origami 2.0.3 → 2.0.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 747446efde7ffefe478ec34908b8555b3a5e2596
-  data.tar.gz: 8d92eb219be13b1070e421a6570c587a16fb9a68
+  metadata.gz: 67f206ada90cab96c6551107f6e1b7c882608a9c
+  data.tar.gz: c64e6272dd9512390470c9e5c56454f569162913
 SHA512:
-  metadata.gz: d3f3997e8181f448f74e9a2bc84855652b71b4ea66a2ede9f1b3f8cc696eb77e82c72f436cc430c838972e43cab0566ce52bf6c8fb0fd0ebee47889a2ff3de9f
-  data.tar.gz: e8895bcc5b5b4ae96bcb24d66b4befea45cf2068493814859092f2b56b25dd3d9467df3fcd72b73a6cbbb835e2cae8910a0725f3c85b042127d14aef1c57fa80
+  metadata.gz: a5335917cb27a2fba1c7e36cd805b924d225d436b62be76411d43c51102c651eb5cbdc931cf12bfd4de206e93a421afcf01edae11b20816a4d6815d06b7aba3f
+  data.tar.gz: aa3eaf290b1c5ece1b06630dcb1440e81403865d753355dbccac57ba7f395486eb2bd3b14ba0a96baa8b15c2d4666072d37dead6a54de7c44a40d212ebb67bb8

data/bin/pdf2ruby

@@ -96,10 +96,8 @@ def objectToRuby(obj, inclevel = 0, internalname = nil, do_convert = false)
         case obj
         when Origami::Null
             "Null.new"
-        when Origami::Boolean, Origami::Number
-            obj.value.to_s
-        when Origami::String
-            obj.inspect
+        when Origami::Boolean, Origami::Number, Origami::Name, Origami::String
+            literalToRuby(obj)
         when Origami::Dictionary
             customclass = nil
             if obj.class != Origami::Dictionary
@@ -111,8 +109,6 @@ def objectToRuby(obj, inclevel = 0, internalname = nil, do_convert = false)
             arrayToRuby(obj, inclevel, internalname)
         when Origami::Stream
             streamToRuby(obj, internalname) unless obj.is_a?(ObjectStream) or obj.is_a?(XRefStream)
-        when Origami::Name
-            nameToRuby(obj)
         when Origami::Reference
             referenceToRuby(obj, internalname)
         else
@@ -144,15 +140,8 @@ def referenceToRuby(ref, internalname)
     end
 end
 
-def nameToRuby(name)
-    code = ':'
-    valid = (name.value.to_s =~ /[+.:-]/).nil?
-
-    code << '"' unless valid
-    code << name.value.to_s
-    code << '"' unless valid
-
-    code
+def literalToRuby(obj)
+    obj.value.inspect
 end
 
 def arrayToRuby(arr, inclevel, internalname)
@@ -180,7 +169,7 @@ def dictionaryToRuby(dict, inclevel, internalname, customtype = nil)
     else
         code << "{\n"
         dict.each_pair do |key, val|
-            rubyname = nameToRuby(key)
+            rubyname = literalToRuby(key)
             subintname = "#{internalname}[#{rubyname}]"
 
             if val.is_a?(Origami::Reference) and @var_hash[val] and @var_hash[val][0,3] == "obj"
@@ -212,7 +201,7 @@ def dictionaryToHashMap(dict, inclevel, internalname)
     i = 0
     code = "\n"
     dict.each_pair do |key, val|
-        rubyname = nameToRuby(key)
+        rubyname = literalToRuby(key)
         subintname = "#{internalname}[#{rubyname}]"
 
         if val.is_a?(Origami::Reference) and @var_hash[val] and @var_hash[val][0,3] == "obj"

data/bin/pdfcop

@@ -36,7 +36,8 @@ end
 require 'optparse'
 require 'yaml'
 require 'rexml/document'
-require 'digest/md5'
+require 'digest/sha2'
+require 'fileutils'
 require 'colorize'
 
 DEFAULT_CONFIG_FILE = "#{File.dirname(__FILE__)}/config/pdfcop.conf.yml"
@@ -74,6 +75,10 @@ USAGE
                 options[:policy] = policy
             end
 
+            opts.on("-m", "--move PATH", "Move rejected documents to the specified directory.") do |dir|
+                options[:move_dir] = dir
+            end
+
             opts.on("-P", "--password PASSWORD", "Password to use if the document is encrypted") do |passwd|
                 options[:password] = passwd
             end
@@ -95,20 +100,24 @@ USAGE
 end
 
