Merge branch 'develop' into devsecops

BUILDING.md

@@ -14,5 +14,5 @@ environment variables. Examples of paths on Windows:
 If you have a new version of ImageMagick, then there is no compare.exe utility there, wrap the path to magick.exe in quotes and call compare command:
 ITEXT_MAGICK_COMPARE_EXEC=`"C:\Program Files\ImageMagick-7.0.9-Q16\magick.exe" compare`
 
-[1]: http://www.ghostscript.com/
-[2]: http://www.imagemagick.org/
+[1]: https://www.ghostscript.com/
+[2]: https://www.imagemagick.org/

CODE_OF_CONDUCT.md

@@ -55,7 +55,7 @@ further defined and clarified by project maintainers.
 ## Enforcement
 
 Instances of abusive, harassing, or otherwise unacceptable behavior may be
-reported by contacting the project team at http://itextpdf.com/contact. All
+reported by contacting the project team at https://itextpdf.com/contact. All
 complaints will be reviewed and investigated and will result in a response that
 is deemed necessary and appropriate to the circumstances. The project team is
 obligated to maintain confidentiality with regard to the reporter of an incident.
@@ -68,7 +68,7 @@ members of the project's leadership.
 ## Attribution
 
 This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4,
-available at [http://contributor-covenant.org/version/1/4][version]
+available at [https://contributor-covenant.org/version/1/4][version]
 
-[homepage]: http://contributor-covenant.org
-[version]: http://contributor-covenant.org/version/1/4/
+[homepage]: https://contributor-covenant.org
+[version]: https://contributor-covenant.org/version/1/4/

CONTRIBUTING.md

@@ -159,7 +159,7 @@ Please note that this project is released with a [Contributor Code of Conduct][c
 
 We use the [Stack Exchange][stackoverflow] network for free support and [GitHub][github] for code hosting. By using these services, you agree to abide by their terms:
 
-* StackExchange: [http://stackexchange.com/legal](http://stackexchange.com/legal)
+* StackExchange: [https://stackexchange.com/legal](https://stackexchange.com/legal)
 * Github: [https://help.github.com/articles/github-terms-of-service/](https://help.github.com/articles/github-terms-of-service/)
 
 [cla]: https://itextpdf.com/en/how-buy/legal/itext-contributor-license-agreement
@@ -168,7 +168,7 @@ We use the [Stack Exchange][stackoverflow] network for free support and [GitHub]
 [java-style-guide]: https://www.oracle.com/technetwork/java/codeconvtoc-136057.html
 [javadocs]: https://itextpdf.com/api
 [pull]: https://github.com/itext/itext7-dotnet/pulls
-[sscce]: http://sscce.org/
+[sscce]: https://sscce.org/
 [stackoverflow]: https://stackoverflow.com/questions/tagged/itext
 [good-questions]: https://stackoverflow.com/help/how-to-ask
 [mcve]: https://stackoverflow.com/help/mcve
@@ -180,4 +180,4 @@ We use the [Stack Exchange][stackoverflow] network for free support and [GitHub]
 [git-commit-end]: https://chris.beams.io/posts/git-commit/#end
 [git-commit-imperative]: https://chris.beams.io/posts/git-commit/#imperative
 [git-commit-wrap-72]: https://chris.beams.io/posts/git-commit/#wrap-72
-[git-commit-why-not-how]: https://chris.beams.io/posts/git-commit/#why-not-how
+[git-commit-why-not-how]: https://chris.beams.io/posts/git-commit/#why-not-how

itext.tests/itext.sign.tests/itext/signatures/TSAClientBouncyCastleTest.cs

@@ -58,8 +58,8 @@ public virtual void TestTsaClientBouncyCastleConstructor3Args() {
             NUnit.Framework.Assert.AreEqual(url, tsaClientBouncyCastle.tsaURL);
             NUnit.Framework.Assert.AreEqual(userName, tsaClientBouncyCastle.tsaUsername);
             NUnit.Framework.Assert.AreEqual(password, tsaClientBouncyCastle.tsaPassword);
-            NUnit.Framework.Assert.AreEqual(TSAClientBouncyCastle.DEFAULTTOKENSIZE, tsaClientBouncyCastle.tokenSizeEstimate
-                );
+            NUnit.Framework.Assert.AreEqual(TSAClientBouncyCastle.DEFAULTTOKENSIZE, tsaClientBouncyCastle.GetTokenSizeEstimate
+                ());
             NUnit.Framework.Assert.AreEqual(TSAClientBouncyCastle.DEFAULTHASHALGORITHM, tsaClientBouncyCastle.digestAlgorithm
                 );
         }
@@ -76,7 +76,9 @@ public virtual void TestTsaClientBouncyCastleConstructorAllArgs() {
             NUnit.Framework.Assert.AreEqual(url, tsaClientBouncyCastle.tsaURL);
             NUnit.Framework.Assert.AreEqual(userName, tsaClientBouncyCastle.tsaUsername);
             NUnit.Framework.Assert.AreEqual(password, tsaClientBouncyCastle.tsaPassword);
-            NUnit.Framework.Assert.AreEqual(tokenSize, tsaClientBouncyCastle.tokenSizeEstimate);
+            NUnit.Framework.Assert.AreEqual(TSAClientBouncyCastle.DEFAULTTOKENSIZE, tsaClientBouncyCastle.tokenSizeEstimate
+                );
+            NUnit.Framework.Assert.AreEqual(tokenSize, tsaClientBouncyCastle.GetTokenSizeEstimate());
             NUnit.Framework.Assert.AreEqual(digestAlgorithm, tsaClientBouncyCastle.digestAlgorithm);
         }
 

