origami 2.0.0 → 2.0.1

data/lib/origami/reference.rb

@@ -42,7 +42,7 @@ module Origami
             @refno, @refgen = refno, refgen
         end
 
-        def self.parse(stream, parser = nil) #:nodoc:
+        def self.parse(stream, _parser = nil) #:nodoc:
             offset = stream.pos
 
             if stream.scan(@@regexp).nil?
@@ -68,7 +68,7 @@ module Origami
             target = doc.get_object(self)
 
             if target.nil? and not Origami::OPTIONS[:ignore_bad_references]
-                raise InvalidReferenceError, "Cannot resolve reference : #{self.to_s}"
+                raise InvalidReferenceError, "Cannot resolve reference : #{self}"
             end
 
             target or Null.new
@@ -104,13 +104,11 @@ module Origami
         end
 
         #
-        # Returns self.
+        # Returns the referenced object value.
         #
         def value
-            self
+            self.solve.value
         end
-
-        def self.native_type ; Reference end
     end
 
 end

data/lib/origami/signature.rb

@@ -18,12 +18,7 @@
 
 =end
 
-begin
-    require 'openssl' if Origami::OPTIONS[:use_openssl]
-rescue LoadError
-    Origami::OPTIONS[:use_openssl] = false
-end
-
+require 'openssl'
 require 'digest/sha1'
 
 module Origami
@@ -38,48 +33,29 @@ module Origami
         #   If no argument is passed, embedded certificates are treated as trusted.
         #
         def verify(trusted_certs: [])
-            unless Origami::OPTIONS[:use_openssl]
-                fail "OpenSSL is not present or has been disabled."
-            end
-
             digsig = self.signature
+            digsig = digsig.cast_to(Signature::DigitalSignature) unless digsig.is_a?(Signature::DigitalSignature)
 
             unless digsig[:Contents].is_a?(String)
                 raise SignatureError, "Invalid digital signature contents"
             end
 
             store = OpenSSL::X509::Store.new
-            trusted_certs.each do |ca| store.add_cert(ca) end
+            trusted_certs.each { |ca| store.add_cert(ca) }
             flags = 0
             flags |= OpenSSL::PKCS7::NOVERIFY if trusted_certs.empty?
 
-            stream = StringScanner.new(self.original_data)
-            stream.pos = digsig[:Contents].file_offset
-            Object.typeof(stream).parse(stream)
-            endofsig_offset = stream.pos
-            stream.terminate
-
-            s1,l1,s2,l2 = digsig.ByteRange
-            if s1.value != 0 or
-                (s2.value + l2.value) != self.original_data.size or
-                (s1.value + l1.value) != digsig[:Contents].file_offset or
-                s2.value != endofsig_offset
-
-                raise SignatureError, "Invalid signature byte range"
-            end
+            data = extract_signed_data(digsig)
+            signature = digsig[:Contents]
+            subfilter = digsig.SubFilter.value
 
-            data = self.original_data[s1,l1] + self.original_data[s2,l2]
+            case subfilter
+            when Signature::DigitalSignature::PKCS7_DETACHED
+                Signature.verify_pkcs7_detached_signature(data, signature, store, flags)
 
-            case digsig.SubFilter.value.to_s
-            when 'adbe.pkcs7.detached'
-                flags |= OpenSSL::PKCS7::DETACHED
-                p7 = OpenSSL::PKCS7.new(digsig[:Contents].value)
-                raise SignatureError, "Not a PKCS7 detached signature" unless p7.detached?
-                p7.verify([], store, data, flags)
 
-            when 'adbe.pkcs7.sha1'
-                p7 = OpenSSL::PKCS7.new(digsig[:Contents].value)
-                p7.verify([], store, nil, flags) and p7.data == Digest::SHA1.digest(data)
+            when Signature::DigitalSignature::PKCS7_SHA1
+                Signature.verify_pkcs7_sha1_signature(data, signature, store, flags)
 
             else
                 raise NotImplementedError, "Unsupported method #{digsig.SubFilter}"
@@ -107,10 +83,6 @@ module Origami
                  contact: nil,
                  reason: nil)
 
