Index: /trunk/src/com/kitfox/svg/ClipPath.java =================================================================== --- /trunk/src/com/kitfox/svg/ClipPath.java (revision 14327) +++ /trunk/src/com/kitfox/svg/ClipPath.java (revision 14328) @@ -132,5 +132,5 @@ * all attributes with track information. * - * @param curTime + * @param curTime Time at which to evaluate node * @return - true if this node has changed state as a result of the time * update Index: /trunk/src/com/kitfox/svg/FillElement.java =================================================================== --- /trunk/src/com/kitfox/svg/FillElement.java (revision 14327) +++ /trunk/src/com/kitfox/svg/FillElement.java (revision 14328) @@ -59,4 +59,5 @@ * @param xform - The current transformation that the shape is being * rendered under. + * @return paint object */ abstract public Paint getPaint(Rectangle2D bounds, AffineTransform xform); Index: /trunk/src/com/kitfox/svg/Gradient.java =================================================================== --- /trunk/src/com/kitfox/svg/Gradient.java (revision 14327) +++ /trunk/src/com/kitfox/svg/Gradient.java (revision 14328) @@ -160,4 +160,32 @@ } + private void buildStops() + { + ArrayList stopList = new ArrayList<>(stops); + stopList.sort((o1, o2) -> Float.compare(o1.offset, o2.offset)); + + //Remove doubles + for (int i = stopList.size() - 2; i > 0; --i) + { + if (stopList.get(i + 1).offset == stopList.get(i).offset) + { + stopList.remove(i + 1); + } + } + + stopFractions = new float[stopList.size()]; + stopColors = new Color[stopList.size()]; + int idx = 0; + for (Stop stop : stopList) + { + int stopColorVal = stop.color.getRGB(); + Color stopColor = new Color((stopColorVal >> 16) & 0xff, (stopColorVal >> 8) & 0xff, stopColorVal & 0xff, clamp((int) (stop.opacity * 255), 0, 255)); + + stopColors[idx] = stopColor; + stopFractions[idx] = stop.offset; + idx++; + } + } + public float[] getStopFractions() { @@ -173,14 +201,5 @@ } - stopFractions = new float[stops.size()]; - int idx = 0; - for (Stop stop : stops) { - float val = stop.offset; - if (idx != 0 && val < stopFractions[idx - 1]) - { - val = stopFractions[idx - 1]; - } - stopFractions[idx++] = val; - } + buildStops(); return stopFractions; @@ -200,25 +219,7 @@ } - stopColors = new Color[stops.size()]; - int idx = 0; - for (Stop stop : stops) { - int stopColorVal = stop.color.getRGB(); - Color stopColor = new Color((stopColorVal >> 16) & 0xff, (stopColorVal >> 8) & 0xff, stopColorVal & 0xff, clamp((int) (stop.opacity * 255), 0, 255)); - stopColors[idx++] = stopColor; - } + buildStops(); return stopColors; - } - - public void setStops(Color[] colors, float[] fractions) - { - if (colors.length != fractions.length) - { - throw new IllegalArgumentException(); - } - - this.stopColors = colors; - this.stopFractions = fractions; - stopRef = null; } Index: /trunk/src/com/kitfox/svg/Group.java =================================================================== --- /trunk/src/com/kitfox/svg/Group.java (revision 14327) +++ /trunk/src/com/kitfox/svg/Group.java (revision 14328) @@ -259,4 +259,5 @@ * Recalculates the bounding box by taking the union of the bounding boxes * of all children. Caches the result. + * @throws com.kitfox.svg.SVGException */ public void calcBoundingBox() throws SVGException Index: /trunk/src/com/kitfox/svg/ImageSVG.java =================================================================== --- /trunk/src/com/kitfox/svg/ImageSVG.java (revision 14327) +++ /trunk/src/com/kitfox/svg/ImageSVG.java (revision 14328) @@ -115,9 +115,23 @@ { URI src = sty.getURIValue(getXMLBase()); - // CVE-2017-5617: Allow only data scheme if ("data".equals(src.getScheme())) { imageSrc = new URL(null, src.toASCIIString(), new Handler()); } + else + { + if (!diagram.getUniverse().isImageDataInlineOnly()) + { + try + { + imageSrc = src.toURL(); + } catch (Exception e) + { + Logger.getLogger(SVGConst.SVG_LOGGER).log(Level.WARNING, + "Could not parse xlink:href " + src, e); + imageSrc = null; + } + } + } } } catch (Exception e) @@ -126,31 +140,28 @@ } - if (imageSrc != null) - { - diagram.getUniverse().registerImage(imageSrc); - - //Set widths if not set - BufferedImage img = diagram.getUniverse().getImage(imageSrc); - if (img == null) - { - xform = new AffineTransform(); - bounds = new Rectangle2D.Float(); - return; - } - - if (width == 0) - { - width = img.getWidth(); - } - if (height == 0) - { - height = img.getHeight(); - } - - //Determine image xform + diagram.getUniverse().registerImage(imageSrc); + + //Set widths if not set + BufferedImage img = diagram.getUniverse().getImage(imageSrc); + if (img == null) + { xform = new AffineTransform(); - xform.translate(this.x, this.y); - xform.scale(this.width / img.getWidth(), this.height / img.getHeight()); - } + bounds = new Rectangle2D.Float(); + return; + } + + if (width == 0) + { + width = img.getWidth(); + } + if (height == 0) + { + height = img.getHeight(); + } + + //Determine image xform + xform = new AffineTransform(); + xform.translate(this.x, this.y); + xform.scale(this.width / img.getWidth(), this.height / img.getHeight()); bounds = new Rectangle2D.Float(this.x, this.y, this.width, this.height); @@ -326,12 +337,14 @@ URI src = sty.getURIValue(getXMLBase()); - URL newVal = null; - // CVE-2017-5617: Allow only data scheme + URL newVal; if ("data".equals(src.getScheme())) { newVal = new URL(null, src.toASCIIString(), new Handler()); + } else + { + newVal = src.toURL(); } - if (newVal != null && !newVal.equals(imageSrc)) + if (!newVal.equals(imageSrc)) { imageSrc = newVal; Index: /trunk/src/com/kitfox/svg/MissingGlyph.java =================================================================== --- /trunk/src/com/kitfox/svg/MissingGlyph.java (revision 14327) +++ /trunk/src/com/kitfox/svg/MissingGlyph.java (revision 14328) @@ -61,8 +61,8 @@ private Shape path = null; //Alternately, we may have child graphical elements - private int horizAdvX = -1; //Inherits font's value if not set - private int vertOriginX = -1; //Inherits font's value if not set - private int vertOriginY = -1; //Inherits font's value if not set - private int vertAdvY = -1; //Inherits font's value if not set + private float horizAdvX = -1; //Inherits font's value if not set + private float vertOriginX = -1; //Inherits font's value if not set + private float vertOriginY = -1; //Inherits font's value if not set + private float vertAdvY = -1; //Inherits font's value if not set /** @@ -132,20 +132,20 @@ if (getPres(sty.setName("horiz-adv-x"))) { - horizAdvX = sty.getIntValue(); + horizAdvX = sty.getFloatValue(); } if (getPres(sty.setName("vert-origin-x"))) { - vertOriginX = sty.getIntValue(); + vertOriginX = sty.getFloatValue(); } if (getPres(sty.setName("vert-origin-y"))) { - vertOriginY = sty.getIntValue(); + vertOriginY = sty.getFloatValue(); } if (getPres(sty.setName("vert-adv-y"))) { - vertAdvY = sty.getIntValue(); + vertAdvY = sty.getFloatValue(); } } @@ -179,5 +179,5 @@ } - public int getHorizAdvX() + public float getHorizAdvX() { if (horizAdvX == -1) @@ -188,5 +188,5 @@ } - public int getVertOriginX() + public float getVertOriginX() { if (vertOriginX == -1) @@ -197,5 +197,5 @@ } - public int getVertOriginY() + public float getVertOriginY() { if (vertOriginY == -1) @@ -206,5 +206,5 @@ } - public int getVertAdvY() + public float getVertAdvY() { if (vertAdvY == -1) @@ -261,5 +261,5 @@ * @param horizAdvX the horizAdvX to set */ - public void setHorizAdvX(int horizAdvX) + public void setHorizAdvX(float horizAdvX) { this.horizAdvX = horizAdvX; @@ -269,5 +269,5 @@ * @param