fix: repair malformed hex colors only in color attributes and CSS values so writeHTML() keeps "#1" and numeric entities such as &, link href="#N" to page N (v7.0.18)

Author: nicolaasuni

VERSION

@@ -1 +1 @@
-7.0.17
+7.0.18

composer.json

@@ -29,7 +29,7 @@
     "require": {
         "php": ">=8.2",
         "ext-curl": "*",
-        "tecnickcom/tc-lib-pdf": "^8.80"
+        "tecnickcom/tc-lib-pdf": "^8.81"
     },
     "require-dev": {
         "carthage-software/mago": "1.55.0",

tcpdf.php

@@ -2,7 +2,7 @@
 
 //============================================================+
 // File name    : tcpdf.php
-// Version      : 7.0.17
+// Version      : 7.0.18
 // Author       : Nicola Asuni - Tecnick.com LTD - www.tecnick.com - info@tecnick.com
 // License      : GNU-LGPL v3 (https://www.gnu.org/copyleft/lesser.html)
 // Copyright (C): 2002-2026 Nicola Asuni - Tecnick.com LTD
@@ -15,7 +15,7 @@
  * See: https://tcpdf.org
  * @package com.tecnick.tcpdf
  * @author Nicola Asuni
- * @version 7.0.17
+ * @version 7.0.18
  */
 
 // TCPDF configuration
@@ -7642,8 +7642,11 @@ static function (array $match): string {
      * - '@'-prefixed base64 image data is rewritten to a data URI;
      * - relative local image paths are made absolute (src attributes,
      *   CSS url() values and the legacy img| list-bullet syntax);
-     * - malformed hexadecimal color tokens, silently coerced by the
-     *   legacy parser, are repaired to valid values.
+     * - legacy page anchors (href="#N" or href="#N,y") become internal
+     *   links to page N at ordinate y;
+     * - malformed hexadecimal colors, silently coerced by the legacy
+     *   parser, are repaired in color attributes and CSS declaration values
+     *   (see repairHtmlColors()).
      */
     protected function normalizeHtmlMarkup(string $html): string
     {
@@ -7699,37 +7702,104 @@ protected function normalizeHtmlMarkup(string $html): string
             $html,
         );
 
+        // Legacy page anchors: href="#N" or href="#N,y" link to page N at ordinate y.
+        $html = (string) preg_replace_callback(
+            '/(\bhref\s*=\s*["\'])#([0-9]+)(?:,([0-9]*\.?[0-9]*))?(["\'])/i',
+            fn(array $match): string => (
+                ($match[1] ?? '')
+                . $this->engine()->addInternalLink(max(0, (int) ($match[2] ?? '1') - 1), (float) ($match[3] ?? '0'))
+                . ($match[4] ?? '')
+            ),
+            $html,
+        );
+
+        return self::repairHtmlColors($html);
+    }
+
+    /**
+     * Repair malformed hexadecimal colors in the attributes whose name ends in
+     * "color" (color, bgcolor, bordercolor), in style attributes and in style
+     * blocks. Text content and other attributes are left unchanged.
+     */
+    protected static function repairHtmlColors(string $html): string
+    {
         $result = preg_replace_callback(
-            '/#([0-9a-zA-Z]+)\b/',
+            '/<style\b[^>]*>.*?<\/style\s*>|<[a-zA-Z][^>]*>/is',
             static function (array $match): string {
-                $token = $match[0] ?? '';
-                $hex = strtolower($match[1] ?? '');
-                $len = strlen($hex);
-                if (preg_match('/^[0-9a-f]+$/', $hex) === 1 && in_array($len, [3, 4, 6, 8], true)) {
-                    return $token;
+                $part = $match[0] ?? '';
+                if (strncasecmp($part, '<style', 6) === 0) {
+                    return self::repairCssColors($part);
                 }
 
-                // Only repair tokens that could be a mistyped hex color: every
-                // character must be a hex digit or a digit-look-alike letter
-                // (l/o/i/s/g/z). This leaves CSS id selectors (#second), link
-                // fragments (#chapter2) and placeholders (#TOC_...) untouched
-                // instead of mangling them into bogus colors.
-                if (preg_match('/^[0-9a-fgilosz]+$/', $hex) !== 1) {
-                    return $token;
-                }
+                $part = (string) preg_replace_callback(
+                    '/(\bstyle\s*=\s*)(?:"([^"]*)"|\'([^\']*)\')/i',
+                    static fn(array $style): string => isset($style[3])
+                        ? ($style[1] ?? '') . "'" . self::repairCssColors($style[3]) . "'"
+                        : ($style[1] ?? '') . '"' . self::repairCssColors($style[2] ?? '') . '"',
+                    $part,
+                );
 