-            unless Origami::OPTIONS[:use_openssl]
-                fail "OpenSSL is not present or has been disabled."
-            end
-
             unless certificate.is_a?(OpenSSL::X509::Certificate)
                 raise TypeError, "A OpenSSL::X509::Certificate object must be passed."
             end
@@ -140,7 +112,7 @@ module Origami
                 end
 
             when 'adbe.pkcs7.sha1'
-              signfield_size = -> (crt, pkey, certs) do
+                signfield_size = -> (crt, pkey, certs) do
                     OpenSSL::PKCS7.sign(
                         crt,
                         pkey,
@@ -151,7 +123,7 @@ module Origami
                 end
 
             when 'adbe.x509.rsa_sha1'
-                signfield_size = -> (crt, pkey, certs) do
+                signfield_size = -> (_crt, pkey, _certs) do
                     pkey.private_encrypt(
                       Digest::SHA1.digest('')
                     ).size
@@ -172,7 +144,7 @@ module Origami
             annotation.V = digsig
             add_fields(annotation)
             self.Catalog.AcroForm.SigFlags =
-                InteractiveForm::SigFlags::SIGNATURESEXIST | InteractiveForm::SigFlags::APPENDONLY
+                InteractiveForm::SigFlags::SIGNATURES_EXIST | InteractiveForm::SigFlags::APPEND_ONLY
 
             digsig.Type = :Sig #:nodoc:
             digsig.Contents = HexaString.new("\x00" * signfield_size[certificate, key, ca]) #:nodoc:
@@ -263,8 +235,8 @@ module Origami
         def signed?
             begin
                 self.Catalog.AcroForm.is_a?(Dictionary) and
-                self.Catalog.AcroForm.has_key?(:SigFlags) and
-                (self.Catalog.AcroForm.SigFlags & InteractiveForm::SigFlags::SIGNATURESEXIST != 0)
+                self.Catalog.AcroForm.SigFlags.is_a?(Integer) and
+                (self.Catalog.AcroForm.SigFlags & InteractiveForm::SigFlags::SIGNATURES_EXIST != 0)
             rescue InvalidReferenceError
                 false
             end
@@ -275,9 +247,6 @@ module Origami
         # _rights_:: list of rights defined in UsageRights::Rights
         #
         def enable_usage_rights(cert, pkey, *rights)
-            unless Origami::OPTIONS[:use_openssl]
-                fail "OpenSSL is not present or has been disabled."
-            end
 
             signfield_size = -> (crt, key, ca) do
                 OpenSSL::PKCS7.sign(
@@ -301,7 +270,7 @@ module Origami
             digsig = Signature::DigitalSignature.new.set_indirect(true)
 
             self.Catalog.AcroForm ||= InteractiveForm.new
-            #self.Catalog.AcroForm.SigFlags = InteractiveForm::SigFlags::APPENDONLY
+            #self.Catalog.AcroForm.SigFlags = InteractiveForm::SigFlags::APPEND_ONLY
 
             digsig.Type = :Sig #:nodoc:
             digsig.Contents = HexaString.new("\x00" * signfield_size[certificate, key, []]) #:nodoc:
@@ -390,6 +359,34 @@ module Origami
 
             raise SignatureError, "Cannot find digital signature"
         end
+
+        private
+
+        #
+        # Verifies the ByteRange field of a digital signature and returned the signed data.
+        #
+        def extract_signed_data(digsig)
+            # Computes the boundaries of the Contents field.
+            start_sig = digsig[:Contents].file_offset
+
+            stream = StringScanner.new(self.original_data)
+            stream.pos = digsig[:Contents].file_offset
+            Object.typeof(stream).parse(stream)
+            end_sig = stream.pos
+            stream.terminate
+
+            r1, r2 = digsig.ranges
+            if r1.begin != 0 or
+                r2.end != self.original_data.size or
+                r1.end != start_sig or
+                r2.begin != end_sig
+
+                raise SignatureError, "Invalid signature byte range"
+            end
+
+            self.original_data[r1] + self.original_data[r2]
+        end
+
     end
 
