ScroogeXHTML 11.0 for Object Pascal is out today. The component converts RTF to HTML5 and XHTML in Delphi 2009+ and Free Pascal/Lazarus, and ships with full source code.

The biggest change in 11.0: RTF tables now become real HTML tables, and multi-level lists become nested HTML lists. Many defaults now also match ScroogeXHTML for Java, so both products give the same output for the same document.

What’s new

Tables. RTF tables become HTML tables instead of loose paragraphs. The conversion handles:

  • header rows
  • column widths
  • cell borders and shading
  • vertical alignment
  • horizontally merged cells, written as colspan
  • table alignment and cell padding

A cell can hold several paragraphs and lists, and each paragraph keeps its own formatting. In plain-text output each row becomes one line, with cells separated by tabs. Use the new ConvertTables property and OptionsTable group to control this. Vertically merged cells and nested tables are not converted yet.

Nested lists. Multi-level RTF lists become nested HTML lists. Before, every level was flattened into one list. A list whose level jumps (TRichView and WPTools write these) now gives valid HTML, and items get the right number format for their level.

Same output as the Java product. These now work as they do in ScroogeXHTML for Java:

  • font sizes in em, with half-point precision; the new fsPX writes CSS pixels
  • language attributes for 60 Windows language codes (13 before)
  • empty paragraphs written as line breaks
  • pictures up to 256 KiB embedded as data URIs
  • bookmark anchors with valid ids, also for internal links

Fixes. The most visible ones:

  • Hidden text no longer hides the visible text after it.
  • Free Pascal no longer loses emoji and other characters outside the Basic Multilingual Plane.
  • Top-aligned table cells are no longer centred.
  • Font names starting with @ now work in CSS.

A W3C-style DOM. For post-processors, the document tree uses W3C DOM names: ParentNode, ChildNodes, AppendChild, RemoveChild and so on. The old names still work but are deprecated. Navigating the tree is safer too: a post-processor can keep a reference to a node without crashing the conversion.

Safer with untrusted RTF

11.0 continues the hardening work of the 10.x line for applications that convert RTF they don’t control, such as uploads or mail:

  • Lower nesting limit. OptionsSecurity.MaxGroupDepth now defaults to 256 groups (4096 before), as in the Java product. Real documents nest far less deeply.
  • Internal errors are easy to spot. The new ESxUnexpectedError wraps internal errors such as access violations, so you can tell a converter bug from bad input. It is a subclass of ESxConversionError, so existing handlers still catch it.
  • No empty links. A hyperlink with a disallowed target, such as javascript: or file:, is written without href. Before, it got href="", which links to the current page.
  • Stricter strict mode. With OptionsSecurity.StrictMode, a \u escape for a character that XML does not allow now raises an error.

The threat model, the four guarantees and how to report a vulnerability are in doc/SECURITY.md, which ships with the product.

Upgrading from 10.x

With its new defaults, 11.0 writes different HTML than 10.x for the same code. Each default can be switched back with one line. To keep the 10.x output:

Scrooge.ConvertEmptyParagraphs := False;  // 11.0 default: True
Scrooge.FontSizeScale := fsPoint;         // 11.0 default: fsEM
Scrooge.ConvertTables := False;           // 11.0 default: True
Scrooge.ConvertLanguage := False;         // 11.0 default: True
Scrooge.OptionsSecurity.MaxGroupDepth := 4096;  // 11.0 default: 256
// if you use the data URI picture adapter without an explicit limit:
Scrooge.PictureAdapter := TMemoryPictureAdapterDataURI.Create(1);  // 11.0 default: 256 KiB

Three things to check:

  • Forms keep their settings. A component on a .dfm/.lfm form keeps the values stored with 10.x until you change them in the Object Inspector.
  • fsEX is gone. A form that stored FontSizeScale = fsEX won’t load. Change it to fsEM in the form file, as text, before you open the form.
  • Non-UTF-8 content types are rejected. The output is always UTF-8, so a MetaContentType with another charset now raises ESxConfigurationError.

Every change, and how to undo it, is listed in the new migration guide, doc/MIGRATING.md.

Get it

ScroogeXHTML 11.0 is available now as an installer and a source zip from the ScroogeXHTML for Object Pascal page. The download includes the Getting Started guide, the API reference, the migration guide and the security policy. The full list of changes is in the release notes.

Visited 2 times, 1 visit(s) today