-                // Map common look-alike characters, drop the rest.
-                $hex = strtr($hex, ['l' => '1', 'o' => '0', 'i' => '1', 's' => '5', 'g' => '6', 'z' => '2']);
-                $hex = (string) preg_replace('/[^0-9a-f]/', '', $hex);
-                $hex = substr(str_pad($hex, 6, '0'), 0, 6);
-                return '#' . $hex;
+                return (string) preg_replace_callback(
+                    '/(\b[a-z-]*color\s*=\s*["\']?)#([0-9a-zA-Z]+)\b/i',
+                    static fn(array $attr): string => ($attr[1] ?? '') . self::repairHexColor('#' . ($attr[2] ?? '')),
+                    $part,
+                );
             },
             $html,
         );
 
         return $result === null ? $html : $result;
     }
 
+    /**
+     * Repair malformed hexadecimal colors in the declaration values of a CSS
+     * text. Selectors, quoted strings and numeric character references are
+     * left unchanged.
+     */
+    protected static function repairCssColors(string $css): string
+    {
+        return (string) preg_replace_callback(
+            '/:[^;{}]*+(?=[;}]|$)/',
+            static fn(array $decl): string => (string) preg_replace_callback(
+                '/"[^"]*"|\'[^\']*\'|(?<!&)#[0-9a-zA-Z]+\b/',
+                static fn(array $item): string => str_starts_with($item[0] ?? '', '#')
+                    ? self::repairHexColor($item[0] ?? '')
+                    : $item[0] ?? '',
+                $decl[0] ?? '',
+            ),
+            $css,
+        );
+    }
+
+    /**
+     * Repair a malformed hexadecimal color token ('#' followed by letters and
+     * digits). Valid 3, 4, 6 or 8 digit values and tokens that cannot be a
+     * mistyped color are returned unchanged; the others are padded or
+     * truncated to 6 digits.
+     */
+    protected static function repairHexColor(string $color): string
+    {
+        $hex = strtolower(substr($color, 1));
+        if (preg_match('/^[0-9a-f]+$/', $hex) === 1 && in_array(strlen($hex), [3, 4, 6, 8], true)) {
+            return $color;
+        }
+
+        // Only repair tokens that could be a mistyped hex color: every
+        // character must be a hex digit or a digit-look-alike letter
+        // (l/o/i/s/g/z). This leaves CSS id selectors (#second), link
+        // fragments (#chapter2) and placeholders (#TOC_...) untouched
+        // instead of mangling them into bogus colors.
+        if (preg_match('/^[0-9a-fgilosz]+$/', $hex) !== 1) {
+            return $color;
+        }
+
+        // Map common look-alike characters, drop the rest.
+        $hex = strtr($hex, ['l' => '1', 'o' => '0', 'i' => '1', 's' => '5', 'g' => '6', 'z' => '2']);
+        $hex = (string) preg_replace('/[^0-9a-f]/', '', $hex);
+
+        return '#' . substr(str_pad($hex, 6, '0'), 0, 6);
+    }
+
     /**
      * Render HTML containing embedded <tcpdf data="..."/> method calls
      * (K_TCPDF_CALLS_IN_HTML feature): the markup is split at the tags,

