hexapdf 1.9.1 → 1.10.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e272dafd41bb732e5110aadc794399a3e5d9823571de2ee67f119f05422af9ac
-  data.tar.gz: 1269ed888e0b5c3fac4b4a25afbcdab75835252aadaf46fe6a92cfbde379f330
+  metadata.gz: 0c85f671cd9d2e469b7f0e8c1ea2f9beec6a09247881c2404b8c9789ba65cd03
+  data.tar.gz: e6d53dd3da7a366f5b724448d31bc7edacae9acb65f6f4fe95e6e3c5caf27564
 SHA512:
-  metadata.gz: 69f36a31e49cb7b434bc53e63c2fde4c271a506046224a0dbb76b473176f435d618d0e9de90a64f3b95c4fa64cec8a8addbcb4c5c997ac9790fd79bd46093306
-  data.tar.gz: 786835f800b29263364d97c872465b7fcaf431bf846a793a3fe502810090bc6ce1b94089a18f2787ed5cc3e9b982cf0a2d33db68b7812861f938e4f209af17d4
+  metadata.gz: 2572d491909fa5f4574705de076a2889d7a0869f6cb3358787394b02ed00ec7e0763617515f9f2ecb50718f6b584189f88e0dad0ab612f0472b8551402331628
+  data.tar.gz: cfe5c5efeaa319b781c566a3d1b0034bf1876ddc8100fecdb96257f68064779476f579e266e796b5a5740177b899319c1fde9e4f21b355d14054e5f157cb3e30

data/CHANGELOG.md

@@ -1,3 +1,28 @@
+## 1.10.0 - 2026-08-21
+
+### Added
+
+* Support for PDF 2.0 UTF-8 strings to
+  [HexaPDF::DictionaryFields::StringConverter]
+* [HexaPDF::Type::Catalog#dss] for returning the document security store
+* [HexaPDF::DigitalSignature::PKCS1Handler#embedded_tsa_signature]
+* [HexaPDF::Type::DocumentSecurityStore] convenience methods for adding entries
+
+### Fixed
+
+* Removed invalid dictionary fields from [HexaPDF::Type::DocumentSecurityStore]
+* [HexaPDF::DigitalSignature::CMSHandler] to handle padding of /Contents
+  correctly
+* Regression in [HexaPDF::Layout::TextFragment::create_with_fallback_glyphs]
+  with respect to handling `\r\n` as a single newline
+* Double decryption when reconstructing invalid files
+* Parsing encrypted indirect objects that should be streams but aren't
+* Serializing of large floats that used scientific instead of fixed-point
+  notation
+* [HexaPDF::Content::SmartTextExtractor::layout_text_runs] to work in case of
+  degenerate input where the majority of text runs have zero height
+
+
 ## 1.9.1 - 2026-06-09
 
 ### Fixed

data/lib/hexapdf/configuration.rb

@@ -254,8 +254,8 @@ module HexaPDF
   #    In nearly all cases this option should not be changed from its default setting!
   #
   # document.on_invalid_string::
-  #    A callable object that takes the invalid UTF-16BE encoded string and returns a valid UTF-8
-  #    encoded string.
+  #    A callable object that takes the invalid UTF-16BE or UTF-8 encoded string and returns a valid
+  #    UTF-8 encoded string.
   #
   #    The default is to remove all invalid characters.
   #

data/lib/hexapdf/content/smart_text_extractor.rb

@@ -172,8 +172,9 @@ module HexaPDF
         return '' if text_runs.empty?
 
