7920f99f7a
* Redact: operators split across a page's content streams are redacted whole A page's /Contents array is one content stream in pieces, and a writer may split it between any two tokens (ISO 32000-2 §7.8.2). Some office and layout exporters do: a TJ array ends one piece and its TJ operator starts the next, or a marked-content dictionary closes in the next piece. Redaction parsed each piece on its own, so such an operator was cut off from its operands. Glyphs shown by a split TJ were never checked against the marks: Apply drew the black box but left the text in the file, and Verify reported nothing under the box. When the piece holding the operands was rewritten for another mark, they were dropped, so the text after it vanished and the next piece began with an operator without operands, which other readers reject. process() now parses the pieces joined, gives each operator back to the piece its keyword is in, and rewrites every piece a split operator spans. Pages whose pieces split only between operators are unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Use the pdfcraft crate names after the rename Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: EthanSuquet <292885762+EthanSuquet@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Brandon Thomas <echelon@gmail.com>
pdfcraft-redact
Layer L4 (may use edit): redaction, architecture §11.2.
// Marks are Redact annotations (pdfcraft-annot: Shape::Redact { quads, overlay }).
let marks: Vec<Mark> = marks(&doc); // page, areas (user space), fill, overlay text
let report = apply(&mut doc, None)?; // everything, or Some(&[pages])
clear_marks(&mut doc, None)?; // remove marks without applying
apply removes, under every marked area:
- text: glyphs are cut out of
Tj/TJ/'/"and replaced by aTJdisplacement of the same advance, so the rest of the line keeps its exact position. Widths come from/Widths,/W//DW(composite fonts, embedded CMaps with codespace and CID ranges), Type 3 font matrices, and approximations for the standard 14. A glyph goes when it overlaps an area by more than a fifth of its size (or a point) both ways; zero-size text goes when its origin is inside; - images: fully covered → removed; partly covered → a copy with the covered pixels cleared (8/16-bit and 1/2/4-bit images, image masks; Flate/LZW/RL/A85/AHx). Codecs PdfCraft can't re-encode (DCT, JPX, JBIG2, CCITT) are removed whole (fail-closed); inline images under an area are removed;
- vectors: covered paths are removed; partly covered paths and shadings are clipped so nothing paints inside the areas;
- form XObjects: rewritten recursively into new objects (pages sharing the original keep it);
- annotations whose rectangle overlaps (with their pop-ups), and form fields with a widget under a mark;
- the marks themselves, replaced by boxes in their fill colour (and overlay text) drawn into the
page as a
/PCMark /Redactionstream.
A verification pass re-reads each redacted page and fails the operation if any glyph or inline image is still under an area. Content that can't be decoded makes the operation fail rather than leave it unredacted.
Remove hidden information / Sanitize
let found = sanitize::scan(&doc); // [(Hidden, count)] per category
sanitize::remove_hidden(&mut doc, &[Hidden::Comments])?; // chosen categories
sanitize::sanitize(&mut doc)?; // all of them
Categories: metadata (/Info, XMP), file attachments, comments, form fields (flattened so the
values stay visible), hidden text (render modes 3 and 7, or wholly off the page), hidden layers
(content of off optional-content groups, then the groups), bookmarks, links/actions/JavaScript,
and /PieceInfo private data. Both make the next save a full rewrite.
patterns finds phone numbers, e-mail addresses, credit card numbers (Luhn-checked), US Social
Security numbers and dates for Search & Redact.
Not yet: pattern locales, struct-tree/alt-text cleanup, metadata and hidden-information sanitising (M8.4), re-encoding of DCT images (they are removed instead).