test/TcpdfHtmlMarkupTest.php

@@ -80,4 +80,113 @@ public function testImageAlignIsDroppedOnlyInsideTables(): void
         $this->assertStringContainsString('</TABLE><img src="data:," align="baseline">', $out);
         $this->assertStringContainsString('<tablex><img src="data:," align="top"></tablex>', $out);
     }
+
+    public function testColorRepairLeavesTextAndCharacterReferencesUnchanged(): void
+    {
+        $html = '<p>Order #1, issue #12, ref #12345, item #123456, long #1234567, tag #abc</p>'
+            . '<p>A&#38;B, x&#35;y, a&#39;b, &#039;q&#039;, &#8364;, &#12354;</p>'
+            . '<p>if a < b then color=#12 > 0</p>';
+
+        $this->assertSame($html, $this->normalize($html));
+    }
+
+    public function testColorRepairLeavesNonColorAttributesUnchanged(): void
+    {
+        $html = '<a href="#chapter2" title="#1 A&#38;B">x</a><img alt="#12" src="data:," /><p id="a1">y</p>';
+
+        $this->assertSame($html, $this->normalize($html));
+    }
+
+    /**
+     * @return array<string, array{0: string, 1: string}>
+     */
+    public static function colorAttributeProvider(): array
+    {
+        return [
+            'color look-alike letter' => ['<font color="#4169el">x</font>', '<font color="#4169e1">x</font>'],
+            'bgcolor short' => ['<td bgcolor="#ab">x</td>', '<td bgcolor="#ab0000">x</td>'],
+            'bordercolor single quotes' => ["<td BorderColor='#f0l'>x</td>", "<td BorderColor='#f01000'>x</td>"],
+            'unquoted color' => ['<font color=#12>x</font>', '<font color=#120000>x</font>'],
+            'valid color' => ['<font color="#ff7f50">x</font>', '<font color="#ff7f50">x</font>'],
+            'long color' => ['<font color="#1234567">x</font>', '<font color="#123456">x</font>'],
+        ];
+    }
+
+    #[\PHPUnit\Framework\Attributes\DataProvider('colorAttributeProvider')]
+    public function testColorRepairFixesColorAttributes(string $html, string $expected): void
+    {
+        $this->assertSame($expected, $this->normalize($html));
+    }
+
+    public function testColorRepairFixesStyleAttributeValues(): void
+    {
+        $out = $this->normalize(
+            '<span style="color:#12;font-family:&#39;courier&#39;;border:1px solid #f0l">s</span>'
+            . "<span style='background-color:#ab'>t</span>",
+        );
+
+        $this->assertSame(
+            '<span style="color:#120000;font-family:&#39;courier&#39;;border:1px solid #f01000">s</span>'
+            . "<span style='background-color:#ab0000'>t</span>",
+            $out,
+        );
+    }
+
+    public function testColorRepairFixesOnlyStyleBlockDeclarationValues(): void
+    {
+        $out = $this->normalize(
+            '<style>#a1 { color:#4169el; } a:hover #a1 { background:#ab } p { content:"#1" }</style>'
+            . '<p id="a1">#1</p>',
+        );
+
+        $this->assertSame(
+            '<style>#a1 { color:#4169e1; } a:hover #a1 { background:#ab0000 } p { content:"#1" }</style>'
+            . '<p id="a1">#1</p>',
+            $out,
+        );
+    }
+
+    public function testWriteHtmlKeepsNumbersAndCharacterReferences(): void
+    {
+        $pdf = $this->newPdf();
+        $pdf->SetFont('helvetica', '', 10);
+        $pdf->AddPage();
+        $pdf->writeHTML(
+            '<p>Order #1, issue #12, ref #12345, item #123456, tag #abc</p>'
+            . '<p>A&#38;B, x&#35;y, a&#39;b, &#039;q&#039;, &#8364;</p>',
+        );
+
+        $text = $this->extractText($pdf);
+        $this->assertStringContainsString('Order #1, issue #12, ref #12345, item #123456, tag #abc', $text);
+        $this->assertStringContainsString("A&B, x#y, a'b, 'q', \u{20AC}", $text);
+    }
+
+    public function testLegacyPageAnchorsBecomeInternalLinks(): void
+    {
+        $out = $this->normalize('<a href="#2">p2</a><a href=\'#3,25.5\'>p3</a><a href="#chapter2">c2</a>');
+
+        $this->assertMatchesRegularExpression(
+            '/^<a href="@\d+">p2<\/a><a href=\'@\d+\'>p3<\/a><a href="#chapter2">c2<\/a>$/',
+            $out,
+        );
+    }
+
+    public function testLegacyPageAnchorLinksToThePage(): void
+    {
+        $pdf = $this->newPdf();
+        $pdf->setCompression(false);
+        $pdf->SetFont('helvetica', '', 10);
+        $pdf->AddPage();
+        $pdf->writeHTML('<a href="#2">link to page 2</a>');
+        $pdf->AddPage();
+        $pdf->writeHTML('page 2');
+
+        $raw = (string) $pdf->getPDFData();
+        $pages = [];
+        preg_match_all('/(\d+) 0 obj\s*<<\s*\/Type \/Page\b/', $raw, $pages);
+        $this->assertCount(2, $pages[1] ?? []);
+        $dest = [];
+        $this->assertSame(1, preg_match('/\/Dest \[(\d+) 0 R \/XYZ /', $raw, $dest));
+        $this->assertSame($pages[1][1] ?? '', $dest[1] ?? '');
+    }
 }