itext.tests/itext.sign.tests/itext/signatures/sign/PdfPadesSignerTest.cs

@@ -21,6 +21,8 @@ You should have received a copy of the GNU Affero General Public License
 along with this program.  If not, see <https://www.gnu.org/licenses/>.
 */
 using System;
+using System.Collections.Generic;
+using System.IO;
 using iText.Bouncycastleconnector;
 using iText.Commons.Bouncycastle;
 using iText.Commons.Bouncycastle.Cert;
@@ -156,6 +158,31 @@ public virtual void DefaultSignerPropertiesTest() {
             TestSignUtils.BasicCheckSignedDoc(outFileName, "Signature1");
             NUnit.Framework.Assert.IsNull(SignaturesCompareTool.CompareSignatures(outFileName, cmpFileName));
         }
+
+        [NUnit.Framework.Test]
+        public virtual void SmallTokenSizeEstimationTest() {
+            String fileName = "smallTokenSizeEstimationTest.pdf";
+            String outFileName = destinationFolder + fileName;
+            String srcFileName = sourceFolder + "helloWorldDoc.pdf";
+            String signCertFileName = certsSrc + "signCertRsa01.pem";
+            String tsaCertFileName = certsSrc + "tsCertRsa.pem";
+            String caCertFileName = certsSrc + "rootRsa.pem";
+            IX509Certificate[] signRsaChain = PemFileHelper.ReadFirstChain(signCertFileName);
+            IPrivateKey signRsaPrivateKey = PemFileHelper.ReadFirstKey(signCertFileName, password);
+            IExternalSignature pks = new PrivateKeySignature(signRsaPrivateKey, DigestAlgorithms.SHA256);
+            IX509Certificate[] tsaChain = PemFileHelper.ReadFirstChain(tsaCertFileName);
+            IPrivateKey tsaPrivateKey = PemFileHelper.ReadFirstKey(tsaCertFileName, password);
+            IX509Certificate caCert = (IX509Certificate)PemFileHelper.ReadFirstChain(caCertFileName)[0];
+            IPrivateKey caPrivateKey = PemFileHelper.ReadFirstKey(caCertFileName, password);
+            SignerProperties signerProperties = new SignerProperties();
+            PdfPadesSigner padesSigner = CreatePdfPadesSigner(srcFileName, outFileName);
+            TestTsaClient testTsa = new TestTsaClientWithCustomSizeEstimation(JavaUtil.ArraysAsList(tsaChain), tsaPrivateKey);
+            ICrlClient crlClient = new TestCrlClient().AddBuilderForCertIssuer(caCert, caPrivateKey);
+            TestOcspClient ocspClient = new TestOcspClient().AddBuilderForCertIssuer(caCert, caPrivateKey);
+            padesSigner.SetOcspClient(ocspClient).SetCrlClient(crlClient);
+            Exception exception = NUnit.Framework.Assert.Catch(typeof(IOException), () => padesSigner.SignWithBaselineLTAProfile
+                (signerProperties, signRsaChain, pks, testTsa));
+        }
 
         private SignerProperties CreateSignerProperties() {
             SignerProperties signerProperties = new SignerProperties();
@@ -170,5 +197,15 @@ private PdfPadesSigner CreatePdfPadesSigner(String srcFileName, String outFileNa
             return new PdfPadesSigner(new PdfReader(FileUtil.GetInputStreamForFile(srcFileName)), FileUtil.GetFileOutputStream
                 (outFileName));
         }
+
+        private sealed class TestTsaClientWithCustomSizeEstimation : TestTsaClient {
+            public TestTsaClientWithCustomSizeEstimation(IList<IX509Certificate> tsaCertificateChain,
+                IPrivateKey tsaPrivateKey) : base(tsaCertificateChain, tsaPrivateKey) {
+            }
+
+            public override int GetTokenSizeEstimate() {
+                return 1024;
+            }
+        }
     }
 }

