mirror of
https://github.com/storytold/pdfcraft.git
synced 2026-10-25 02:29:31 -06:00
b642e327e7
* fix(create): cap decoded size of imported PNGs A PNG's declared dimensions sized an infallible allocation, so a few-byte file claiming huge dimensions aborted the process when the allocation failed. Cap the decoded size at the TIFF ceiling and reserve every input-sized buffer fallibly, returning CreateError::Image instead. (Security audit run-2: v3-024.) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(xfa): bound total picture bytes kept during layout Each laid-out picture kept its own copy, so one picture in a repeating subform multiplied without bound and could exhaust memory on open. Add a per-layout aggregate cap (256 MiB) that stops with XfaError::TooLarge. (Security audit run-2: v3-103.) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(xfdf): bound XML nesting and protect redaction marks on import Deeply nested XFDF/XML overflowed roxmltree's recursive parser and aborted the process; a non-recursive depth scan now rejects it before parsing. Imported comments could also replace a locked or redaction mark by /NM or add a hidden one; place() no longer replaces locked/Redact annotations and clears the hidden/invisible flags on imported redaction marks. (Security audit run-2: v3-105, v3-111.) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(sign): classify post-signing changes by the signed revision's roles A signed object's modification was classified from labels in the attacker-written new version, so relabelling a signed page /Type /Sig (or giving it /ModDate), or relabelling a drawn stream /ObjStm or /XRef, let a forged page validate as Valid even under DocMDP P=1. Decide an object's role (page content, signature, metadata, file plumbing) from what it was in the signed revision, not its new dictionary. (Security audit run-2: v3-082, v3-083.) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(redact): remove redacted content from the saved file, fail closed otherwise Apply Redactions and Remove Hidden Information left the originals behind: dropped or cleaned image/form XObjects kept their resource names (so the full rewrite saved the originals), an XFA form kept the redacted value in its datasets packet, and vertical-writing text under a mark was never hit by the horizontal removal geometry yet reported success. Prune replaced XObject names the page no longer draws, drop /XFA and /NeedsRendering when redacting an XFA form, and fail closed (RedactError::VerticalText) rather than silently leave vertical text. (Security audit run-2: v3-064, v3-067, v3-062.) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(ui-egui): trust the displayed signer, not the document's embedded root The Signatures panel's one-click 'Add to trusted certificates' trusted the top of the chain the document supplied, installing the author's self-signed root as an anchor instead of the signer shown. Trust the displayed signer certificate. (Security audit run-2: v3-098.) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * Use main's decoded-size ceiling for PNGs too; keep the depth tests on main's checker --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> Co-authored-by: Brandon Thomas <echelon@gmail.com>
pdfcraft-xfdf
Layer L4: comment and form data exchange (execution plan M5.6, M6.7).
let xml = export_xfdf(&doc, true, true, "form.pdf"); // comments and/or field values
let fdf = export_fdf(&doc, false, true, "form.pdf");
let txt = export_data(&doc, Format::Txt); // or Xml, Csv
let report = import(&mut doc, &bytes)?; // XFDF, FDF, XML, CSV or text, detected
- XFDF (ISO 19444-1): every comment type PdfCraft knows (text, free text, line, square,
circle, polygon, polyline, markup, stamp, caret, ink, attachments, sound, redact) with rect,
name, author, subject, dates, flags, colours, opacity, width, icon, quads, line ends, ink,
default appearance, callouts (
callout,fringe,intent,head), pop-ups and reply threads (inreplyto); field values nested by name. - FDF: fields (with
/Kidshierarchies) and comments as direct objects. - Form data: Acrobat's XML (
xfdf:originalkeeps names that aren't XML names), CSV and tab-delimited text (a row of names, a row of values).
Import replaces comments with the same /NM (and drops the replaced comment's pop-up), draws
appearances PdfCraft can draw, and sets values through the form's own checks (formats,
validation, recalculation); read-only fields take imported values, as in Acrobat. XML is read
with roxmltree.