best Practices
+
+To help ensure the security of your applications using iText Core, we recommend the following best practices:
+
+1. **Keep iText Core up to date** by regularly checking for and applying updates.
+2. **Review and follow** our security guidelines for secure usage.
+3. **Monitor your applications** for any unusual activity and investigate any anomalies promptly.
+
+Thank you for helping us keep iText secure!

barcodes/pom.xml

@@ -5,7 +5,7 @@
   <parent>
     <groupId>com.itextpdf</groupId>
     <artifactId>root</artifactId>
-    <version>8.0.5</version>
+    <version>9.0.0</version>
   </parent>
 
   <artifactId>barcodes</artifactId>

barcodes/src/main/java/com/itextpdf/barcodes/BarcodeDataMatrix.java

@@ -373,28 +373,30 @@ public int setCode(byte[] text, int textOffset, int textSize) {
         switchMode = new int[6][textSize - extOut];
         if (height == 0 || width == 0) {
             last = dmSizes[dmSizes.length - 1];
-            e = getEncodation(text, textOffset + extOut, textSize - extOut, data, extCount, last.dataSize - extCount, options, false);
+            e = getEncodation(text, textOffset + extOut, textSize - extOut, data,
+                    extCount, last.getDataSize() - extCount, options, false);
             if (e < 0) {
                 return DM_ERROR_TEXT_TOO_BIG;
             }
             e += extCount;
             for (k = 0; k < dmSizes.length; ++k) {
-                if (dmSizes[k].dataSize >= e)
+                if (dmSizes[k].getDataSize() >= e)
                     break;
             }
             dm = dmSizes[k];
-            height = dm.height;
-            width = dm.width;
+            height = dm.getHeight();
+            width = dm.getWidth();
         } else {
             for (k = 0; k < dmSizes.length; ++k) {
-                if (height == dmSizes[k].height && width == dmSizes[k].width)
+                if (height == dmSizes[k].getHeight() && width == dmSizes[k].getWidth())
                     break;
             }
             if (k == dmSizes.length) {
                 return DM_ERROR_INVALID_SQUARE;
             }
             dm = dmSizes[k];
-            e = getEncodation(text, textOffset + extOut, textSize - extOut, data, extCount, dm.dataSize - extCount, options, true);
+            e = getEncodation(text, textOffset + extOut, textSize - extOut, data,
+                    extCount, dm.getDataSize() - extCount, options, true);
             if (e < 0) {
                 return DM_ERROR_TEXT_TOO_BIG;
             }
@@ -403,11 +405,12 @@ public int setCode(byte[] text, int textOffset, int textSize) {
         if ((options & DM_TEST) != 0) {
             return DM_NO_ERROR;
         }
-        image = new byte[(dm.width + 2 * ws + 7) / 8 * (dm.height + 2 * ws)];
-        makePadding(data, e, dm.dataSize - e);
-        place = Placement.doPlacement(dm.height - dm.height / dm.heightSection * 2, dm.width - dm.width / dm.widthSection * 2);
-        full = dm.dataSize + (dm.dataSize + 2) / dm.dataBlock * dm.errorBlock;
-        ReedSolomon.generateECC(data, dm.dataSize, dm.dataBlock, dm.errorBlock);
+        image = new byte[(dm.getWidth() + 2 * ws + 7) / 8 * (dm.getHeight() + 2 * ws)];
+        makePadding(data, e, dm.getDataSize() - e);
+        place = Placement.doPlacement(dm.getHeight() - dm.getHeight() /
+                dm.getHeightSection() * 2, dm.getWidth() - dm.getWidth() / dm.getWidthSection() * 2);
+        full = dm.getDataSize() + (dm.getDataSize() + 2) / dm.getDataBlock() * dm.getErrorBlock();
+        ReedSolomon.generateECC(data, dm.getDataSize(), dm.getDataBlock(), dm.getErrorBlock());
         draw(data, full, dm);
         return DM_NO_ERROR;
     }
@@ -849,8 +852,8 @@ private int EdifactEncodation(byte[] text, int textOffset, int textLength, byte[
             if (!sizeFixed && (symbolIndex == text.length - 1 || symbolIndex < 0) && textLength % 4 < 3) {
                 dataSize = Integer.MAX_VALUE;
                 for (int i = 0; i < dmSizes.length; ++i) {
-                    if (dmSizes[i].dataSize >= dataRequired + textLength % 4) {
-                        dataSize = dmSizes[i].dataSize;
+                    if (dmSizes[i].getDataSize() >= dataRequired + textLength % 4) {
+                        dataSize = dmSizes[i].getDataSize();
                         break;
                     }
                 }
@@ -990,8 +993,8 @@ private int EdifactEncodation(byte[] text, int textOffset, int textLength, byte[
         if (!sizeFixed && (symbolIndex == text.length - 1 || symbolIndex < 0)) {
             dataSize = Integer.MAX_VALUE;
             for (int i = 0; i < dmSizes.length; ++i) {
-                if (dmSizes[i].dataSize >= dataOffset + ptrOut + (3 - pedi / 6)) {
-                    dataSize = dmSizes[i].dataSize;
+                if (dmSizes[i].getDataSize() >= dataOffset + ptrOut + (3 - pedi / 6)) {
+                    dataSize = dmSizes[i].getDataSize();
                     break;
                 }
             }
@@ -1183,38 +1186,38 @@ private void setBit(int x, int y, int xByte) {
 