         # Use the median height of all text runs as an approximation of the main font size used on
-        # the page. The line tolerance uses a hard floor for small fonts.
-        median_height = median(text_runs.map(&:height).sort)
+        # the page. In case the majority of text runs have a height of 0, use a non-zero height
+        # value. The line tolerance uses a hard floor for small fonts.
+        median_height = [median(text_runs.map(&:height).sort), 1].max
         line_tolerance = [median_height * line_tolerance_factor, 2].max
 
         # Group the text runs into lines which are sorted top to bottom. Text runs are pre-sorted by

data/lib/hexapdf/dictionary_fields.rb

@@ -262,6 +262,13 @@ module HexaPDF
           else
             document.config['document.on_invalid_string'].call(str)
           end
+        elsif str.getbyte(0) == 239 && str.getbyte(1) == 187 && str.getbyte(2) == 191
+          str = str[3..-1].force_encoding(Encoding::UTF_8)
+          if str.valid_encoding?
+            str
+          else
+            document.config['document.on_invalid_string'].call(str)
+          end
         else
           Utils::PDFDocEncoding.convert_to_utf8(str)
         end

data/lib/hexapdf/digital_signature/cms_handler.rb

@@ -92,7 +92,7 @@ module HexaPDF
         return @embedded_tsa_signature if defined?(@embedded_tsa_signature)
 
         @embedded_tsa_signature = nil
-        p7 = OpenSSL::ASN1.decode(signature_dict.contents.sub(/\x00*\z/, ''))
+        p7 = decode_asn1(signature_dict.contents)
         signed_data = p7.value[1].value[0]
         signer_info = signed_data.value[-1].value[0] # first (and only) signer info
         return unless signer_info.value[-1].tag == 1 # check for unsigned attributes
@@ -140,7 +140,7 @@ module HexaPDF
 
         if signature_dict.signature_type == 'ETSI.RFC3161'
           # Getting the needed values is not directly supported by Ruby OpenSSL
-          p7 = OpenSSL::ASN1.decode(signature_dict.contents.sub(/\x00*\z/, ''))
+          p7 = decode_asn1(signature_dict.contents)
           signed_data = p7.value[1].value[0]
           content_info = signed_data.value[2]
           content = OpenSSL::ASN1.decode(content_info.value[1].value[0].value)
@@ -175,6 +175,31 @@ module HexaPDF
         result
       end
 
+      private
+
+      # Decode the first data structure in the given +data+ binary string.
+      #
+      # Since ASN1.decode raises an error if there are trailing bytes in +data+, we need to try
+      # several things to get the first data structure out of +data+ that is possibly zero-padded
+      # (due to definite and indefinite encodings; \x00\x00 is the EOD marker for indefinite
+      # encodings complicating things).
+      def decode_asn1(data)
+        length = OpenSSL::ASN1.traverse(data) do |_depth, _offset, header_length, length, *|
+          break length > 0 ? header_length + length : 0
+        end
+        if length > 0
+          OpenSSL::ASN1.decode(data[0, length])
+        else
+          begin
+            OpenSSL::ASN1.decode(data)
+          rescue OpenSSL::ASN1::ASN1Error => e
+            length = e.message.scan(/Total bytes read: (\d+)/)&.first&.first.to_i
+            data = data[0, length]
+            retry
+          end
+        end
+      end
+
     end
 
   end

data/lib/hexapdf/digital_signature/pkcs1_handler.rb

@@ -59,6 +59,11 @@ module HexaPDF
         certificate_chain.first
       end
 
+      # Returns +nil+.
+      def embedded_tsa_signature
+        nil
+      end
+
       # Verifies the signature using the provided OpenSSL::X509::Store object.
       def verify(store, allow_self_signed: false)
         result = super

data/lib/hexapdf/encryption/security_handler.rb

@@ -276,7 +276,9 @@ module HexaPDF
           str.replace(string_algorithm.decrypt(key, str, &error_proc))
         end
 
-        if obj.kind_of?(HexaPDF::Stream) && obj.raw_stream.filter[0] != :Crypt
+        # The (obj.raw_stream == '') case may occur for PDFs where a typed object that should be a
+        # stream isn't one. For example, if a /Type /Form object doesn't have stream ... endstream.
+        if obj.kind_of?(HexaPDF::Stream) && obj.raw_stream != '' && obj.raw_stream.filter[0] != :Crypt
           unless string_algorithm == stream_algorithm
             key = object_key(obj.oid, obj.gen, stream_algorithm)
           end

data/lib/hexapdf/layout/text_fragment.rb

@@ -119,7 +119,11 @@ module HexaPDF
               items = []
             end
             if glyph.control_char?
-              result.append(new([glyph], style))
+              if result.last&.style == style
+                result.last.items << glyph
+              else
+                result.append(new([glyph], style))
+              end
             else
               fallback = yield(codepoint, glyph)
               unless fallback.empty?

