iText 5 Documentation

repository·develop·Indexed 23 days ago

https://github.com/itext/itextpdf

A legacy Java library for creating and manipulating PDF documents. Now in End-of-Life (EOL) status and succeeded by iText 9, it continues to receive security fixes. The library includes core functionality (itextpdf), extra features (itext-xtra), PDF/A support (itext-pdfa), and XML/HTML functionality (xmlworker). Key components include GeneralPath for geometry manipulation, GroupedRandomAccessSource for handling multiple data sources, and CJKFont for Asian font management.

Tokens
3.4K
Snippets
1
Records
22
Agent score
82%

What's inside iText 5

  1. Remote Network Interaction requirements

    develop
    If you modify the Program and your version supports remote interaction through a computer network, you must prominently offer all users interacting with it remotely an opportunity to receive the Corresponding Source of your version. This must be provided by offering access to the Corresponding Source from a network server at no charge through standard or customary means.
  2. Verify licenses for hyphenation XML files

    develop

    The XML files located in com/itextpdf/text/pdf/hyphenation/hyph are not part of the iText project itself. While many are shared with the Apache FOP project and available under an Apache license, some files were provided by individual developers from various sources.

    Important: You must check the header of each individual XML file you intend to use to determine its specific license.

  3. Requirements for User Products and Installation Information

    develop

    If you convey an object code work specifically for use in a User Product (a consumer product like personal/household property or items for dwellings) and the right of possession is transferred to the recipient, you must also provide Installation Information.

    Installation Information includes:

    • Methods, procedures, authorization keys, or other information required to install and execute modified versions of the covered work from its Corresponding Source.
    • This information must ensure that the continued functioning of the modified object code is not prevented or interfered with solely because of the modification.
    • The information must be in a publicly documented format that requires no special password or key for unpacking, reading, or copying.
  4. Conveying modified source versions under AGPLv3

    develop

    When you distribute a work based on the Program (a modified version) in source code form, you must satisfy the following conditions:

    1. Modification Notices: The work must carry prominent notices stating that you modified it and providing a relevant date.
    2. License Notice: The work must carry prominent notices stating that it is released under the GNU Affero General Public License (AGPLv3) and any conditions added under section 7.
    3. Full Work Licensing: You must license the entire work, as a whole, under this License to anyone who receives a copy. The License applies to the whole of the work and all its parts, regardless of packaging.
    4. Interactive Interfaces: If the work has interactive user interfaces, each must display "Appropriate Legal Notices" (copyright notice and warranty disclaimer). However, if the original Program's interfaces did not display these, your modified version is not required to add them.
  5. Apply the GNU Affero General Public License to your new programs

    develop

    To distribute a new program under the GNU Affero General Public License (AGPL), you should attach specific notices to your source files. It is recommended to place these at the start of each source file to clearly state the exclusion of warranty. Each file should include at least a copyright line and a pointer to the full license notice.

    If your software interacts with users remotely via a computer network (e.g., a web application), you must also provide a way for users to obtain the source code, such as a "Source" link in the interface that leads to a code archive.

    Additionally, you should provide contact information via electronic and paper mail and, if applicable, obtain a copyright disclaimer from your employer or school.

    <one line to give the program's name and a brief idea of what it does.>
    Copyright (C) <year>  <name of author>
    
    This program is free software: you can redistribute it and/or modify
    it under the terms of the GNU Affero General Public License as published by
    the Free Software Foundation, either version 3 of the License, or
    (at your option) any later version.
    
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU Affero General Public License for more details.
    
    You should have received a copy of the GNU Affero General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  6. Conveying non-source (object code) forms under AGPLv3

    develop

    To convey a covered work in object code form, you must also convey the machine-readable Corresponding Source using one of the following methods:

    • Physical Product: Include the object code in/on a physical product accompanied by the Corresponding Source on a durable physical medium.
    • Written Offer: Accompany the object code with a written offer (valid for at least 3 years and as long as spare parts/support are offered) to provide the Corresponding Source either on a durable physical medium (at a reasonable cost) or via network access at no charge.
    • Occasional/Noncommercial: Convey individual copies of object code with a written offer to provide source (only allowed occasionally and noncommercially if you received the object code with such an offer).
    • Network Access: Offer access to the object code from a designated place and offer equivalent access to the Corresponding Source from the same place at no further charge.
    • Peer-to-Peer: Use peer-to-peer transmission, provided you inform peers where the object code and Corresponding Source are offered for free via a designated network server.
  7. Migrate from iText 5 to iText 9

    develop

    iText 5 is End-of-Life (EOL) and only receives security fixes. For new projects, or to upgrade existing ones, it is highly recommended to move to iText 9.

    Key improvements in iText 9 include:

    • HTML to PDF (PDF/UA) conversion
    • Wider PDF standards support (e.g., PDF/A-4, PDF/UA-2, WTPDF)
    • PDF Redaction
    • SVG support
    • Improved language support (Indic, Thai, Khmer, Arabic, Hebrew via close-source addon)
    • PDF Debugging for IDEs
    • Data Extraction
    • More modular and extensible document workflows
    • Enhanced Encryption, hashing, and digital signatures
  8. Mitigate commons-io vulnerabilities in iText 5

    develop

    iText 5 modules targeting Java 5 use a version of commons-io:commons-io that is vulnerable to certain CVEs (e.g., CVE-2021-29425).

    If your project uses Java 8 or higher, you can mitigate these vulnerabilities by specifying a direct dependency on the latest version of commons-io:commons-io. The version used by iText is compatible with the latest releases of commons-io.

  9. Handle xmlsec vulnerabilities and Java compatibility

    develop

    iText 5 targets Java 5, which prevents upgrading org.apache.santuario:xmlsec to version 2.x.x or newer (which requires Java 8).

    If you are not using the com.itextpdf.text.pdf.security.MakeXmlSignature class, you can avoid adding the org.apache.santuario:xmlsec dependency to your project entirely to avoid related vulnerabilities.

    If you are using com.itextpdf.text.pdf.security.MakeXmlSignature (e.g., for XFA signatures), you have two options:

    1. Use org.apache.santuario:xmlsec 1.5.8: This works on Java 5+ but is affected by known vulnerabilities.
    2. Use org.apache.santuario:xmlsec 2.1.7 or newer: This requires Java 8+ and may affect the output format.
  10. Identify iText 5 core and extra JAR files

    develop

    The iText 5 release is composed of several JAR files depending on the functionality required:

    • itextpdf-x.y.z.jar: The core library.
    • itext-xtra-x.y.z.jar: Extra functionality (PDF 2!).
    • itext-pdfa-x.y.z.jar: PDF/A-related functionality.
    • xmlworker-x.y.z.jar: XML (and HTML) functionality.