     private void draw(byte[] data, int dataSize, DmParams dm) {
         int i, j, p, x, y, xs, ys, z;
-        int xByte = (dm.width + ws * 2 + 7) / 8;
+        int xByte = (dm.getWidth() + ws * 2 + 7) / 8;
         Arrays.fill(image, (byte) 0);
         //alignment patterns
         //dotted horizontal line
-        for (i = ws; i < dm.height + ws; i += dm.heightSection) {
-            for (j = ws; j < dm.width + ws; j += 2) {
+        for (i = ws; i < dm.getHeight() + ws; i += dm.getHeightSection()) {
+            for (j = ws; j < dm.getWidth() + ws; j += 2) {
                 setBit(j, i, xByte);
             }
         }
         //solid horizontal line
-        for (i = dm.heightSection - 1 + ws; i < dm.height + ws; i += dm.heightSection) {
-            for (j = ws; j < dm.width + ws; ++j) {
+        for (i = dm.getHeightSection() - 1 + ws; i < dm.getHeight() + ws; i += dm.getHeightSection()) {
+            for (j = ws; j < dm.getWidth() + ws; ++j) {
                 setBit(j, i, xByte);
             }
         }
         //solid vertical line
-        for (i = ws; i < dm.width + ws; i += dm.widthSection) {
-            for (j = ws; j < dm.height + ws; ++j) {
+        for (i = ws; i < dm.getWidth() + ws; i += dm.getWidthSection()) {
+            for (j = ws; j < dm.getHeight() + ws; ++j) {
                 setBit(i, j, xByte);
             }
         }
         //dotted vertical line
-        for (i = dm.widthSection - 1 + ws; i < dm.width + ws; i += dm.widthSection) {
-            for (j = 1 + ws; j < dm.height + ws; j += 2) {
+        for (i = dm.getWidthSection() - 1 + ws; i < dm.getWidth() + ws; i += dm.getWidthSection()) {
+            for (j = 1 + ws; j < dm.getHeight() + ws; j += 2) {
                 setBit(i, j, xByte);
             }
         }
         p = 0;
-        for (ys = 0; ys < dm.height; ys += dm.heightSection) {
-            for (y = 1; y < dm.heightSection - 1; ++y) {
-                for (xs = 0; xs < dm.width; xs += dm.widthSection) {
-                    for (x = 1; x < dm.widthSection - 1; ++x) {
+        for (ys = 0; ys < dm.getHeight(); ys += dm.getHeightSection()) {
+            for (y = 1; y < dm.getHeightSection() - 1; ++y) {
+                for (xs = 0; xs < dm.getWidth(); xs += dm.getWidthSection()) {
+                    for (x = 1; x < dm.getWidthSection() - 1; ++x) {
                         z = place[p++];
                         if (z == 1 || z > 1 && (data[z / 8 - 1] & 0xff & 128 >> z % 8) != 0)
                             setBit(x + xs + ws, y + ys + ws, xByte);

barcodes/src/main/java/com/itextpdf/barcodes/BarcodePDF417.java

@@ -1267,7 +1267,7 @@ protected int getTextTypeAndValue(int maxLength, int idx) {
     protected boolean checkSegmentType(Segment segment, char type) {
         if (segment == null)
             return false;
-        return segment.type == type;
+        return segment.getType() == type;
     }
 
     /**
@@ -1280,7 +1280,7 @@ protected boolean checkSegmentType(Segment segment, char type) {
     protected int getSegmentLength(Segment segment) {
         if (segment == null)
             return 0;
-        return segment.end - segment.start;
+        return segment.getEnd() - segment.getStart();
     }
 