vertOriginX the vertOriginX to set */ - public void setVertOriginX(int vertOriginX) + public void setVertOriginX(float vertOriginX) { this.vertOriginX = vertOriginX; @@ -277,5 +277,5 @@ * @param vertOriginY the vertOriginY to set */ - public void setVertOriginY(int vertOriginY) + public void setVertOriginY(float vertOriginY) { this.vertOriginY = vertOriginY; @@ -285,5 +285,5 @@ * @param vertAdvY the vertAdvY to set */ - public void setVertAdvY(int vertAdvY) + public void setVertAdvY(float vertAdvY) { this.vertAdvY = vertAdvY; Index: /trunk/src/com/kitfox/svg/RadialGradient.java =================================================================== --- /trunk/src/com/kitfox/svg/RadialGradient.java (revision 14327) +++ /trunk/src/com/kitfox/svg/RadialGradient.java (revision 14328) @@ -37,4 +37,5 @@ import com.kitfox.svg.xml.StyleAttribute; +import java.awt.Color; import java.awt.MultipleGradientPaint; import java.awt.Paint; @@ -129,4 +130,6 @@ Point2D.Float pt1 = new Point2D.Float(cx, cy); Point2D.Float pt2 = hasFocus ? new Point2D.Float(fx, fy) : pt1; + float[] stopFractions = getStopFractions(); + Color[] stopColors = getStopColors(); if (gradientUnits == GU_USER_SPACE_ON_USE) { @@ -135,6 +138,6 @@ r, pt2, - getStopFractions(), - getStopColors(), + stopFractions, + stopColors, method, MultipleGradientPaint.ColorSpaceType.SRGB, @@ -152,6 +155,6 @@ r, pt2, - getStopFractions(), - getStopColors(), + stopFractions, + stopColors, method, MultipleGradientPaint.ColorSpaceType.SRGB, Index: /trunk/src/com/kitfox/svg/RenderableElement.java =================================================================== --- /trunk/src/com/kitfox/svg/RenderableElement.java (revision 14327) +++ /trunk/src/com/kitfox/svg/RenderableElement.java (revision 14328) @@ -112,4 +112,7 @@ * Pushes transform stack, transforms to local coordinates and sets up * clipping mask. + * + * @param g Graphics context + * @throws com.kitfox.svg.SVGException */ protected void beginLayer(Graphics2D g) throws SVGException @@ -166,4 +169,5 @@ * Restores transform and clipping values to the way they were before this * layer was drawn. + * @param g */ protected void finishLayer(Graphics2D g) Index: /trunk/src/com/kitfox/svg/SVGDiagram.java =================================================================== --- /trunk/src/com/kitfox/svg/SVGDiagram.java (revision 14327) +++ /trunk/src/com/kitfox/svg/SVGDiagram.java (revision 14328) @@ -90,5 +90,9 @@ final URI xmlBase; - /** Creates a new instance of SVGDiagram */ + /** + * Creates a new instance of SVGDiagram + * @param xmlBase + * @param universe + */ public SVGDiagram(URI xmlBase, SVGUniverse universe) { @@ -100,4 +104,6 @@ /** * Draws this diagram to the passed graphics context + * @param g + * @throws com.kitfox.svg.SVGException */ public void render(Graphics2D g) throws SVGException @@ -114,5 +120,8 @@ * SVGElement.getPath() is added for each entry. * + * @param point + * @param retVec * @return the passed in list + * @throws com.kitfox.svg.SVGException */ public List> pick(Point2D point, List> retVec) throws SVGException @@ -179,4 +188,6 @@ /** * Returns the viewing rectangle of this diagram in device coordinates. + * @param rect + * @return */ public Rectangle2D getViewRect(Rectangle2D rect) @@ -224,4 +235,6 @@ * Updates all attributes in this diagram associated with a time event. * Ie, all attributes with track information. + * @param curTime + * @throws com.kitfox.svg.SVGException */ public void updateTime(double curTime) throws SVGException @@ -240,4 +253,5 @@ * SVGRoot when its x, y, width or height parameters are specified as * percentages. + * @param deviceViewport */ public void setDeviceViewport(Rectangle deviceViewport) Index: /trunk/src/com/kitfox/svg/SVGElement.java =================================================================== --- /trunk/src/com/kitfox/svg/SVGElement.java (revision 14327) +++ /trunk/src/com/kitfox/svg/SVGElement.java (revision 14328) @@ -156,4 +156,5 @@ /** + * @param retVec * @return an ordered list of nodes from the root of the tree to this node */ @@ -212,4 +213,6 @@ * Searches children for given element. If found, returns index of child. * Otherwise returns -1. + * @param child + * @return index of child */ public int indexOfChild(SVGElement child) @@ -221,8 +224,7 @@ * Swaps 2 elements in children. * - * @i index of first - * @j index of second - * - * @return true if successful, false otherwise + * @param i index of first child + * @param j index of second child + * @throws com.kitfox.svg.SVGException */ public void swapChildren(int i, int j) throws SVGException @@ -246,4 +248,6 @@ * @param helper - An object passed to all SVG elements involved in this * build process to aid in sharing information. + * @param parent + * @throws org.xml.sax.SAXException */ public void loaderStartElement(SVGLoaderHelper helper, Attributes attrs, SVGElement parent) throws SAXException @@ -317,4 +321,7 @@ * Called after the start element but before the end element to indicate * each child tag that has been processed + * @param helper + * @param child + * @throws com.kitfox.svg.SVGElementException */ public void loaderAddChild(SVGLoaderHelper helper, SVGElement child) throws SVGElementException @@ -346,4 +353,6 @@ /** * Called during load process to add text scanned within a tag + * @param helper + * @param text */ public void loaderAddText(SVGLoaderHelper helper, String text) @@ -354,4 +363,6 @@ * Called to indicate that this tag and the tags it contains have been * completely processed, and that it should finish any load processes. + * @param helper + * @throws com.kitfox.svg.SVGParseException */ public void loaderEndElement(SVGLoaderHelper helper) throws SVGParseException @@ -370,4 +381,5 @@ * Called by internal processes to rebuild the geometry of this node from * it's presentation attributes, style attributes and animated tracks. + * @throws com.kitfox.svg.SVGException */ protected void build() throws SVGException @@ -420,4 +432,5 @@ * Hack to allow nodes to temporarily change their parents. The Use tag will * need this so it can alter the attributes that a particular node uses. + * @param context */ protected void pushParentContext(SVGElement context) @@ -465,4 +478,5 @@ * style attribute, checks attributes of parents back to root until one * found. + * @return */ public boolean getStyle(StyleAttribute attrib, boolean recursive) throws SVGException @@ -523,4 +537,5 @@ /** + * @param styName * @return the raw style value of this attribute. Does not take the * presentation value or animation into consideration. Used by animations to @@ -536,5 +551,7 @@ * Copies the presentation attribute into the passed one. * + * @param attrib * @return - True if attribute was read successfully + * @throws com.kitfox.svg.SVGException */ public boolean getPres(StyleAttribute attrib) throws SVGException @@ -558,4 +575,5 @@ /** + * @param styName * @return the raw presentation value of this attribute. Ignores any * modifications applied by style attributes or animation. Used by @@ -810,6 +828,8 @@ * all attributes with track information. * + * @param curTime * @return - true if this node has changed state as a result of the time * update + * @throws com.kitfox.svg.SVGException */ abstract public boolean updateTime(double curTime) throws SVGException; Index: /trunk/src/com/kitfox/svg/SVGElementException.java =================================================================== --- /trunk/src/com/kitfox/svg/SVGElementException.java (revision 14327) +++ /trunk/src/com/kitfox/svg/SVGElementException.java (revision 