diff --git a/crates/redact/src/lib.rs b/crates/redact/src/lib.rs index a8dbf64d9..78be3096f 100644 --- a/crates/redact/src/lib.rs +++ b/crates/redact/src/lib.rs @@ -51,6 +51,13 @@ pub enum RedactError { "redaction appearance has invalid geometry or exceeds the 8 MiB budget; reduce the marked area, turn off repeated text or apply fewer pages at once (nothing was redacted)" )] OverlayLimit, + /// The structure tree couldn't be cleaned completely (#3302): an element written in place that + /// would need changing, an element whose inherited page can't be found, or a tree too large to + /// walk. Tags that kept the removed text or annotation would undo the redaction. + #[error( + "the document's tags can't be cleaned completely (an element written in place, or a structure tree too large or too deep to follow), so nothing was changed" + )] + Tags, #[error(transparent)] Edit(#[from] pdfcraft_edit::EditError), #[error(transparent)] diff --git a/crates/redact/src/tags.rs b/crates/redact/src/tags.rs index 2b117fcf4..ab5735e06 100644 --- a/crates/redact/src/tags.rs +++ b/crates/redact/src/tags.rs @@ -9,6 +9,8 @@ use std::collections::{HashMap, HashSet}; use pdfcraft_cos::{Dict, Document, ObjRef, Object}; +use crate::RedactError; + /// Each MCID's operators (serialized), and whether anything is still drawn inside it. fn by_mcid(doc: &Document, resources: &Dict, data: &[u8]) -> HashMap, bool)> { let mut out: HashMap, bool)> = HashMap::new(); @@ -103,13 +105,15 @@ pub(crate) fn clean( stream: Option<(ObjRef, ObjRef)>, changed: &HashSet, empty: &HashSet, -) -> Result { +) -> Result { clean_within(doc, page, stream, changed, empty, MAX_STRUCT_REFS) } -/// [`clean`], visiting at most `limit` structure-tree references. A tree too large to walk in full -/// could hide an element that repeats the redacted text, so then every element in the document -/// loses its alternate and actual text instead (fail-closed, #3302). +/// [`clean`], visiting at most `limit` structure-tree references. Fail-closed (#3302): when the +/// cleanup can't be shown complete, it is [`RedactError::Tags`] and the redaction isn't made. That +/// is a tree too large to walk in full (it could hide an element that repeats the redacted text), +/// an element whose inherited page can't be found (its ancestry too deep, or looping), and an +/// element written in place that would need changing (only the object holding it could be). pub(crate) fn clean_within( doc: &mut Document, page: ObjRef, @@ -117,7 +121,7 @@ pub(crate) fn clean_within( changed: &HashSet, empty: &HashSet, limit: usize, -) -> Result { +) -> Result { if changed.is_empty() && stream.is_none() { return Ok(0); } @@ -135,24 +139,36 @@ pub(crate) fn clean_within( let mut todo: Vec<(Object, Option)> = [&b"IDTree"[..], b"ParentTree", b"K"].iter().filter_map(|key| root.get(key).cloned()).map(|k| (k, None)).collect(); let mut seen = HashSet::new(); + let mut pages = HashMap::new(); let mut hits: Vec<(ObjRef, Dict, Option, bool)> = Vec::new(); + // Whether marked content `x` (a kid on page `pg`) is one this cleanup must change. + let touches = |doc: &Document, x: &Object, pg: Option| { + mcid_of(doc, x, pg, page, stream).is_some_and(|m| stream.is_some() || changed.contains(&m) || empty.contains(&m)) + }; while let Some((k, pg)) = todo.pop() { match k { Object::Array(a) => todo.extend(a.into_iter().map(|x| (x, pg))), // A number or name tree node written in place. Object::Dict(d) if !d.contains(b"S") => todo.extend(tree_node_entries(&d).into_iter().map(|x| (x, pg))), + // An element written in place: its kids are followed, but if it owns marked content + // this cleanup changes, only rewriting what holds it could change it. + Object::Dict(d) => { + let pg = match d.get(b"Pg").and_then(Object::as_ref).or(pg) { + Some(p) => Some(p), + None => inherited_page(doc, &d, &mut pages)?, + }; + let kids = kids_of(doc, &d); + if kids.iter().any(|x| touches(doc, x, pg)) { + return Err(RedactError::Tags); + } + todo.extend(kids.into_iter().map(|x| (x, pg))); + } Object::Ref(r) => { if !seen.insert(r) { continue; } if seen.len() > limit { - let n = clear_every_element(doc)?; - if stream.is_some() { - // Marked-content references the walk didn't reach still name the - // original stream through /Stm, which a full save would then keep. - drop_tree(doc)?; - } - return Ok(n); + return Err(RedactError::Tags); } let object = doc.get(r); if let Object::Array(a) = &*object { @@ -165,14 +181,11 @@ pub(crate) fn clean_within( todo.extend(tree_node_entries(&d).into_iter().map(|x| (x, pg))); continue; } - let pg = d.get(b"Pg").and_then(Object::as_ref).or(pg).or_else(|| inherited_page(doc, &d)); - let kids: Vec = match d.get(b"K").map(|k| doc.resolve(k)) { - Some(o) => match &*o { - Object::Array(a) => a.clone(), - _ => d.get(b"K").cloned().into_iter().collect(), - }, - None => Vec::new(), + let pg = match d.get(b"Pg").and_then(Object::as_ref).or(pg) { + Some(p) => Some(p), + None => inherited_page(doc, &d, &mut pages)?, }; + let kids = kids_of(doc, &d); let sensitive = kids.iter().any(|x| mcid_of(doc, x, pg, page, stream).is_some_and(|m| changed.contains(&m))); let remap = stream.is_some() && kids.iter().any(|x| mcid_of(doc, x, pg, page, stream).is_some()); if sensitive || remap { @@ -234,57 +247,49 @@ pub(crate) fn clean_within( Ok(n) } -/// The fail-closed end of a walk that couldn't finish: every structure element in the document, -/// found by reading each object rather than through the tree, loses the text that could repeat -/// redacted words. Returns how many elements changed. -fn clear_every_element(doc: &mut Document) -> Result { - let keys = [&b"Alt"[..], b"ActualText", b"E"]; - let elements: Vec = doc - .scan_objects() - .filter(|(_, o)| { - o.as_dict().is_some_and(|d| { - (d.name(b"Type") == Some(b"StructElem") || (d.contains(b"S") && d.contains(b"P"))) && keys.iter().any(|k| d.contains(k)) - }) - }) - .map(|(r, _)| r) - .collect(); - for &r in &elements { - doc.update_dict(r, |e| { - for key in keys { - e.remove(key); - } - })?; - } - Ok(elements.len()) -} - /// The page an element inherits (ยง14.7.4.4): the nearest `/Pg` among its ancestors, following -/// `/P` at most [`MAX_PARENTS`] steps. -fn inherited_page(doc: &Document, d: &Dict) -> Option { +/// `/P`. `Ok(None)` when none has one; [`RedactError::Tags`] when the lookup gives up (more than +/// [`MAX_PARENTS`] ancestors, or a loop), which isn't the same as having no page. `pages` keeps +/// each ancestor's answer, so siblings don't climb the same chain again. +fn inherited_page(doc: &Document, d: &Dict, pages: &mut HashMap>) -> Result, RedactError> { + let mut chain: Vec = Vec::new(); let mut parent = d.get(b"P").and_then(Object::as_ref); - for _ in 0..MAX_PARENTS { - let p = doc.get(parent?); - let p = p.as_dict()?; + let found = loop { + let Some(r) = parent else { break None }; + if let Some(known) = pages.get(&r) { + break *known; + } + if chain.len() >= MAX_PARENTS || chain.contains(&r) { + return Err(RedactError::Tags); + } + chain.push(r); + let object = doc.get(r); + let Some(p) = object.as_dict() else { break None }; if let Some(pg) = p.get(b"Pg").and_then(Object::as_ref) { - return Some(pg); + break Some(pg); } parent = p.get(b"P").and_then(Object::as_ref); + }; + for r in chain { + pages.insert(r, found); + } + Ok(found) +} + +/// An element's kids: its `/K` array, or the one kid it has. +fn kids_of(doc: &Document, d: &Dict) -> Vec { + match d.get(b"K").map(|k| doc.resolve(k)) { + Some(o) => match &*o { + Object::Array(a) => a.clone(), + _ => d.get(b"K").cloned().into_iter().collect(), + }, + None => Vec::new(), } - None } /// The most