     class Perms < Dictionary
@@ -402,6 +399,21 @@ module Origami
 
     module Signature
 
+        # Verifies a PKCS7 detached signature.
+        def self.verify_pkcs7_detached_signature(data, signature, store, flags)
+            pkcs7 = OpenSSL::PKCS7.new(signature)
+            raise SignatureError, "Not a PKCS7 detached signature" unless pkcs7.detached?
+
+            flags |= OpenSSL::PKCS7::DETACHED
+            pkcs7.verify([], store, data, flags)
+        end
+
+        # Verifies a PKCS7-SHA1 signature.
+        def self.verify_pkcs7_sha1_signature(data, signature, store, flags)
+            pkcs7 = OpenSSL::PKCS7.new(signature)
+            pkcs7.verify([], store, nil, flags) and pkcs7.data == Digest::SHA1.digest(data)
+        end
+
         #
         # Class representing a signature which can be embedded in DigitalSignature dictionary.
         # It must be a direct object.
@@ -494,6 +506,10 @@ module Origami
         class DigitalSignature < Dictionary
             include StandardObject
 
+            PKCS1_RSA_SHA1  = :"adbe.x509.rsa_sha1"
+            PKCS7_SHA1      = :"adbe.pkcs7.sha1"
+            PKCS7_DETACHED  = :"adbe.pkcs7.detached"
+
             field   :Type,            :Type => Name, :Default => :Sig
             field   :Filter,          :Type => Name, :Default => :"Adobe.PPKLite", :Required => true
             field   :SubFilter,       :Type => Name
@@ -537,6 +553,18 @@ module Origami
                 output(content)
             end
 
+            def ranges
+                byte_range = self.ByteRange
+
+                unless byte_range.is_a?(Array) and byte_range.length == 4 and byte_range.all? {|i| i.is_a?(Integer) }
+                    raise SignatureError, "Invalid ByteRange field value"
+                end
+
+                byte_range.map(&:to_i).each_slice(2).map do |start, length|
+                    (start...start + length)
+                end
+            end
+
             def signature_offset #:nodoc:
                 indent, tab = 1, "\t"
                 content = "#{no} #{generation} obj" + EOL + TOKENS.first + EOL

data/lib/origami/stream.rb

@@ -35,14 +35,16 @@ module Origami
     class Stream
         include Origami::Object
         include StandardObject
+        include FieldAccessor
         using TypeConversion
 
-        TOKENS = [ "stream" + WHITECHARS_NORET  + "\\r?\\n", "endstream" ] #:nodoc:
+        TOKENS = [ "stream" + WHITECHARS_NORET + "(\\r\\n|\\r|\\n)" , "endstream" ] #:nodoc:
 
         @@regexp_open = Regexp.new(WHITESPACES + TOKENS.first)
         @@regexp_close = Regexp.new(TOKENS.last)
 
-        @@cast_fingerprints = {}
+        @@type_signatures = {}
+        @@type_keys = []
 
         #
         # Actually only 5 first ones are implemented,
@@ -139,9 +141,9 @@ module Origami
 
             stm =
                 if Origami::OPTIONS[:enable_type_guessing]
-                    self.guess_type(dictionary).new('', dictionary.to_h)
+                    self.guess_type(dictionary).new('', dictionary)
                 else
-                    Stream.new('', dictionary.to_h)
+                    Stream.new('', dictionary)
                 end
 
             raw_data.chomp!(TOKENS.last)
@@ -161,20 +163,24 @@ module Origami
             stm
         end
 