data/lib/hexapdf/parser.rb

@@ -531,8 +531,7 @@ module HexaPDF
 
       loader = lambda do |xref_entry|
         obj, oid, gen, stream = parse_indirect_object(xref_entry.pos)
-        obj = @document.wrap(obj, oid: oid, gen: gen, stream: stream)
-        @document.security_handler ? @document.security_handler.decrypt(obj) : obj
+        @document.wrap(obj, oid: oid, gen: gen, stream: stream)
       end
 
       @in_reconstruct_revision = false

data/lib/hexapdf/serializer.rb

@@ -206,7 +206,7 @@ module HexaPDF
       if -0.0001 < obj && obj < 0.0001 && obj != 0
         sprintf("%.6f", obj)
       elsif obj.finite?
-        obj.round(6).to_s
+        obj.clamp(-999999999999999, 999999999999999).round(6).to_s
       else
         raise HexaPDF::Error, "Can't serialize special floating point number #{obj}"
       end

data/lib/hexapdf/type/catalog.rb

@@ -84,7 +84,7 @@ module HexaPDF
       define_field :Requirements,      type: PDFArray,   version: '1.7'
       define_field :Collection,        type: Dictionary, version: '1.7'
       define_field :NeedsRendering,    type: Boolean,    version: '1.7'
-      define_field :DSS,               type: Dictionary, version: '2.0'
+      define_field :DSS,               type: :DSS,       version: '2.0'
       define_field :AF,                type: PDFArray,   version: '2.0'
       define_field :DPartRoot,         type: Dictionary, version: '2.0'
 
@@ -124,6 +124,13 @@ module HexaPDF
         self[:OCProperties] ||= document.add({OCGs: [], D: {Creator: 'HexaPDF'}}, type: :XXOCProperties)
       end
 
+      # Returns the document security store, creating it if needed.
+      #
+      # See: DocumentSecurityStore
+      def dss
+        self[:DSS] ||= document.add({}, type: :DSS)
+      end
+
       # Returns the main AcroForm object.
       #
       # * If an AcroForm object exists, the +create+ argument is not used.

data/lib/hexapdf/type/document_security_store.rb

@@ -34,6 +34,7 @@
 # commercial licenses are available at <https://gettalong.at/hexapdf/>.
 #++
 
+require 'openssl'
 require 'hexapdf/dictionary'
 
 module HexaPDF
@@ -54,25 +55,78 @@ module HexaPDF
         define_type :VRI
 
         define_field :Type, type: Symbol, default: type
-        define_field :Cert, type: PDFArray
-        define_field :CRL,  type: PDFArray
-        define_field :OCSP, type: PDFArray
-        define_field :TU,   type: PDFDate
-        define_field :TS,   type: Stream
+        define_field :Cert, type: PDFArray, version: '2.0'
+        define_field :CRL,  type: PDFArray, version: '2.0'
+        define_field :OCSP, type: PDFArray, version: '2.0'
+        define_field :TU,   type: PDFDate, version: '2.0'
+        define_field :TS,   type: Stream, version: '2.0'
 
