mirror of
https://github.com/storytold/pdfcraft.git
synced 2026-10-30 13:08:48 -06:00
21d5323132
* Rework faux-redaction audit per maintainer review - Paint-order aware: a rectangle counts as a cover only when painted strictly after the text (positions from the joined content stream). - Colour-aware: WCAG contrast between text and cover must be below 3.0, so page backgrounds, table shading and highlights are not flagged. - Fail closed: audit_redactions returns Err on undecodable content streams (decoded_strict) and malformed /Annots; the operator bound is an error, not a silent truncation. - Graphics state carries across a page's content streams (one joined walk); form XObjects still isolate their state at Do. - Audit-only: the sanitize-for-sharing half is dropped (upstream #162). - Parity entry marked partial, not shipped. * Audit: register its layer, add a README, fail closed past 32 nested forms, document what it doesn't check --------- Co-authored-by: Erick Barraza <ejbarraza1994@gmail.com> Co-authored-by: Brandon Thomas <echelon@gmail.com>
31 lines
1.3 KiB
Markdown
31 lines
1.3 KiB
Markdown
# pdfcraft-audit
|
|
|
|
Layer L4 (may use `edit`): verification tooling, the faux-redaction audit.
|
|
|
|
```rust
|
|
let findings: Vec<Finding> = audit_redactions(&doc)?; // page, kind, rect, covered_text
|
|
```
|
|
|
|
It reports two kinds of finding:
|
|
|
|
- **faux redaction**: an opaque filled rectangle painted *after* text it overlaps, dark enough
|
|
against the text's colour (WCAG contrast below 3) to hide it, while the text is still
|
|
extractable underneath;
|
|
- **unapplied mark**: a Redact annotation that was marked but never applied.
|
|
|
|
A properly applied redaction removes the text, so it never flags. Page backgrounds, table
|
|
shading and highlights don't either: they're painted before the text, or light against it.
|
|
|
|
Limits, by design and documented rather than hidden:
|
|
|
|
- only `re` rectangles closed by a fill count as covers (not arbitrary paths, shadings or
|
|
patterns), and a translucent one (`/ca` below 1) is not flagged;
|
|
- covers inside form XObjects are found, but only text drawn directly in the page content is
|
|
checked under them;
|
|
- annotation rectangles are compared in unrotated user space, so `/Rotate` pages may misalign.
|
|
|
|
It fails closed: an undecodable content stream, malformed `/Annots`, form XObjects nested deeper
|
|
than 32 or in a cycle, or a walk past the operator bound is an error, never "no findings".
|
|
|
|
Surfaces: the `redact_audit` automation tool and `pdfcraft-cli`.
|