 
@@ -1332,19 +1332,19 @@ protected void assemble() {
         cwPtr = 1;
         for (k = 0; k < segmentList.size(); ++k) {
             Segment v = segmentList.get(k);
-            switch (v.type) {
+            switch (v.getType()) {
                 case 'T':
                     if (k != 0)
                         codewords[cwPtr++] = TEXT_MODE;
-                    textCompaction(v.start, getSegmentLength(v));
+                    textCompaction(v.getStart(), getSegmentLength(v));
                     break;
                 case 'N':
                     codewords[cwPtr++] = NUMERIC_MODE;
-                    numberCompaction(v.start, getSegmentLength(v));
+                    numberCompaction(v.getStart(), getSegmentLength(v));
                     break;
                 case 'B':
                     codewords[cwPtr++] = getSegmentLength(v) % 6 != 0 ? BYTE_MODE : BYTE_MODE_6;
-                    byteCompaction(v.start, getSegmentLength(v));
+                    byteCompaction(v.getStart(), getSegmentLength(v));
                     break;
             }
         }
@@ -1384,12 +1384,12 @@ protected void dumpList() {
             int len = getSegmentLength(v);
             char[] c = new char[len];
             for (int j = 0; j < len; ++j) {
-                c[j] = (char) (code[v.start + j] & 0xff);
+                c[j] = (char) (code[v.getStart() + j] & 0xff);
                 if (c[j] == '\r')
                     c[j] = '\n';
             }
             StringBuffer sb = new StringBuffer();
-            sb.append(v.type);
+            sb.append(v.getType());
             sb.append(c);
             System.out.println(sb.toString());
         }
@@ -1501,7 +1501,7 @@ void breakString() {
             if (checkSegmentType(v, 'B') && getSegmentLength(v) == 1) {
                 if (checkSegmentType(vp, 'T') && checkSegmentType(vn, 'T')
                         && getSegmentLength(vp) + getSegmentLength(vn) >= 3) {
-                    vp.end = vn.end;
+                    vp.setEnd(vn.getEnd());
                     segmentList.remove(k);
                     segmentList.remove(k);
                     k = -1;
@@ -1518,13 +1518,13 @@ && getSegmentLength(vp) + getSegmentLength(vn) >= 3) {
                 boolean redo = false;
                 if (checkSegmentType(vp, 'B') && getSegmentLength(vp) == 1 || checkSegmentType(vp, 'T')) {
                     redo = true;
-                    v.start = vp.start;
+                    v.setStart(vp.getStart());
                     segmentList.remove(k - 1);
                     --k;
                 }
                 if (checkSegmentType(vn, 'B') && getSegmentLength(vn) == 1 || checkSegmentType(vn, 'T')) {
                     redo = true;
-                    v.end = vn.end;
+                    v.setEnd(vn.getEnd());
                     segmentList.remove(k + 1);
                 }
                 if (redo) {
@@ -1542,13 +1542,13 @@ && getSegmentLength(vp) + getSegmentLength(vn) >= 3) {
                 boolean redo = false;
                 if (checkSegmentType(vp, 'T') && getSegmentLength(vp) < 5 || checkSegmentType(vp, 'B')) {
                     redo = true;
-                    v.start = vp.start;
+                    v.setStart(vp.getStart());
                     segmentList.remove(k - 1);
                     --k;
                 }
                 if (checkSegmentType(vn, 'T') && getSegmentLength(vn) < 5 || checkSegmentType(vn, 'B')) {
                     redo = true;
-                    v.end = vn.end;
+                    v.setEnd(vn.getEnd());
                     segmentList.remove(k + 1);
                 }
                 if (redo) {
@@ -1558,14 +1558,14 @@ && getSegmentLength(vp) + getSegmentLength(vn) >= 3) {
             }
         }
         // check if all numbers
-        if (segmentList.size() == 1 && (v = segmentList.get(0)).type == 'T' && getSegmentLength(v) >= 8) {
-            for (k = v.start; k < v.end; ++k) {
+        if (segmentList.size() == 1 && (v = segmentList.get(0)).getType() == 'T' && getSegmentLength(v) >= 8) {
+            for (k = v.getStart(); k < v.getEnd(); ++k) {
                 c = (char) (code[k] & 0xff);
                 if (c < '0' || c > '9')
                     break;
             }
-            if (k == v.end)
-                v.type = 'N';
+            if (k == v.getEnd())
+                v.setType('N');
         }
     }
 
@@ -1789,9 +1789,9 @@ private void textCompaction(byte[] input, int start, int length) {
      * A container that encapsulates all data needed for a segment.
      */
     protected static class Segment {
-        public char type;
-        public int start;
-        public int end;
+        private char type;
+        private int start;
+        private int end;
 
         /**
          * Creates a new {@link Segment} instance.
@@ -1805,6 +1805,60 @@ public Segment(char type, int start, int end) {
             this.start = start;
             this.end = end;
         }
+
+        /**
+         * Retrieves the type of the segment.
+         *
+         * @return segment type
+         */
+        public char getType() {
+            return type;
+        }
+
+        /**
+         * Sets the type of the segment.
+         *
+         * @param type segment type
+         */
+        public void setType(char type) {
+            this.type = type;
+        }
+
+        /**
+         * Retrieves the start of the segment.
+         *
+         * @return segment start
+         */
+        public int getStart() {
+            return start;
+        }
+
+        /**
+         * Sets the start of the segment.
+         *
+         * @param start segment start
+         */
+        public void setStart(int start) {
+            this.start = start;
+        }
+
+        /**
+         * Retrieves the end of the segment.
+         *
+         * @return segment end
+         */
+        public int getEnd() {
+            return end;
+        }
+
+        /**
+         * Sets the end of the segment.
+         *
+         * @param end segment end
+         */
+        public void setEnd(int end) {
+            this.end = end;
+        }
     }
 
     /**

barcodes/src/main/java/com/itextpdf/barcodes/BarcodePostnet.java

@@ -35,8 +35,8 @@ This file is part of the iText (R) project.
  */
 public class BarcodePostnet extends Barcode1D {
 
-    public static int TYPE_POSTNET = 1;
-    public static int TYPE_PLANET = 2;
+    public static final int TYPE_POSTNET = 1;
+    public static final int TYPE_PLANET = 2;
 
     /**
      * The bars for each character.