iText 5 Documentation
repository·develop·Indexed 23 days ago
https://github.com/itext/itextpdfA legacy Java library for creating and manipulating PDF documents. Now in End-of-Life (EOL) status and succeeded by iText 9, it continues to receive security fixes. The library includes core functionality (itextpdf), extra features (itext-xtra), PDF/A support (itext-pdfa), and XML/HTML functionality (xmlworker). Key components include GeneralPath for geometry manipulation, GroupedRandomAccessSource for handling multiple data sources, and CJKFont for Asian font management.
What's inside iText 5
- If you modify the Program and your version supports remote interaction through a computer network, you must prominently offer all users interacting with it remotely an opportunity to receive the Corresponding Source of your version. This must be provided by offering access to the Corresponding Source from a network server at no charge through standard or customary means.
Verify licenses for hyphenation XML files
developThe XML files located in
com/itextpdf/text/pdf/hyphenation/hyphare not part of the iText project itself. While many are shared with the Apache FOP project and available under an Apache license, some files were provided by individual developers from various sources.Important: You must check the header of each individual XML file you intend to use to determine its specific license.
Requirements for User Products and Installation Information
developIf you convey an object code work specifically for use in a User Product (a consumer product like personal/household property or items for dwellings) and the right of possession is transferred to the recipient, you must also provide Installation Information.
Installation Information includes:
- Methods, procedures, authorization keys, or other information required to install and execute modified versions of the covered work from its Corresponding Source.
- This information must ensure that the continued functioning of the modified object code is not prevented or interfered with solely because of the modification.
- The information must be in a publicly documented format that requires no special password or key for unpacking, reading, or copying.
Conveying modified source versions under AGPLv3
developWhen you distribute a work based on the Program (a modified version) in source code form, you must satisfy the following conditions:
- Modification Notices: The work must carry prominent notices stating that you modified it and providing a relevant date.
- License Notice: The work must carry prominent notices stating that it is released under the GNU Affero General Public License (AGPLv3) and any conditions added under section 7.
- Full Work Licensing: You must license the entire work, as a whole, under this License to anyone who receives a copy. The License applies to the whole of the work and all its parts, regardless of packaging.
- Interactive Interfaces: If the work has interactive user interfaces, each must display "Appropriate Legal Notices" (copyright notice and warranty disclaimer). However, if the original Program's interfaces did not display these, your modified version is not required to add them.
Apply the GNU Affero General Public License to your new programs
developTo distribute a new program under the GNU Affero General Public License (AGPL), you should attach specific notices to your source files. It is recommended to place these at the start of each source file to clearly state the exclusion of warranty. Each file should include at least a copyright line and a pointer to the full license notice.
If your software interacts with users remotely via a computer network (e.g., a web application), you must also provide a way for users to obtain the source code, such as a "Source" link in the interface that leads to a code archive.
Additionally, you should provide contact information via electronic and paper mail and, if applicable, obtain a copyright disclaimer from your employer or school.
<one line to give the program's name and a brief idea of what it does.> Copyright (C) <year> <name of author> This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more details. You should have received a copy of the GNU Affero General Public License along with this program. If not, see <http://www.gnu.org/licenses/>.Conveying non-source (object code) forms under AGPLv3
developTo convey a covered work in object code form, you must also convey the machine-readable Corresponding Source using one of the following methods:
- Physical Product: Include the object code in/on a physical product accompanied by the Corresponding Source on a durable physical medium.
- Written Offer: Accompany the object code with a written offer (valid for at least 3 years and as long as spare parts/support are offered) to provide the Corresponding Source either on a durable physical medium (at a reasonable cost) or via network access at no charge.
- Occasional/Noncommercial: Convey individual copies of object code with a written offer to provide source (only allowed occasionally and noncommercially if you received the object code with such an offer).
- Network Access: Offer access to the object code from a designated place and offer equivalent access to the Corresponding Source from the same place at no further charge.
- Peer-to-Peer: Use peer-to-peer transmission, provided you inform peers where the object code and Corresponding Source are offered for free via a designated network server.
Migrate from iText 5 to iText 9
developiText 5 is End-of-Life (EOL) and only receives security fixes. For new projects, or to upgrade existing ones, it is highly recommended to move to iText 9.
Key improvements in iText 9 include:
- HTML to PDF (PDF/UA) conversion
- Wider PDF standards support (e.g., PDF/A-4, PDF/UA-2, WTPDF)
- PDF Redaction
- SVG support
- Improved language support (Indic, Thai, Khmer, Arabic, Hebrew via close-source addon)
- PDF Debugging for IDEs
- Data Extraction
- More modular and extensible document workflows
- Enhanced Encryption, hashing, and digital signatures
Mitigate commons-io vulnerabilities in iText 5
developiText 5 modules targeting Java 5 use a version of
commons-io:commons-iothat is vulnerable to certain CVEs (e.g., CVE-2021-29425).If your project uses Java 8 or higher, you can mitigate these vulnerabilities by specifying a direct dependency on the latest version of
commons-io:commons-io. The version used by iText is compatible with the latest releases ofcommons-io.Handle xmlsec vulnerabilities and Java compatibility
developiText 5 targets Java 5, which prevents upgrading
org.apache.santuario:xmlsecto version 2.x.x or newer (which requires Java 8).If you are not using the
com.itextpdf.text.pdf.security.MakeXmlSignatureclass, you can avoid adding theorg.apache.santuario:xmlsecdependency to your project entirely to avoid related vulnerabilities.If you are using
com.itextpdf.text.pdf.security.MakeXmlSignature(e.g., for XFA signatures), you have two options:- Use
org.apache.santuario:xmlsec1.5.8: This works on Java 5+ but is affected by known vulnerabilities. - Use
org.apache.santuario:xmlsec2.1.7 or newer: This requires Java 8+ and may affect the output format.
- Use
Identify iText 5 core and extra JAR files
developThe iText 5 release is composed of several JAR files depending on the functionality required:
itextpdf-x.y.z.jar: The core library.itext-xtra-x.y.z.jar: Extra functionality (PDF 2!).itext-pdfa-x.y.z.jar: PDF/A-related functionality.xmlworker-x.y.z.jar: XML (and HTML) functionality.
Get the CID code for a character
developUsegetCidCode(int c)to retrieve the CID (Character Identifier) code for a given Unicode character within aCJKFont. This is necessary for low-level PDF operations where the CID is required instead of the Unicode value.Verify if a font is a valid CJK font
developUse
CJKFont.isCJKFont(String fontName, String enc)to check if a specific font name and encoding combination is recognized as a valid CJK font within the iText Asian font pack. This is useful for validating font configurations before attempting to render CJK text.Returns
trueif the font is a valid CJK font,falseotherwise.