-        def self.add_type_info(typeclass, key, value) #:nodoc:
-            if not @@cast_fingerprints.has_key?(typeclass) and typeclass.superclass != Stream and
-                 @@cast_fingerprints.has_key?(typeclass.superclass)
-                @@cast_fingerprints[typeclass] = @@cast_fingerprints[typeclass.superclass].dup
+        def self.add_type_signature(key, value) #:nodoc:
+            key, value = key.to_o, value.to_o
+
+            # Inherit the superclass type information.
+            if not @@type_signatures.key?(self) and @@type_signatures.key?(self.superclass)
+                @@type_signatures[self] = @@type_signatures[self.superclass].dup
             end
 
-            @@cast_fingerprints[typeclass] ||= {}
-            @@cast_fingerprints[typeclass][key.to_o] = value.to_o
+            @@type_signatures[self] ||= {}
+            @@type_signatures[self][key] = value
+
+            @@type_keys.push(key) unless @@type_keys.include?(key)
         end
 
         def self.guess_type(hash) #:nodoc:
             best_type = self
 
-            @@cast_fingerprints.each_pair do |klass, keys|
+            @@type_signatures.each_pair do |klass, keys|
                 next unless klass < best_type
 
                 best_type = klass if keys.all? { |k,v| hash[k] == v }
@@ -223,12 +229,11 @@ module Origami
         def set_predictor(predictor, colors: 1, bitspercomponent: 8, columns: 1)
             filters = self.filters
 
-            unless filters.include?(:FlateDecode) or filters.include?(:LZWDecode)
+            layer = filters.index(:FlateDecode) or filters.index(:LZWDecode)
+            if layer.nil?
                 raise InvalidStreamObjectError, 'Predictor functions can only be used with Flate or LZW filters'
             end
 
-            layer = filters.index(:FlateDecode) or filters.index(:LZWDecode)
-
             params = Filter::LZW::DecodeParms.new
             params[:Predictor] = predictor
             params[:Colors] = colors if colors != 1
@@ -243,7 +248,7 @@ module Origami
         def cast_to(type, _parser = nil)
             super(type)
 
-            cast = type.new("", self.dictionary.to_h)
+            cast = type.new("", self.dictionary.copy)
             cast.encoded_data = self.encoded_data.dup
             cast.no, cast.generation = self.no, self.generation
             cast.set_indirect(true)
@@ -261,7 +266,7 @@ module Origami
         # Returns the uncompressed stream content.
         #
         def data
-            self.decode! unless self.decoded?
+            self.decode! unless decoded?
 
             @data
         end
@@ -281,7 +286,7 @@ module Origami
         # Returns the raw compressed stream content.
         #
         def encoded_data
-            self.encode! unless self.encoded?
+            self.encode! unless encoded?
 
             @encoded_data
         end
@@ -407,19 +412,8 @@ module Origami
         end
         alias has_key? key?
 
-        def self.native_type ; Stream end
-
         private
 
-        def method_missing(field, *args) #:nodoc:
-            if field.to_s[-1,1] == '='
-                self[field.to_s[0..-2].to_sym] = args.first
-            else
-                obj = self[field];
-                obj.is_a?(Reference) ? obj.solve : obj
-            end
-        end
-
         def decoded? #:nodoc:
             not @data.nil?
         end
@@ -534,7 +528,7 @@ module Origami
         end
 
         def pre_build #:nodoc:
-            load! if @objects.nil?
+            load!
 
             prolog = ""
             data = ""
@@ -545,7 +539,7 @@ module Origami
                 obj.objstm_offset = objoff
 
                 prolog << "#{num} #{objoff} "
-                objdata = "#{obj.to_s} "
+                objdata = "#{obj} "
 
                 objoff += objdata.size
                 data << objdata
@@ -580,23 +574,14 @@ module Origami
             end
 
             # The object already belongs to a document.
-            unless (obj_doc = object.document).nil?
-                # Remove the previous instance if the object is indirect to avoid duplicates.
-                if obj_doc.equal?(@document)
-                    @document.delete_object(object.reference) if object.indirect?
-                else
-                    object = object.export
-                end
+            unless object.document.nil?
+                object = import_object_from_document(object)
             end
 
-            load! if @objects.nil?
+            load!
 
             object.no, object.generation = @document.allocate_new_object_number if object.no == 0
-
-            object.set_indirect(true) # object is indirect
-            object.parent = self      # set this stream as the parent
-            object.set_document(@document)      # indirect objects need pdf information
-            @objects[object.no] = object
+            store_object(object)
 
             Reference.new(object.no, 0)
         end
@@ -606,7 +591,7 @@ module Origami
         # Deletes Object _no_.
         #
         def delete(no)
-            load! if @objects.nil?
+            load!
 
