netceteragroup / girders

Java Framework based on spring-boot
https://netceteragroup.github.io/girders/
Apache License 2.0
5 stars 1 forks source link

Extend FopTemplate with the possibility to configure the Apache FOUserAgent #50

Open belahorvath opened 1 year ago

belahorvath commented 1 year ago

When using the girders FopTemplate class and its methods, the underlying implementation instantiates a new "Fop" object with a default factory and user agent from apache. This introduces a minor security issue when generating PDF's that the producer is visible in the meta data and there is no nice way of getting rid of it.

Example excerpt from inspecting a generated PDF with notepad:

image

To address said concern the producer should not be publicly visible.

Could you please adapt the FopTemplate in such a way that the FOUserAgent can be passed in from the outside so I can manually configure it?

Thanks for checking this issue.