ancestors [`inherited_page`] looks through; deeper trees, and cycles, go unanswered. const MAX_PARENTS: usize = 256; -/// Remove the structure tree, with `/MarkInfo`, which would claim tags there no longer are. -fn drop_tree(doc: &mut Document) -> Result<(), pdfcraft_cos::CosError> { - let Some(catalog) = doc.root() else { return Ok(()) }; - doc.update_dict(catalog, |c| { - c.remove(b"StructTreeRoot"); - c.remove(b"MarkInfo"); - }) -} - /// Whether `o` is an object reference (`/Type /OBJR`, direct or indirect) to one of `gone`. fn refers_to(doc: &Document, o: &Object, gone: &HashSet) -> bool { doc.resolve(o) @@ -305,20 +310,21 @@ fn tree_node_entries(d: &Dict) -> Vec { /// /// Only elements that are objects of their own are edited: changing a structure element written in /// place (a direct dictionary in a `/K` array or a tree) means rewriting the object that holds it, -/// so when one of those refers to a removed annotation the whole tree goes instead (fail-closed). +/// so when one of those refers to a removed annotation it is [`RedactError::Tags`] (fail-closed). /// Producers rarely write elements that way. -pub(crate) fn drop_object_refs(doc: &mut Document, gone: &HashSet) -> Result { +pub(crate) fn drop_object_refs(doc: &mut Document, gone: &HashSet) -> Result { drop_object_refs_within(doc, gone, MAX_STRUCT_REFS) } /// The most structure-tree references [`drop_object_refs`] visits. const MAX_STRUCT_REFS: usize = 2_000_000; -/// [`drop_object_refs`], visiting at most `limit` references. A tree too large to walk in full -/// could keep a reference the walk never reached, so then the whole structure tree goes instead -/// (with `/MarkInfo`, which would claim tags there no longer are): fail-closed, at the cost of -/// the document's tags. -pub(crate) fn drop_object_refs_within(doc: &mut Document, gone: &HashSet, limit: usize) -> Result { +/// [`drop_object_refs`], visiting at most `limit` references. Fail-closed: a tree too large to +/// walk in full could keep a reference the walk never reached, and an element written in place +/// can only be changed by rewriting what holds it, so either is [`RedactError::Tags`] rather than +/// a cleanup that leaves the annotation reachable (removing only the tree would not: an outline +/// item's `/SE` or a link's `/SD` still reaches its elements). +pub(crate) fn drop_object_refs_within(doc: &mut Document, gone: &HashSet, limit: usize) -> Result { if gone.is_empty() { return Ok(0); } @@ -337,19 +343,12 @@ pub(crate) fn drop_object_refs_within(doc: &mut Document, gone: &HashSet while let Some(k) = todo.pop() { match k { Object::Array(a) => todo.extend(a), - // A structure element written in place: its kids, and if it tags a removed - // annotation, the whole tree (see above). + // A structure element written in place: its kids are followed; one that tags a + // removed annotation can't be changed here (see above). Object::Dict(d) if d.contains(b"S") => { - let kids: Vec = match d.get(b"K").map(|k| doc.resolve(k)) { - Some(o) => match &*o { - Object::Array(a) => a.clone(), - _ => d.get(b"K").cloned().into_iter().collect(), - }, - None => Vec::new(), - }; + let kids = kids_of(doc, &d); if kids.iter().any(|x| refers_to(doc, x, gone)) { - drop_tree(doc)?; - return Ok(0); + return Err(RedactError::Tags); } todo.extend(kids); } @@ -360,8 +359,7 @@ pub(crate) fn drop_object_refs_within(doc: &mut Document, gone: &HashSet continue; } if seen.len() > limit { - drop_tree(doc)?; - return Ok(0); + return Err(RedactError::Tags); } let object = doc.get(r); if let Object::Array(a) = &*object { @@ -374,13 +372,7 @@ pub(crate) fn drop_object_refs_within(doc: &mut Document, gone: &HashSet todo.extend(tree_node_entries(d)); continue; } - let kids: Vec = match d.get(b"K").map(|k| doc.resolve(k)) { - Some(o) => match &*o { - Object::Array(a) => a.clone(), - _ => d.get(b"K").cloned().into_iter().collect(), - }, - None => Vec::new(), - }; + let kids = kids_of(doc, d); if kids.iter().any(|x| refers_to(doc, x, gone)) { hits.push(r); } diff --git a/crates/redact/src/tests.rs b/crates/redact/src/tests.rs index c721c5e6d..8af417dcc 100644 --- a/crates/redact/src/tests.rs +++ b/crates/redact/src/tests.rs @@ -810,11 +810,12 @@ fn flattened_widgets_and_far_pop_ups_leave_the_structure_tree() { } /// #2532 review: a structure tree larger than the walk's limit can't be searched in full, so a -/// reference the walk never reached could keep a removed annotation. Then the whole tree goes -/// (with `/MarkInfo`), rather than reporting success with references left behind; under the -/// limit only the reference goes. +/// reference the walk never reached could keep a removed annotation. Then it is an error, and +/// nothing is changed, rather than success with references left behind (removing only the tree +/// would leave an outline's `/SE` reaching them, review on #3285); under the limit only the +/// reference goes. #[test] -fn a_structure_tree_too_large_to_walk_is_removed_whole() { +fn a_structure_tree_too_large_to_walk_is_refused() { let objs: Vec> = vec![ b"<< /Type /Catalog /Pages 2 0 R /MarkInfo << /Marked true >> /StructTreeRoot 5 0 R >>".to_vec(), b"<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_vec(), @@ -835,11 +836,8 @@ fn a_structure_tree_too_large_to_walk_is_removed_whole() { assert!(catalog(&doc).contains(b"StructTreeRoot") && catalog(&doc).contains(b"MarkInfo"), "under the limit the tree stays"); let mut doc = pdf(objs); - crate::tags::drop_object_refs_within(&mut doc, &gone, 2).unwrap(); - assert!(!catalog(&doc).contains(b"StructTreeRoot"), "a tree the walk couldn't finish goes whole"); - assert!(!catalog(&doc).contains(b"MarkInfo")); - let bytes = write_full(&doc, &SaveOptions { object_streams: false, ..SaveOptions::default() }).unwrap(); - assert!(!bytes.windows(14).any(|w| w == b"secret.example"), "the removed link can't be reached any more"); + assert!(matches!(crate::tags::drop_object_refs_within(&mut doc, &gone, 2), Err(RedactError::Tags)), "a tree the walk couldn't finish is refused"); + assert!(catalog(&doc).contains(b"StructTreeRoot"), "nothing changed"); } /// #3302: an element listed only in the parent tree (not under the root's /K) still owns the @@ -868,11 +866,10 @@ fn an_element_listed_only_in_the_parent_tree_loses_its_redacted_text() { assert!(!element.contains(b"ActualText") && !element.contains(b"Alt"), "{element:?}"); } -/// #3302: a structure tree too large to walk in full fails closed: every element loses its -/// alternate and actual text, found by reading each object, instead of the walk stopping and -/// reporting success with elements never checked. +/// #3302: a structure tree too large to walk in full fails closed: an error, so the redaction +/// isn't made, instead of the walk stopping and reporting success with elements never checked. #[test] -fn a_tag_walk_cut_short_clears_every_element() { +fn a_tag_walk_cut_short_is_refused() { let objs: Vec> = vec![ b"<< /Type /Catalog /Pages 2 0 R /StructTreeRoot 5 0 R >>".to_vec(), b"<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_vec(), @@ -886,17 +883,12 @@ fn a_tag_walk_cut_short_clears_every_element() { let page = ObjRef::new(3, 0); let changed: std::collections::HashSet = [0].into(); let mut doc = pdf(objs.clone()); - crate::tags::clean_within(&mut doc, page, None, &changed, &Default::default(), 100).unwrap(); + assert_eq!(crate::tags::clean_within(&mut doc, page, None, &changed, &Default::default(), 100).unwrap(), 1); let figure = doc.get(ObjRef::new(8, 0)).as_dict().cloned().unwrap(); assert!