Tech article

Bypassing Apache Fop PostScript Escaping to Reach GhostScript

Community description: 5 points · 0 comments on Hacker News

Hacker News | Mar 8, 2026 | notmine1337

Automated excerpt

For example, sending the following: 1 0 0 -1 166. 218 112. 199 Tm 1 0 0 -1 -6814. 694 133. 799 Tm The bug is the combination of these two features: inserting character that could close the PostScript string will force Apache FOP to insert an escaping character, i. e. aa)aa becomes aa\)aa. Icare found a way to bypass this behavior: using a non-breaking space (hexadecimal \xa0) does correctly separate a PostScript command without allowing Apache FOP insert a new line. 1 0 0 -1 220. 443 112. 199 Tm 1 0 0 -1 -787. 871 133.

Selected automatically from source text; not independently written or fact-checked. Read the original for full context.

Read the original article

More tech news