itext.tests/itext.svg.tests/itext/svg/css/SvgStrokeParameterConverterUnitTest.cs

@@ -0,0 +1,79 @@
+/*
+This file is part of the iText (R) project.
+Copyright (c) 1998-2023 Apryse Group NV
+Authors: Apryse Software.
+
+This program is offered under a commercial and under the AGPL license.
+For commercial licensing, contact us at https://itextpdf.com/sales.  For AGPL licensing, see below.
+
+AGPL licensing:
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+using iText.Svg.Logs;
+using iText.Test;
+using iText.Test.Attributes;
+
+namespace iText.Svg.Css {
+    [NUnit.Framework.Category("UnitTest")]
+    public class SvgStrokeParameterConverterUnitTest : ExtendedITextTest {
+        [LogMessage(SvgLogMessageConstant.PERCENTAGE_VALUES_IN_STROKE_DASHARRAY_AND_STROKE_DASHOFFSET_ARE_NOT_SUPPORTED
+            )]
+        [NUnit.Framework.Test]
+        public virtual void TestStrokeDashArrayPercentsAreNotSupported() {
+            NUnit.Framework.Assert.IsNull(SvgStrokeParameterConverter.ConvertStrokeDashParameters("5,3%", null));
+        }
+
+        [NUnit.Framework.Test]
+        public virtual void TestStrokeDashArrayOddNumberOfValues() {
+            SvgStrokeParameterConverter.PdfLineDashParameters result = SvgStrokeParameterConverter.ConvertStrokeDashParameters
+                ("5pt", null);
+            NUnit.Framework.Assert.IsNotNull(result);
+            NUnit.Framework.Assert.AreEqual(0, result.GetDashPhase(), 0);
+            iText.Test.TestUtil.AreEqual(new float[] { 5, 5 }, result.GetDashArray(), 1e-5f);
+        }
+
+        [NUnit.Framework.Test]
+        public virtual void TestEmptyStrokeDashArray() {
+            SvgStrokeParameterConverter.PdfLineDashParameters result = SvgStrokeParameterConverter.ConvertStrokeDashParameters
+                ("", null);
+            NUnit.Framework.Assert.IsNull(result);
+        }
+
+        [LogMessage(SvgLogMessageConstant.PERCENTAGE_VALUES_IN_STROKE_DASHARRAY_AND_STROKE_DASHOFFSET_ARE_NOT_SUPPORTED
+            )]
+        [NUnit.Framework.Test]
+        public virtual void TestStrokeDashOffsetPercentsAreNotSupported() {
+            SvgStrokeParameterConverter.PdfLineDashParameters result = SvgStrokeParameterConverter.ConvertStrokeDashParameters
+                ("5pt,3pt", "10%");
+            NUnit.Framework.Assert.AreEqual(new SvgStrokeParameterConverter.PdfLineDashParameters(new float[] { 5, 3 }
+                , 0), result);
+        }
+
+        [NUnit.Framework.Test]
+        public virtual void TestEmptyStrokeDashOffset() {
+            SvgStrokeParameterConverter.PdfLineDashParameters result = SvgStrokeParameterConverter.ConvertStrokeDashParameters
+                ("5pt,3pt", "");
+            NUnit.Framework.Assert.AreEqual(new SvgStrokeParameterConverter.PdfLineDashParameters(new float[] { 5, 3 }
+                , 0), result);
+        }
+
+        [NUnit.Framework.Test]
+        public virtual void TestStrokeDashOffset() {
+            SvgStrokeParameterConverter.PdfLineDashParameters result = SvgStrokeParameterConverter.ConvertStrokeDashParameters
+                ("5pt,3pt", "10");
+            NUnit.Framework.Assert.AreEqual(new SvgStrokeParameterConverter.PdfLineDashParameters(new float[] { 5, 3 }
+                , 7.5f), result);
+        }
+    }
+}

itext.tests/itext.svg.tests/itext/svg/renderers/StrokeTest.cs

@@ -53,6 +53,11 @@ public virtual void NoLineStrokeWidthTest() {
             ConvertAndCompare(SOURCE_FOLDER, DESTINATION_FOLDER, "noLineStrokeWidth");
         }
 
+        [NUnit.Framework.Test]
+        public virtual void StrokeWithDashesTest() {
+            ConvertAndCompare(SOURCE_FOLDER, DESTINATION_FOLDER, "strokeWithDashes");
+        }
+
         [NUnit.Framework.Test]
         public virtual void AdvancedStrokeTest() {
             //TODO: update cmp-file after DEVSIX-2258

itext/itext.bouncy-castle-adapter/itext/bouncycastle/BouncyCastleFactory.cs

@@ -1036,6 +1036,11 @@ public ISubjectKeyIdentifier CreateSubjectKeyIdentifier(ISubjectPublicKeyInfo su
         public bool IsNullExtension(IX509Extension ext) {
             return ((X509ExtensionBC)ext).GetX509Extension() == null;
         }
+
+        /// <summary><inheritDoc/></summary>
+        public bool IsNull(IAsn1Encodable encodable) {
+            return ((Asn1EncodableBC)encodable).GetEncodable() == null;
+        }
 