       end
 
       define_type :DSS
 
       define_field :Type,  type: Symbol, default: type
-      define_field :VRI,   type: Dictionary
-      define_field :Certs, type: PDFArray
-      define_field :OCSPs, type: PDFArray
-      define_field :CRLs,  type: PDFArray
-      define_field :SW, type: Symbol,   default: :A, allowed_values: [:A, :B, :S, :N]
-      define_field :S,  type: Symbol,   default: :P, allowed_values: [:A, :P]
-      define_field :A,  type: PDFArray, default: [0.5, 0.5]
-      define_field :FB, type: Boolean,  default: false, version: '1.5'
+      define_field :VRI,   type: Dictionary, version: '2.0'
+      define_field :Certs, type: PDFArray, version: '2.0'
+      define_field :OCSPs, type: PDFArray, version: '2.0'
+      define_field :CRLs,  type: PDFArray, version: '2.0'
+
+      # Adds validation data for a single signature to the /VRI dictionary and to the various
+      # arrays, and returns the new VRI entry.
+      #
+      # +signature+::
+      #     The signature for which the validation data should be added.
+      #
+      # +certs+::
+      #     Array of DER-encoded certificates.
+      #
+      # +ocsps+::
+      #     Array of DER-encoded OCSP responses.
+      #
+      # +crls+::
+      #     Array of DER-encoded CRLs.
+      def add_vri(signature, certs: [], ocsps: [], crls: [])
+        key = OpenSSL::Digest::SHA1.hexdigest(signature.contents).upcase.to_sym
+        vri = {Type: :VRI}
+        vri[:Cert] = certs.map {|der| add_cert(der) } unless certs.empty?
+        vri[:OCSP] = ocsps.map {|der| add_ocsp(der) } unless ocsps.empty?
+        vri[:CRL]  = crls.map  {|der| add_crl(der)  } unless crls.empty?
+        (self[:VRI] ||= {})[key] = document.add(vri)
+      end
+
+      # Adds the DER-encoded certificate to the /Certs array if not already present and returns
+      # the stream object containing it.
+      def add_cert(cert_der)
+        add_data_as_stream_to_field(cert_der, :Certs)
+      end
+
+      # Adds the DER-encoded OCSP response to the /OCSPs array if not already present and returns
+      # the stream object containing it.
+      def add_ocsp(ocsp_der)
+        add_data_as_stream_to_field(ocsp_der, :OCSPs)
+      end
+
+      # Adds the DER-encoded CRL to the /CRLs array if not already present and returns the stream
+      # object containing it.
+      def add_crl(crl_der)
+        add_data_as_stream_to_field(crl_der, :CRLs)
+      end
+
+      private
+
+      # Adds the given string +data+ to the +field+ array as stream object and returns the resulting
+      # stream.
+      #
+      # If the field already contains a stream with the same data, this existing stream is returned.
+      def add_data_as_stream_to_field(data, field)
+        self[field] ||= []
+        existing_stream = self[field].find {|stream| stream.stream == data }
+        return existing_stream if existing_stream
+
+        stream = document.add({Filter: :FlateDecode}, stream: data)
+        self[field] << stream
+        stream
+      end
 
     end
 

data/lib/hexapdf/type/font_type0.rb

@@ -146,7 +146,7 @@ module HexaPDF
           registry = system_info[:Registry]
           ordering = system_info[:Ordering]
           if (encoding.kind_of?(Symbol) && HexaPDF::Font::CMap.predefined?(encoding.to_s) &&
-            encoding != :'Identity-H' && encoding != :'Identity-V') ||
+              encoding != :'Identity-H' && encoding != :'Identity-V') ||
               (registry == "Adobe" && ['GB1', 'CNS1', 'Japan1', 'Korea1'].include?(ordering))
             HexaPDF::Font::CMap.for_name("#{registry}-#{ordering}-UCS2")
           end

data/lib/hexapdf/version.rb

@@ -37,6 +37,6 @@
 module HexaPDF
 
   # The version of HexaPDF.
-  VERSION = '1.9.1'
+  VERSION = '1.10.0'
 
 end

data/test/hexapdf/content/test_smart_text_extractor.rb

@@ -101,6 +101,13 @@ describe HexaPDF::Content::SmartTextExtractor do
                               ['Foot', 50, 10, 66, 20]]))
   end
 
