Merge pull request matplotlib#31646 from meeseeksmachine/auto-backport-of-pr-31632-on-v3.11.x

Backport PR matplotlib#31632 on branch v3.11.x (FIX: Prohibit special TeX chars in pgf metadata)

Author: rcomer

lib/matplotlib/backends/backend_pgf.py

@@ -154,6 +154,15 @@ def _metadata_to_str(key, value):
         value = value.name.decode('ascii')
     else:
         value = str(value)
+
+    # ensure that metadata does not contain special TeX chars because we
+    # insert the metadata as raw text into the TeX source
+    invalid_chars = r"\{}[]()"
+    if any(c in value + key for c in invalid_chars):
+        raise ValueError(
+            f"Invalid metadata value for {key!r}: {value!r}. "
+            f"The value must not contain the chars {invalid_chars}.")
+
     return f'{key}={{{value}}}'
 
 

lib/matplotlib/tests/test_backend_pgf.py

@@ -15,7 +15,7 @@
 from matplotlib.testing import _has_tex_package, _check_for_pgf
 from matplotlib.testing.exceptions import ImageComparisonFailure
 from matplotlib.testing.compare import compare_images
-from matplotlib.backends.backend_pgf import PdfPages
+from matplotlib.backends.backend_pgf import _metadata_to_str, PdfPages
 from matplotlib.testing.decorators import (
     _image_directories, check_figures_equal, image_comparison)
 from matplotlib.testing._markers import (
@@ -37,6 +37,26 @@ def compare_figure(fname, savefig_kwargs={}, tol=0):
         raise ImageComparisonFailure(err)
 
 
+@pytest.mark.parametrize("key, value, expected_str", [
+    ("Author", "me", "Author={me}"),
+    ("ModDate",
+     datetime.datetime(1968, 8, 1, tzinfo=datetime.timezone(datetime.timedelta(0))),
+     "ModDate={D:19680801000000Z}"),
+])
+def test__metadata_to_str(key, value, expected_str):
+    assert _metadata_to_str(key, value) == expected_str
+
+
+@pytest.mark.parametrize("value", [
+    r"Backslashes, e.g. in \commands",
+    r"funny braces {}",
+    r"and square brackets]",
+])
+def test__metadata_to_str_error(value):
+    with pytest.raises(ValueError, match="value must not contain the chars"):
+        _metadata_to_str("Title", value)
+
+
 @needs_pgf_xelatex
 @needs_ghostscript
 @pytest.mark.backend('pgf')