(tika) branch main updated: TIKA-4992 - drop object, link and remote img src in TikaGUI html view (#3400)

[tallison]

This is an automated email from the ASF dual-hosted git repository.

tballison pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tika.git


The following commit(s) were added to refs/heads/main by this push:
     new 7d550ac60b TIKA-4992 - drop object, link and remote img src in TikaGUI 
html view (#3400)
7d550ac60b is described below

commit 7d550ac60b2246dcdf253c28316f76eee891d493
Author: Naveed <mr.devel2...@gmail.com>
AuthorDate: Thu Oct 22 23:36:53 2026 +0530

    TIKA-4992 - drop object, link and remote img src in TikaGUI html view 
(#3400)
    
    Swing's html view instantiates the java.awt.Component an <object
    classid> names, sets its String properties from <param>, and fetches
    <link> stylesheets and remote image sources, so a document opened in
    the GUI could construct classpath components and make network requests.
    
    Generated-by: Claude Code (claude-opus-5-5)
---
 .../src/main/java/org/apache/tika/gui/TikaGUI.java    | 19 +++++++++++--------
 1 file changed, 11 insertions(+), 8 deletions(-)

diff --git a/tika-app/src/main/java/org/apache/tika/gui/TikaGUI.java 
b/tika-app/src/main/java/org/apache/tika/gui/TikaGUI.java
index 7eeeff2c41..00cfe41fe8 100644
--- a/tika-app/src/main/java/org/apache/tika/gui/TikaGUI.java
+++ b/tika-app/src/main/java/org/apache/tika/gui/TikaGUI.java
@@ -105,6 +105,9 @@ public class TikaGUI extends JFrame implements 
ActionListener, HyperlinkListener
     //maximum length to allow for mark for reparse to get JSON
     private static final int MAX_MARK = 20 * 1024 * 1024;//20MB
 
+    // Swing's html view instantiates the class an <object> names and fetches 
<link> stylesheets
+    private static final Set<String> HTML_VIEW_DROPPED = Set.of("head", 
"link", "object", "param");
+
     /**
      * Serial version UID.
      */
@@ -527,14 +530,10 @@ public class TikaGUI extends JFrame implements 
ActionListener, HyperlinkListener
                 if (XHTMLContentHandler.XHTML.equals(uri)) {
                     uri = null;
                 }
-                if (!"head".equals(localName)) {
+                if (!HTML_VIEW_DROPPED.contains(localName)) {
                     if ("img".equals(localName)) {
-                        AttributesImpl newAttrs;
-                        if (atts instanceof AttributesImpl) {
-                            newAttrs = (AttributesImpl) atts;
-                        } else {
-                            newAttrs = new AttributesImpl(atts);
-                        }
+                        // a copy: the other tee'd handlers see the same 
attributes
+                        AttributesImpl newAttrs = new AttributesImpl(atts);
 
                         for (int i = 0; i < newAttrs.getLength(); i++) {
                             if ("src".equals(newAttrs.getLocalName(i))) {
@@ -551,6 +550,10 @@ public class TikaGUI extends JFrame implements 
ActionListener, HyperlinkListener
                                         System.err.println("Error creating 
temp image file " + filename);
                                         // The html viewer will show a broken 
image too to alert them
                                     }
+                                } else {
+                                    // the view would fetch it on display
+                                    newAttrs.removeAttribute(i);
+                                    i--;
                                 }
                             }
                         }
@@ -566,7 +569,7 @@ public class TikaGUI extends JFrame implements 
ActionListener, HyperlinkListener
                 if (XHTMLContentHandler.XHTML.equals(uri)) {
                     uri = null;
                 }
-                if (!"head".equals(localName)) {
+                if (!HTML_VIEW_DROPPED.contains(localName)) {
                     super.endElement(uri, localName, name);
                 }
             }