14328) @@ -49,4 +49,5 @@ /** * Creates a new instance of SVGException without detail message. + * @param element */ public SVGElementException(SVGElement element) @@ -58,4 +59,5 @@ /** * Constructs an instance of SVGException with the specified detail message. + * @param element * @param msg the detail message. */ Index: /trunk/src/com/kitfox/svg/SVGLoader.java =================================================================== --- /trunk/src/com/kitfox/svg/SVGLoader.java (revision 14327) +++ /trunk/src/com/kitfox/svg/SVGLoader.java (revision 14328) @@ -76,6 +76,10 @@ final boolean verbose; - - /** Creates a new instance of SVGLoader */ + + /** + * Creates a new instance of SVGLoader + * @param xmlBase + * @param universe + */ public SVGLoader(URI xmlBase, SVGUniverse universe) { Index: /trunk/src/com/kitfox/svg/SVGLoaderHelper.java =================================================================== --- /trunk/src/com/kitfox/svg/SVGLoaderHelper.java (revision 14327) +++ /trunk/src/com/kitfox/svg/SVGLoaderHelper.java (revision 14328) @@ -57,5 +57,10 @@ public final URI xmlBase; - /** Creates a new instance of SVGLoaderHelper */ + /** + * Creates a new instance of SVGLoaderHelper + * @param xmlBase + * @param universe + * @param diagram + */ public SVGLoaderHelper(URI xmlBase, SVGUniverse universe, SVGDiagram diagram) { Index: /trunk/src/com/kitfox/svg/SVGUniverse.java =================================================================== --- /trunk/src/com/kitfox/svg/SVGUniverse.java (revision 14327) +++ /trunk/src/com/kitfox/svg/SVGUniverse.java (revision 14328) @@ -105,4 +105,7 @@ XMLReader cachedReader; + //If true, elements will only load image data that is included using inline data: uris + private boolean imageDataInlineOnly = false; + /** * Creates a new instance of SVGUniverse @@ -130,4 +133,30 @@ loadedFonts.clear(); loadedImages.clear(); + } + + /** + * Returns the current animation time in milliseconds. + */ + public double getCurTime() + { + return curTime; + } + + public void setCurTime(double curTime) + { + double oldTime = this.curTime; + this.curTime = curTime; + changes.firePropertyChange("curTime", new Double(oldTime), new Double(curTime)); + } + + /** + * Updates all time influenced style and presentation attributes in all SVG + * documents in this universe. + */ + public void updateTime() throws SVGException + { + for (SVGDiagram dia : loadedDocs.values()) { + dia.updateTime(curTime); + } } @@ -648,3 +677,19 @@ return universe; } + + /** + * @return the imageDataInlineOnly + */ + public boolean isImageDataInlineOnly() + { + return imageDataInlineOnly; + } + + /** + * @param imageDataInlineOnly the imageDataInlineOnly to set + */ + public void setImageDataInlineOnly(boolean imageDataInlineOnly) + { + this.imageDataInlineOnly = imageDataInlineOnly; + } } Index: /trunk/src/com/kitfox/svg/Text.java =================================================================== --- /trunk/src/com/kitfox/svg/Text.java (revision 14327) +++ /trunk/src/com/kitfox/svg/Text.java (revision 14328) @@ -272,5 +272,5 @@ for (int i = 0; i < families.length; ++i) { - font = diagram.getUniverse().getFont(fontFamily); + font = diagram.getUniverse().getFont(families[i]); if (font != null) { @@ -278,8 +278,14 @@ } } - + if (font == null) { - font = new FontSystem(fontFamily, fontStyle, fontWeight, (int)fontSize); + //Check system fonts + font = FontSystem.createFont(fontFamily, fontStyle, fontWeight, (int)fontSize); + } + + if (font == null) + { + font = FontSystem.createFont("Serif", fontStyle, fontWeight, fontStyle); } Index: /trunk/src/com/kitfox/svg/Tspan.java =================================================================== --- /trunk/src/com/kitfox/svg/Tspan.java (revision 14327) +++ /trunk/src/com/kitfox/svg/Tspan.java (revision 14328) @@ -231,5 +231,5 @@ if (font == null) { - font = new FontSystem(fontFamily, fontStyle, fontWeight, (int)fontSize); + font = FontSystem.createFont(fontFamily, fontStyle, fontWeight, (int)fontSize); } Index: /trunk/src/com/kitfox/svg/pathcmd/Arc.java =================================================================== --- /trunk/src/com/kitfox/svg/pathcmd/Arc.java (revision 14327) +++ /trunk/src/com/kitfox/svg/pathcmd/Arc.java (revision 14328) @@ -104,4 +104,6 @@ * point of the arc. * + * @param path The path that the arc will be appended to. + * * @param rx the x radius of the ellipse * @param ry the y radius of the ellipse @@ -160,4 +162,16 @@ * AffineTransform.getRotateInstance * (angle, arc.getX()+arc.getWidth()/2, arc.getY()+arc.getHeight()/2); + * + * @param x0 origin of arc in x + * @param y0 origin of arc in y + * @param rx radius of arc in x + * @param ry radius of arc in y + * @param angle number of radians in arc + * @param largeArcFlag + * @param sweepFlag + * @param x ending coordinate of arc in x + * @param y ending coordinate of arc in y + * @return arc shape + * */ public static Arc2D computeArc(double x0, double y0, Index: /trunk/src/com/kitfox/svg/util/FontSystem.java =================================================================== --- /trunk/src/com/kitfox/svg/util/FontSystem.java (revision 14327) +++ /trunk/src/com/kitfox/svg/util/FontSystem.java (revision 14328) @@ -42,8 +42,10 @@ import java.awt.Canvas; import java.awt.FontMetrics; +import java.awt.GraphicsEnvironment; import java.awt.font.FontRenderContext; import java.awt.font.GlyphMetrics; import java.awt.font.GlyphVector; import java.util.HashMap; +import java.util.HashSet; /** @@ -58,5 +60,34 @@ HashMap glyphCache = new HashMap(); - public FontSystem(String fontFamily, int fontStyle, int fontWeight, int fontSize) + static HashSet sysFontNames = new HashSet(); + + public static boolean checkIfSystemFontExists(String fontName) + { + if (sysFontNames.isEmpty()) + { + for (String name: GraphicsEnvironment.getLocalGraphicsEnvironment().getAvailableFontFamilyNames()) + { + sysFontNames.add(name); + } + } + + return sysFontNames.contains(fontName); + } + + public static FontSystem createFont(String fontFamily, int fontStyle, int fontWeight, int fontSize) + { + String[] families = fontFamily.split(","); + for (String fontName: families) + { + if (checkIfSystemFontExists(fontName)) + { + return new FontSystem(fontName, fontStyle, fontWeight, fontSize); + } + } + + return null; + } + + private FontSystem(String fontFamily, int fontStyle, int fontWeight, int fontSize) { int style; @@ -82,5 +113,6 @@ break; } - sysFont = new java.awt.Font(fontFamily, style | weight, (int) fontSize); + + sysFont = new java.awt.Font(fontFamily, style | weight, fontSize); Canvas c = new Canvas(); @@ -100,5 +132,5 @@ GlyphVector vec = sysFont.createGlyphVector(frc, unicode); - Glyph glyph = (Glyph)glyphCache.get(unicode); + Glyph glyph = glyphCache.get(unicode); if (glyph == null) { @@ -107,6 +139,6 @@ GlyphMetrics gm = vec.getGlyphMetrics(0); - glyph.setHorizAdvX((int)gm.getAdvanceX()); - glyph.setVertAdvY((int)gm.getAdvanceY()); + glyph.setHorizAdvX(gm.getAdvanceX()); + glyph.setVertAdvY(gm.getAdvanceY()); glyph.setVertOriginX(0); glyph.setVertOriginY(0); Index: /trunk/src/org/openstreetmap/josm/tools/ImageProvider.java =================================================================== --- /trunk/src/org/openstreetmap/josm/tools/ImageProvider.java (revision 14327) +++ /trunk/src/org/openstreetmap/josm/tools/ImageProvider.java (revision 14328) @@ -1656,4 +1656,6 @@ if (svgUniverse == null) { svgUniverse = new SVGUniverse(); + // CVE-2017-5617: Allow only data scheme (see #14319) + svgUniverse.setImageDataInlineOnly(true); } return svgUniverse;