+
+  it "works in case the majority of text runs have zero height" do
+    assert_equal(["Hello", "World News"].join("\n"*17), layout_runs([['World', 50, 80, 70, 80],
+                                                                     ['News', 75, 80, 100, 80],
+                                                                     ['Hello', 50, 100, 70, 100]]))
+  end
+
   it "ignores outliers when calculating the normal line spacing" do
     assert_equal("Hello\nWorld\n\n\n\nHere",
                  layout_runs([['Hello', 50, 100, 70, 110],

data/test/hexapdf/digital_signature/test_cms_handler.rb

@@ -125,7 +125,9 @@ describe HexaPDF::DigitalSignature::CMSHandler do
       fac.serial_number = 1
       fac.allowed_digests = ["sha256", "sha512"]
       res = fac.create_timestamp(CERTIFICATES.signer_key, CERTIFICATES.timestamp_certificate, req)
-      @dict.contents = res.token.to_der
+      der_form = res.token.to_der
+      # Convert DER to BER with indefinite length encoding as variation
+      @dict.contents = der_form[0] << "\x80".b << der_form[4..-1] << "\x00\x00".b << "\x00\x00\x00\x00".b
       @dict.signature_type = 'ETSI.RFC3161'
       @handler = HexaPDF::DigitalSignature::CMSHandler.new(@dict)
 
@@ -151,7 +153,7 @@ describe HexaPDF::DigitalSignature::CMSHandler do
         key: CERTIFICATES.signer_key, timestamp_handler: tsh,
         certificates: [CERTIFICATES.ca_certificate]
       )
-      @dict.contents = cms.to_der
+      @dict.contents = cms.to_der << "\x00\x00\x00\x00"
       @dict.signed_data = @data
       @handler = HexaPDF::DigitalSignature::CMSHandler.new(@dict)
     end

data/test/hexapdf/digital_signature/test_pkcs1_handler.rb

@@ -28,6 +28,10 @@ describe HexaPDF::DigitalSignature::PKCS1Handler do
     assert_equal(CERTIFICATES.signer_certificate, @handler.signer_certificate)
   end
 
+  it "returns nil for the embedded timestamp signature" do
+    assert_nil(@handler.embedded_tsa_signature)
+  end
+
   describe "verify" do
     before do
       @store = OpenSSL::X509::Store.new

data/test/hexapdf/encryption/test_security_handler.rb

@@ -302,6 +302,18 @@ describe HexaPDF::Encryption::SecurityHandler do
       assert_equal('string', obj.stream)
     end
 
+    it "handles decryption of should-be stream objects without actual streams" do
+      doc = HexaPDF::Document.new
+      obj = doc.add({}) # Create XObject as Dictionary and not as Stream
+      obj[:Type] = :XObject
+      obj[:Subtype] = :Form
+      doc.catalog[:Test] = obj
+      doc.encrypt
+      doc = HexaPDF::Document.new(io: StringIO.new(doc.write_to_string))
+      assert_kind_of(HexaPDF::Stream, doc.catalog[:Test])
+      assert_equal('', doc.catalog[:Test].raw_stream)
+    end
+
     it "doesn't decrypt a document's Encrypt dictionaries" do
       @document = HexaPDF::Document.new
       @document.trailer[:Encrypt] = @document.add({Key: "Something"})

data/test/hexapdf/layout/test_text_fragment.rb

@@ -43,10 +43,18 @@ describe HexaPDF::Layout::TextFragment do
 
     it "allows using a style object instead of directly specifying style properties" do
       style = HexaPDF::Layout::Style.new(font: @font, font_size: 20)
-      frags = HexaPDF::Layout::TextFragment.create_with_fallback_glyphs("Tom", style)
+      frags = HexaPDF::Layout::TextFragment.create_with_fallback_glyphs("Tom", style) {}
       assert_equal(37.78, frags[0].width)
     end
 