         /// <summary><inheritDoc/></summary>
         public IX509Extension CreateExtension(bool b, IDerOctetString octetString) {

itext/itext.bouncy-castle-connector/itext/bouncycastleconnector/BouncyCastleDefaultFactory.cs

@@ -653,6 +653,11 @@ public IX509Extension CreateExtension(bool b, IDerOctetString octetString) {
         public bool IsNullExtension(IX509Extension extNonce) {
             throw new NotSupportedException(BouncyCastleLogMessageConstant.BOUNCY_CASTLE_DEPENDENCY_MUST_PRESENT);
         }
+
+
+        public bool IsNull(IAsn1Encodable encodable) {
+            throw new NotSupportedException(BouncyCastleLogMessageConstant.BOUNCY_CASTLE_DEPENDENCY_MUST_PRESENT);
+        }
 
         public byte[] CreateCipherBytes(IX509Certificate x509Certificate, byte[] abyte0, IAlgorithmIdentifier algorithmidentifier) {
             throw new NotSupportedException(BouncyCastleLogMessageConstant.BOUNCY_CASTLE_DEPENDENCY_MUST_PRESENT);

itext/itext.bouncy-castle-fips-adapter/itext/bouncycastlefips/BouncyCastleFipsFactory.cs

@@ -1100,6 +1100,11 @@ public ISubjectKeyIdentifier CreateSubjectKeyIdentifier(ISubjectPublicKeyInfo su
         public bool IsNullExtension(IX509Extension ext) {
             return ((X509ExtensionBCFips)ext).GetX509Extension() == null;
         }
+
+        /// <summary><inheritDoc/></summary>
+        public bool IsNull(IAsn1Encodable encodable) {
+            return ((Asn1EncodableBCFips)encodable).GetEncodable() == null;
+        }
 
         /// <summary><inheritDoc/></summary>
         public IX509Extension CreateExtension(bool b, IDerOctetString octetString) {

itext/itext.commons/itext/commons/bouncycastle/IBouncyCastleFactory.cs

@@ -1470,6 +1470,8 @@ IX509V3CertificateGenerator CreateJcaX509v3CertificateBuilder(IX509Certificate s
         /// otherwise
         /// </returns>
         bool IsNullExtension(IX509Extension extNonce);
+
+        bool IsNull(IAsn1Encodable encodable);
 
         /// <summary>
         /// Create

itext/itext.sign/itext/signatures/PdfPKCS7.cs

@@ -328,7 +328,7 @@ public PdfPKCS7(byte[] contentsKey, PdfName filterSubtype) {
                         IAttributeTable attble = BOUNCY_CASTLE_FACTORY.CreateAttributeTable(unat);
                         IPkcsObjectIdentifiers ipkcsObjectIdentifiers = BOUNCY_CASTLE_FACTORY.CreatePKCSObjectIdentifiers();
                         IAttribute ts = attble.Get(ipkcsObjectIdentifiers.GetIdAaSignatureTimeStampToken());
-                        if (ts != null && ts.GetAttrValues().Size() > 0) {
+                        if (!BOUNCY_CASTLE_FACTORY.IsNull(ts) && ts.GetAttrValues().Size() > 0) {
                             IAsn1Set attributeValues = ts.GetAttrValues();
                             IAsn1Sequence tokenSequence = BOUNCY_CASTLE_FACTORY.CreateASN1SequenceInstance(attributeValues.GetObjectAt
                                 (0));

itext/itext.sign/itext/signatures/PdfSigner.cs

@@ -591,7 +591,7 @@ public virtual void SignDetached(IExternalSignature externalSignature, IX509Cert
                     estimatedSize += 4192;
                 }
                 if (tsaClient != null) {
-                    estimatedSize += 4192;
+                    estimatedSize += tsaClient.GetTokenSizeEstimate() + 96;
                 }
             }
             appearance.SetCertificate(chain[0]);
@@ -732,7 +732,8 @@ public virtual void Timestamp(ITSAClient tsa, String signatureName) {
                     .Message, e);
             }
             if (contentEstimated + 2 < tsToken.Length) {
-                throw new System.IO.IOException("Not enough space");
+                throw new System.IO.IOException(MessageFormatUtil.Format(SignExceptionMessageConstant.TOKEN_ESTIMATION_SIZE_IS_NOT_LARGE_ENOUGH
+                    , contentEstimated, tsToken.Length));
             }
             byte[] paddedSig = new byte[contentEstimated];
             Array.Copy(tsToken, 0, paddedSig, 0, tsToken.Length);