(figure.contains(b"Alt"), "a walk that finishes keeps an unrelated element's text"); let mut doc = pdf(objs); - let n = crate::tags::clean_within(&mut doc, page, None, &changed, &Default::default(), 1).unwrap(); - assert_eq!(n, 2, "both elements with text change"); - for r in [7, 8] { - let e = doc.get(ObjRef::new(r, 0)).as_dict().cloned().unwrap(); - assert!(!e.contains(b"ActualText") && !e.contains(b"Alt") && !e.contains(b"E"), "{r}: {e:?}"); - } + assert!(matches!(crate::tags::clean_within(&mut doc, page, None, &changed, &Default::default(), 1), Err(RedactError::Tags))); } /// #2532 follow-up: an element reached only through the parent tree or the ID tree, not from @@ -957,37 +949,11 @@ fn an_element_inheriting_its_page_loses_its_redacted_text_when_the_parent_tree_l } } -/// #3285 review: when the tag walk is cut short while redaction replaced a form's stream, the -/// marked-content references it never reached still name the original stream through /Stm, so -/// the tree goes, as it does for removed annotations. Without a replaced stream it stays. -#[test] -fn a_tag_walk_cut_short_over_a_replaced_stream_removes_the_tree() { - let objs: Vec> = vec![ - b"<< /Type /Catalog /Pages 2 0 R /StructTreeRoot 5 0 R /MarkInfo << /Marked true >> >>".to_vec(), - b"<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_vec(), - b"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 300 300] /StructParents 0 >>".to_vec(), - stream("/Type /XObject /Subtype /Form /BBox [0 0 10 10]", b"/P <> BDC EMC"), - b"<< /Type /StructTreeRoot /K 6 0 R >>".to_vec(), - b"<< /Type /StructElem /S /Document /P 5 0 R /K [7 0 R] >>".to_vec(), - b"<< /Type /StructElem /S /P /P 6 0 R /Pg 3 0 R /K << /Type /MCR /MCID 0 /Stm 4 0 R >> >>".to_vec(), - stream("/Type /XObject /Subtype /Form /BBox [0 0 10 10]", b""), - ]; - let page = ObjRef::new(3, 0); - let streams = Some((ObjRef::new(4, 0), ObjRef::new(8, 0))); - let has_tree = |doc: &Document| doc.get(doc.root().unwrap()).as_dict().is_some_and(|c| c.contains(b"StructTreeRoot") && c.contains(b"MarkInfo")); - let mut doc = pdf(objs.clone()); - crate::tags::clean_within(&mut doc, page, None, &[0].into(), &Default::default(), 1).unwrap(); - assert!(has_tree(&doc), "without a replaced stream the tree stays"); - let mut doc = pdf(objs); - crate::tags::clean_within(&mut doc, page, streams, &Default::default(), &Default::default(), 1).unwrap(); - assert!(!has_tree(&doc), "a cut-short walk over a replaced stream drops the tree"); -} - /// #3285 review: a structure element written in place, here as an ID tree value, can't be -/// edited without rewriting what holds it; when it tags a removed annotation the tree goes -/// instead of keeping the annotation reachable in a full rewrite. +/// edited without rewriting what holds it; when it tags a removed annotation, removing hidden +/// information is refused instead of keeping the annotation reachable in a full rewrite. #[test] -fn an_element_written_in_place_that_tags_a_removed_annotation_removes_the_tree() { +fn an_element_written_in_place_that_tags_a_removed_annotation_is_refused() { let objs: Vec> = vec![ b"<< /Type /Catalog /Pages 2 0 R /MarkInfo << /Marked true >> /StructTreeRoot 5 0 R >>".to_vec(), b"<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_vec(), @@ -998,11 +964,74 @@ fn an_element_written_in_place_that_tags_a_removed_annotation_removes_the_tree() ]; let gone: std::collections::HashSet = [ObjRef::new(4, 0)].into(); let mut doc = pdf(objs); - crate::tags::drop_object_refs(&mut doc, &gone).unwrap(); - let catalog = doc.get(doc.root().unwrap()).as_dict().cloned().unwrap(); - assert!(!catalog.contains(b"StructTreeRoot") && !catalog.contains(b"MarkInfo"), "{catalog:?}"); - let bytes = write_full(&doc, &SaveOptions { object_streams: false, ..SaveOptions::default() }).unwrap(); - assert!(!bytes.windows(8).any(|w| w == b"hushhush"), "the removed comment can't be reached any more"); + assert!