+    it "handles control characters separately by not running them through the text shaper" do
+      frags = HexaPDF::Layout::TextFragment.create_with_fallback_glyphs("\tA\nB\rC\r\nD", font: @font) {}
+      assert_equal(5, frags.size)
+      assert_equal("\t", frags[0].text)
+      assert_equal("A\n", frags[1].text)
+      assert_equal("C\r\n", frags[3].text)
+    end
+
     it "replaces invalid glyphs with the result of the block" do
       zapf_dingbats = @doc.fonts.add('ZapfDingbats')
       i = 0
@@ -62,7 +70,7 @@ describe HexaPDF::Layout::TextFragment do
 
       frags = HexaPDF::Layout::TextFragment.create_with_fallback_glyphs("✂Tom✂Tom✂Tom✂Tom\u{ad}",
                                                                         style, &fallback)
-      assert_equal(8, frags.size)
+      assert_equal(7, frags.size)
       assert_equal(zapf_dingbats, frags[0].style.font)
       assert_equal(:a2, frags[0].items[0].name)
       assert_equal("Tom", frags[1].text)
@@ -71,8 +79,7 @@ describe HexaPDF::Layout::TextFragment do
       assert_equal("Tom", frags[3].text)
       assert_equal(:'.notdef', frags[4].items[0].name)
       assert_equal("Tom", frags[5].text)
-      assert_equal("Tom", frags[6].text)
-      assert_equal("\u{ad}", frags[7].text)
+      assert_equal("Tom\u{ad}", frags[6].text)
     end
   end
 

data/test/hexapdf/test_dictionary_fields.rb

@@ -129,6 +129,11 @@ describe HexaPDF::DictionaryFields do
       str = @field.convert("\xfe\xff\x00t\x00e\x00s\x00t".b, self)
       assert_equal('test', str)
       assert_equal(Encoding::UTF_8, str.encoding)
+
+      str = @field.convert("\xef\xbb\xbfHall\xC3\xB6".b, self)
+      assert_equal('Hallö', str)
+      assert_equal(Encoding::UTF_8, str.encoding)
+
       str = @field.convert("Testing\x9c\x92".b, self)
       assert_equal("Testing\u0153\u2122", str)
       assert_equal(Encoding::UTF_8, str.encoding)
@@ -141,6 +146,9 @@ describe HexaPDF::DictionaryFields do
     it "calls document.on_invalid_string if the provided string is invalid" do
       str = "\xfe\xff\xD8\x00\x00s\x00t".b
       assert_equal("st", @field.convert(str, self))
+
+      str = "\xef\xbb\xbfHall\xFF\xC3".b
+      assert_equal("Hall", @field.convert(str, self))
     end
   end
 

data/test/hexapdf/test_parser.rb

@@ -702,15 +702,6 @@ describe HexaPDF::Parser do
       assert_equal(6, @parser.load_object(@xref).value)
     end
 
-    it "uses a security handler for decrypting indirect objects if necessary" do
-      handler = Minitest::Mock.new
-      handler.expect(:decrypt, HexaPDF::Object.new(:result, oid: 1), [HexaPDF::Object])
-      @document.instance_variable_set(:@security_handler, handler)
-      create_parser("1 0 obj\n6\nendobj\ntrailer\n<</Size 1>>")
-      assert_equal(:result, @parser.load_object(@xref).value)
-      assert(handler.verify)
-    end
-
     it "ignores parts where the starting line is split across lines" do
       create_parser("1 0 obj\n5\nendobj\n1 0\nobj\n6\nendobj\ntrailer\n<</Size 1>>")
       assert_equal(5, @parser.load_object(@xref).value)
@@ -774,6 +765,31 @@ describe HexaPDF::Parser do
       assert_equal({Root: HexaPDF::Reference.new(1, 0)}, @parser.reconstructed_revision.trailer.value)
     end
 