             @objects.delete(no)
         end
@@ -615,14 +600,7 @@ module Origami
         # Returns the index of Object _no_.
         #
         def index(no)
-            ind = 0
-            @objects.to_a.sort.each do |num, obj|
-                return ind if num == no
-
-                ind = ind + 1
-            end
-
-            nil
+            @objects.to_a.sort.index { |num, _| num == no }
         end
 
         #
@@ -630,7 +608,7 @@ module Origami
         # _no_:: The Object number.
         #
         def extract(no)
-            load! if @objects.nil?
+            load!
 
             @objects[no]
         end
@@ -640,7 +618,7 @@ module Origami
         # _index_:: The Object index in the ObjectStream.
         #
         def extract_by_index(index)
-            load! if @objects.nil?
+            load!
 
             raise TypeError, "index must be an integer" unless index.is_a?(::Integer)
             raise IndexError, "index #{index} out of range" if index < 0 or index >= @objects.size
@@ -653,7 +631,7 @@ module Origami
         # _no_:: The Object number.
         #
         def include?(no)
-            load! if @objects.nil?
+            load!
 
             @objects.include?(no)
         end
@@ -662,7 +640,7 @@ module Origami
         # Iterates over each object in the stream.
         #
         def each(&b)
-            load! if @objects.nil?
+            load!
 
             @objects.values.each(&b)
         end
@@ -681,14 +659,44 @@ module Origami
         # Returns the array of inner objects.
         #
         def objects
-            load! if @objects.nil?
+            load!
 
             @objects.values
         end
 
         private
 
+        #
+        # Preprocess the object in case it already belongs to a document.
+        # If the document is the same as the current object stream, remove the duplicate object from our document.
+        # If the object comes from another document, use the export method to create a version without references.
+        #
+        def import_object_from_document(object)
+            obj_doc = object.document
+
+            # Remove the previous instance if the object is indirect to avoid duplicates.
+            if obj_doc.equal?(@document)
+                @document.delete_object(object.reference) if object.indirect?
+
+            # Otherwise, create a exported version of the object.
+            else
+                object = object.export
+            end
+
+            object
+        end
+
+        def store_object(object) #:nodoc:
+            object.set_indirect(true)       # all stored objects are indirect.
+            object.parent = self            # set this stream as the parent.
+            object.set_document(@document)  # inherit document information.
+
+            @objects[object.no] = object
+        end
+
         def load! #:nodoc:
+            return unless @objects.nil?
+
             decode!
 
             @objects = {}
@@ -705,7 +713,7 @@ module Origami
             end
 
             self.length.times do |i|
-                unless (0...@data.size).cover? (first_object_offset + offsets[i]) and offsets[i] >= 0
+                unless (0...@data.size).cover?(first_object_offset + offsets[i]) and offsets[i] >= 0
                     raise InvalidObjectStreamObjectError, "Invalid offset '#{offsets[i]} for object #{nums[i]}"
                 end
 
@@ -715,12 +723,10 @@ module Origami
                         "Bad embedded object format in object stream" if type.nil?
 
                 embeddedobj = type.parse(data)
-                embeddedobj.set_indirect(true) # object is indirect
-                embeddedobj.no = nums[i]       # object number
-                embeddedobj.parent = self      # set this stream as the parent
-                embeddedobj.set_document(@document) # indirect objects need pdf information
+                embeddedobj.no = nums[i] # object number
                 embeddedobj.objstm_offset = offsets[i]
-                @objects[nums[i]] = embeddedobj
+
+                store_object(embeddedobj)
             end
         end