(matches!(crate::tags::drop_object_refs(&mut doc, &gone), Err(RedactError::Tags))); +} + +/// Whether a full rewrite of `doc` still holds the redacted word. +fn bluefin_survives(doc: &Document) -> bool { + let bytes = write_full(doc, &SaveOptions { object_streams: false, ..SaveOptions::default() }).unwrap(); + bytes.windows(7).any(|w| w == b"Bluefin") +} + +/// #3285 review (the maintainer's probes): an element written in place in the parent tree that +/// owns the redacted text can't be changed, so applying is refused; the same element as an object +/// of its own is cleaned, and nothing of the word is left in a full rewrite. +#[test] +fn an_element_written_in_place_owning_redacted_text_is_refused() { + let objs = |element: &str| -> Vec> { + vec![ + b"<< /Type /Catalog /Pages 2 0 R /StructTreeRoot 5 0 R /MarkInfo << /Marked true >> >>".to_vec(), + b"<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_vec(), + b"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 300 300] /Contents 4 0 R /StructParents 0 /Resources << /Font << /F1 9 0 R >> >> >>" + .to_vec(), + stream("", b"/P <> BDC BT /F1 14 Tf 20 150 Td (Codename Bluefin) Tj ET EMC"), + format!("<< /Type /StructTreeRoot /K 6 0 R /ParentTree << /Nums [0 [{element}]] >> /ParentTreeNextKey 1 >>").into_bytes(), + b"<< /Type /StructElem /S /Document /P 5 0 R >>".to_vec(), + b"<< /Type /StructElem /S /P /P 6 0 R /Pg 3 0 R /K 0 /ActualText (Codename Bluefin) >>".to_vec(), + b"<< >>".to_vec(), + b"<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica /Encoding /WinAnsiEncoding >>".to_vec(), + ] + }; + let mut doc = pdf(objs("<< /Type /StructElem /S /P /P 6 0 R /Pg 3 0 R /K 0 /ActualText (Codename Bluefin) >>")); + mark(&mut doc, 0, &[[10.0, 140.0, 290.0, 170.0]], ""); + assert!(matches!(apply(&mut doc, None), Err(RedactError::Tags))); + let mut doc = pdf(objs("7 0 R")); + mark(&mut doc, 0, &[[10.0, 140.0, 290.0, 170.0]], ""); + let r = apply(&mut doc, None).unwrap(); + assert!(r.glyphs > 0 && !bluefin_survives(&doc), "{r:?}"); +} + +/// #3285 review: an element whose inherited page can't be found (more ancestors than the lookup +/// follows) isn't taken for one with no page: applying is refused. Within the limit the page is +/// found and the text goes. +#[test] +fn an_element_whose_inherited_page_is_out_of_reach_is_refused() { + let objs = |depth: u32| -> Vec> { + let mut objs: Vec> = vec![ + b"<< /Type /Catalog /Pages 2 0 R /StructTreeRoot 5 0 R /MarkInfo << /Marked true >> >>".to_vec(), + b"<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_vec(), + b"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 300 300] /Contents 4 0 R /StructParents 0 /Resources << /Font << /F1 9 0 R >> >> >>" + .to_vec(), + stream("", b"/P <> BDC BT /F1 14 Tf 20 150 Td (Codename Bluefin) Tj ET EMC"), + b"<< /Type /StructTreeRoot /K 6 0 R /ParentTree << /Nums [0 [7 0 R]] >> /ParentTreeNextKey 1 >>".to_vec(), + b"<< /Type /StructElem /S /Document /P 5 0 R /Pg 3 0 R >>".to_vec(), + format!("<< /Type /StructElem /S /P /P {} 0 R /K 0 /ActualText (Codename Bluefin) >>", 10 + depth - 1).into_bytes(), + b"<< >>".to_vec(), + b"<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica /Encoding /WinAnsiEncoding >>".to_vec(), + ]; + for i in 0..depth { + let parent = if i == 0 { 6 } else { 10 + i - 1 }; + objs.push(format!("<< /Type /StructElem /S /Div /P {parent} 0 R >>").into_bytes()); + } + objs + }; + let mut doc = pdf(objs(300)); + mark(&mut doc, 0, &[[10.0, 140.0, 290.0, 170.0]], ""); + assert!(matches!(apply(&mut doc, None), Err(RedactError::Tags))); + let mut doc = pdf(objs(100)); + mark(&mut doc, 0, &[[10.0, 140.0, 290.0, 170.0]], ""); + apply(&mut doc, None).unwrap(); + assert!(!bluefin_survives(&doc)); } /// Issue #1325: removing comments keeps the annotations that are not comments: the multimedia