+    it "decrypts strings and streams correctly in case of whole/part document recovery" do
+      io = StringIO.new
+      doc = HexaPDF::Document.new
+      doc.catalog[:XXTest] = doc.add({Data: "string"}, stream: "stream")
+      doc.encrypt
+      xref_section = doc.write(io)[1]
+      test_oid = doc.catalog[:XXTest].oid
+
+      # whole document corruption
+      invalid_doc = io.string.sub(/xref\n0 #{xref_section.max_oid + 1}/, "xref\n0 1")
+      doc = HexaPDF::Document.new(io: StringIO.new(invalid_doc))
+      assert(doc.revisions.parser.reconstructed?)
+      assert_equal('string', doc.catalog[:XXTest][:Data])
+      assert_equal('stream', doc.catalog[:XXTest].stream)
+
+      # part document corruption
+      invalid_doc = io.string.sub(xref_section[test_oid].pos.to_s.rjust(10, '0'),
+                                  (xref_section[test_oid].pos + 5).to_s.rjust(10, '0'))
+      doc = HexaPDF::Document.new(io: StringIO.new(invalid_doc))
+      refute(doc.revisions.parser.reconstructed?)
+      assert_equal('string', doc.catalog[:XXTest][:Data])
+      assert_equal('stream', doc.catalog[:XXTest].stream)
+      assert(doc.revisions.parser.reconstructed?)
+    end
+
     it "fails if no valid trailer is found and couldn't be constructed" do
       create_parser("1 0 obj\n5\nendobj\nquack trailer <</Size 1>>\nstartxref\n22\n%%EOF")
       assert_raises(HexaPDF::MalformedPDFError) { @parser.reconstructed_revision.trailer }

data/test/hexapdf/test_serializer.rb

@@ -58,7 +58,7 @@ describe HexaPDF::Serializer do
     assert_serialized("1208925819614629174706176", 1_208_925_819_614_629_174_706_176)
   end
 
-  it "serializes floats with a precision of 4" do
+  it "serializes floats with a precision of 6" do
     assert_serialized("1.5", 1.5)
     assert_serialized("-1.5", -1.5)
     assert_serialized("9.123456", 9.123456)
@@ -66,6 +66,12 @@ describe HexaPDF::Serializer do
     assert_serialized("0.000005", 0.000005)
     assert_serialized("-0.000005", -0.000005)
     assert_serialized("0.0", 0.0)
+    assert_serialized("123456789012345.0", 1.23456789012345e14)
+    assert_serialized("123456789012345.34", 1.2345678901234534e14)
+    assert_serialized("-123456789012345.0", -1.23456789012345e14)
+    assert_serialized("-123456789012345.34", -1.2345678901234534e14)
+    assert_serialized("999999999999999", 1.23456789012345e15)
+    assert_serialized("-999999999999999", -1.23456789012345e15)
     assert_raises(HexaPDF::Error) { @serializer.serialize(0.0 / 0) }
     assert_raises(HexaPDF::Error) { @serializer.serialize(1.0 / 0) }
     assert_raises(HexaPDF::Error) { @serializer.serialize(-1.0 / 0) }

data/test/hexapdf/type/test_catalog.rb

@@ -50,6 +50,16 @@ describe HexaPDF::Type::Catalog do
     assert_equal(:XXOCConfiguration, oc[:D].type)
   end
 
+  it "uses or creates the document security store on access" do
+    @catalog[:DSS] = {}
+    assert_equal(:DSS, @catalog.dss.type)
+
+    @catalog.delete(:DSS)
+    dss = @catalog.dss
+    assert_equal(:DSS, dss.type)
+    assert_same(dss, @catalog.dss)
+  end
+
   describe "acro_form" do
     it "returns an existing form object" do
       @catalog[:AcroForm] = :test

