diff --git a/crates/redact/src/tags.rs b/crates/redact/src/tags.rs index 961f016e94..648c0c29e5 100644 --- a/crates/redact/src/tags.rs +++ b/crates/redact/src/tags.rs @@ -2,7 +2,7 @@ //! //! Marked content (MCIDs) that applying redactions changed is found by comparing each MCID's //! operators before and after. Elements owning such content lose their alternate text, actual -//! text and expansion (which may spell out the removed words); +//! text, title and expansion (which may spell out the removed words), as do their ancestors; //! references to marked content that is now empty are dropped from the element. use std::collections::{HashMap, HashSet}; @@ -281,7 +281,7 @@ pub(crate) fn clean_within( } doc.update_dict(r, |e| { if sensitive { - for key in [&b"Alt"[..], b"ActualText", b"E"] { + for key in DESCRIPTIONS { e.remove(key); } } @@ -321,8 +321,10 @@ impl Above { } } -/// The keys of an element that describe its content. -const DESCRIPTIONS: [&[u8]; 3] = [b"Alt", b"ActualText", b"E"]; +/// The keys of an element that describe its content, and so may repeat what was removed: one +/// policy for the element that owned it, the elements above it and elements written in place. +/// The title (`/T`) is included, as producers often fill it with the element's text. +const DESCRIPTIONS: [&[u8]; 4] = [b"Alt", b"ActualText", b"T", b"E"]; /// Each element's parents as the walk found them: through `/K`, which `/P` may not agree with. struct Parents(HashMap>); @@ -539,7 +541,7 @@ pub(crate) fn drop_object_refs_within(doc: &mut Document, gone: &HashSet // An element that lost an annotation keeps no text describing it, even with other // kids left: a link's alternate text often repeats the URL, an annotation's its // comment. Elements above it may describe it too. - for key in [&b"Alt"[..], b"ActualText", b"T", b"E"] { + for key in DESCRIPTIONS { e.remove(key); } })?; diff --git a/crates/redact/src/tests/descriptions.rs b/crates/redact/src/tests/descriptions.rs index df6b8555dc..0495dd1f70 100644 --- a/crates/redact/src/tests/descriptions.rs +++ b/crates/redact/src/tests/descriptions.rs @@ -62,3 +62,61 @@ fn a_link_element_that_keeps_its_text_loses_the_description_of_its_removed_annot let link = doc.get(ObjRef::new(11, 0)).as_dict().cloned().unwrap(); assert_eq!(link.get(b"K"), Some(&Object::Array(vec![Object::Int(0)])), "the element keeps its text"); } + +/// [`sectioned`], with titles that repeat the secret on the paragraph that owns it, on its section +/// and on the document element above both. +fn titled() -> Document { + let mut doc = sectioned("11 0 R"); + let title = |t: &str| Object::String(pdfcraft_cos::PdfString::literal(t.as_bytes().to_vec())); + for (n, t) in [(8, "LEAK_DOC_TITLE"), (9, "LEAK_OWN_TITLE"), (11, "LEAK_SECT_TITLE"), (10, "Public title")] { + doc.update_dict(ObjRef::new(n, 0), |d| d.set(b"T".to_vec(), title(t))).unwrap(); + } + doc +} + +#[test] +fn titles_repeating_redacted_content_go_from_the_owner_and_its_ancestors() { + let mut doc = titled(); + mark(&mut doc, 0, &[[5.0, 195.0, 60.0, 212.0]], ""); + apply(&mut doc, None).unwrap(); + assert!(!full_save_holds(&doc, b"LEAK_"), "a structure title repeating the redacted word survived"); + let public = doc.get(ObjRef::new(10, 0)).as_dict().cloned().unwrap(); + assert!(public.contains(b"T"), "an element beside it keeps its own title"); +} + +#[test] +fn titles_repeating_hidden_text_go_from_the_owner_and_its_ancestors() { + use crate::sanitize::{Hidden, remove_hidden}; + let mut doc = titled(); + let hidden = + b"/P <> BDC BT /F1 10 Tf 3 Tr 10 200 Td (SECRET) Tj ET EMC /P <> BDC BT /F1 10 Tf 0 Tr 10 100 Td (Public) Tj ET EMC"; + doc.set(ObjRef::new(4, 0), Object::Stream(Stream::from_raw(Dict::new(), hidden.to_vec()))); + remove_hidden(&mut doc, &[Hidden::HiddenText]).unwrap(); + assert!(!full_save_holds(&doc, b"SECRET"), "the hidden text survived"); + assert!(!full_save_holds(&doc, b"LEAK_"), "a structure title repeating the hidden text survived"); + let public = doc.get(ObjRef::new(10, 0)).as_dict().cloned().unwrap(); + assert!(public.contains(b"T"), "an element beside it keeps its own title"); +} + +#[test] +fn an_ancestor_title_describing_a_removed_annotation_goes() { + use crate::sanitize::{Hidden, remove_hidden}; + let mut doc = pdf(vec![ + b"<< /Type /Catalog /Pages 2 0 R /MarkInfo << /Marked true >> /StructTreeRoot 8 0 R >>".to_vec(), + b"<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_vec(), + b"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 300 300] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> /Annots [6 0 R] /StructParents 0 >>" + .to_vec(), + stream("", b"/Link << /MCID 0 >> BDC BT /F1 10 Tf 10 230 Td (See the site) Tj ET EMC"), + FONT.replace("95 0 R", "12 0 R").into_bytes(), + b"<< /Type /Annot /Subtype /Link /Rect [10 228 80 240] /StructParent 1 /A << /S /URI /URI (https://example.org/) >> >>".to_vec(), + b"null".to_vec(), + b"<< /Type /StructTreeRoot /K 9 0 R /ParentTree << /Nums [0 [11 0 R] 1 11 0 R] >> /ParentTreeNextKey 2 >>".to_vec(), + b"<< /Type /StructElem /S /Document /P 8 0 R /K 10 0 R >>".to_vec(), + // Only a title above the link element repeats the address. + b"<< /Type /StructElem /S /P /P 9 0 R /T (LEAK_PARENT_TITLE) /K 11 0 R >>".to_vec(), + b"<< /Type /StructElem /S /Link /P 10 0 R /Pg 3 0 R /K [0 << /Type /OBJR /Obj 6 0 R /Pg 3 0 R >>] >>".to_vec(), + widths(), + ]); + remove_hidden(&mut doc, &[Hidden::LinksActionsScripts]).unwrap(); + assert!(!full_save_holds(&doc, b"LEAK_"), "an ancestor's title describing the removed link survived"); +}