data/test/hexapdf/type/test_document_security_store.rb

@@ -0,0 +1,90 @@
+# -*- encoding: utf-8 -*-
+
+require 'test_helper'
+require 'hexapdf/document'
+require 'hexapdf/type/document_security_store'
+
+describe HexaPDF::Type::DocumentSecurityStore do
+  before do
+    @doc = HexaPDF::Document.new
+    @dss = @doc.add({Type: :DSS})
+  end
+
+  [[:add_cert, :Certs], [:add_ocsp, :OCSPs], [:add_crl, :CRLs]].each do |method, field|
+    describe method do
+      it "adds a #{field[0..-2]} as an indirect stream object" do
+        result = @dss.send(method, "der_data")
+        assert_kind_of(HexaPDF::Stream, result)
+        assert_equal(:FlateDecode, result[:Filter])
+        assert_equal("der_data", result.stream)
+        assert_equal(1, @dss[field].size)
+      end
+
+      it "returns the same stream object for duplicate #{field[0..-2]} data" do
+        result1 = @dss.send(method, "der_data")
+        result2 = @dss.send(method, "der_data")
+        assert_same(result1, result2)
+        assert_equal(1, @dss[field].size)
+      end
+
+      it "adds distinct stream objects for different #{field[0..-2]} data" do
+        @dss.send(method, "data_one")
+        @dss.send(method, "data_two")
+        assert_equal(2, @dss[field].size)
+      end
+    end
+  end
+
+  describe "add_vri" do
+    before do
+      @signature_contents = 'signature bytes'
+      @signature = @doc.add({Type: :Sig, Contents: @signature_contents})
+      @vri_key = OpenSSL::Digest::SHA1.hexdigest(@signature_contents).upcase.to_sym
+    end
+
+    it "returns the VRI entry" do
+      vri = @dss.add_vri(@signature)
+      assert_equal(:VRI, vri.type)
+    end
+
+    it "creates the /VRI dictionary with an entry for the signature" do
+      vri = @dss.add_vri(@signature)
+      assert(@dss.key?(:VRI))
+      assert_same(vri, @dss[:VRI][@vri_key])
+    end
+
+    it "populates /Cert in the VRI entry and the DSS /Certs array" do
+      @dss.add_vri(@signature, certs: ["cert1", "cert2"])
+      assert_equal(2, @dss[:VRI][@vri_key][:Cert].size)
+      assert_equal(2, @dss[:Certs].size)
+    end
+
+    it "populates /OCSP in the VRI entry and the DSS /OCSPs array" do
+      @dss.add_vri(@signature, ocsps: ["ocsp1", "ocsp2"])
+      assert_equal(2, @dss[:VRI][@vri_key][:OCSP].size)
+      assert_equal(2, @dss[:OCSPs].size)
+    end
+
+    it "populates /CRL in the VRI entry and the DSS /CRLs array" do
+      @dss.add_vri(@signature, crls: ["crl1"])
+      assert_equal(1, @dss[:VRI][@vri_key][:CRL].size)
+      assert_equal(1, @dss[:CRLs].size)
+    end
+
+    it "de-duplicates DER streams shared across multiple VRI entries" do
+      @dss.add_vri(@signature, certs: ["shared_cert", "cert_a"])
+      @dss.add_vri(@doc.add({Type: :Sig, Contents: 'new'}), certs: ["shared_cert", "cert_b"])
+      # shared_cert added once despite appearing in both VRI entries
+      assert_equal(2, @dss[:VRI].value.size)
+      assert_equal(3, @dss[:Certs].size)
+    end
+
+    it "creates a VRI entry with no optional arrays when all inputs are empty" do
+      @dss.add_vri(@signature)
+      vri = @dss[:VRI][@vri_key]
+      refute(vri.key?(:Cert))
+      refute(vri.key?(:OCSP))
+      refute(vri.key?(:CRL))
+    end
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: hexapdf
 version: !ruby/object:Gem::Version
-  version: 1.9.1
+  version: 1.10.0
 platform: ruby
 authors:
 - Thomas Leitner
@@ -874,6 +874,7 @@ files:
 - test/hexapdf/type/test_annotation.rb
 - test/hexapdf/type/test_catalog.rb
 - test/hexapdf/type/test_cid_font.rb
+- test/hexapdf/type/test_document_security_store.rb
 - test/hexapdf/type/test_file_specification.rb
 - test/hexapdf/type/test_font.rb
 - test/hexapdf/type/test_font_descriptor.rb