 @options = OptParser.parse(ARGV)
-if @options.has_key?(:output_log)
+if @options.key?(:output_log)
     LOGGER = File.open(@options[:output_log], "a+")
 else
     LOGGER = STDOUT
 end
 
-if not @options.has_key?(:policy)
+if not @options.key?(:policy)
     @options[:policy] = DEFAULT_POLICY
 end
 
+if @options.key?(:move_dir) and not File.directory?(@options[:move_dir])
+    abort "Error: #{@options[:move_dir]} is not a valid directory."
+end
+
 String.disable_colorization @options[:disable_colors]
 
 load_config_file(@options[:config_file] || DEFAULT_CONFIG_FILE)
-unless SECURITY_POLICIES.has_key?("POLICY_#{@options[:policy].upcase}")
+unless SECURITY_POLICIES.key?("POLICY_#{@options[:policy].upcase}")
     abort "Undeclared policy `#{@options[:policy]}'"
 end
 
@@ -124,9 +133,23 @@ end
 
 def reject(cause)
     log("Document rejected by policy `#{@options[:policy]}', caused by #{cause.inspect}.", :red)
+
+    if @options.key?(:move_dir)
+        quarantine(TARGET, @options[:move_dir])
+    end
+
     abort
 end
 
+def quarantine(file, quarantine_folder)
+    digest = Digest::SHA256.file(TARGET)
+    ext = File.extname(TARGET)
+    dest_name = "#{File.basename(TARGET, ext)}_#{digest}#{ext}"
+    dest_path = File.join(@options[:move_dir], dest_name)
+
+    FileUtils.move(TARGET, dest_path)
+end
+
 def check_rights(*required_rights)
     current_rights = SECURITY_POLICIES["POLICY_#{@options[:policy].upcase}"]
 
@@ -165,7 +188,7 @@ end
 def analyze_annotation(annot, _level = 0)
     check_rights(:allowAnnotations)
 
-    if annot.is_a?(Origami::Dictionary) and annot.has_key?(:Subtype)
+    if annot.is_a?(Origami::Dictionary) and annot.key?(:Subtype)
         case annot[:Subtype].solve.value
         when :FileAttachment
             check_rights(:allowAttachments, :allowFileAttachmentAnnotation)
@@ -186,7 +209,7 @@ def analyze_annotation(annot, _level = 0)
             check_rights(:allow3DAnnotation)
 
             # 3D annotation might pull in JavaScript for real-time driven behavior.
-            if annot.has_key?(:"3DD")
+            if annot.key?(:"3DD")
                 dd = annot[:"3DD"].solve
                 u3dstream = nil
 
@@ -200,7 +223,7 @@ def analyze_annotation(annot, _level = 0)
                 if u3dstream and u3dstream.key?(:OnInstantiate)
                     check_rights(:allowJS)
 
-                    if annot.has_key?(:"3DA") # is 3d view instantiated automatically?
+                    if annot.key?(:"3DA") # is 3d view instantiated automatically?
                         u3dactiv = annot[:"3DA"].solve
 
                         check_rights(:allowJSAtOpening) if u3dactiv.is_a?(Origami::Dictionary) and (u3dactiv[:A] == :PO or u3dactiv[:A] == :PV)
@@ -223,13 +246,13 @@ def analyze_page(page, level = 0)
         #
         # Checking page additional actions.
         #
-        if page.has_key?(:AA)
+        if page.key?(:AA)
             if page.AA.is_a?(Origami::Dictionary)
                 log(text_prefix + " Page has an action dictionary.")
 
                 aa = Origami::Page::AdditionalActions.new(page.AA); aa.parent = page.AA.parent
-                analyze_action(aa.O, true, level + 1) if aa.has_key?(:O)
-                analyze_action(aa.C, false, level + 1) if aa.has_key?(:C)
+                analyze_action(aa.O, true, level + 1) if aa.key?(:O)
+                analyze_action(aa.C, false, level + 1) if aa.key?(:C)
             end
         end
 
@@ -280,7 +303,7 @@ def analyze_action(action, triggered_at_opening, level = 0)
             check_rights(:allowGoToRAction)
 
         when :Thread
-            check_rights(:allowGoToRAction) if action.has_key?(:F)
+            check_rights(:allowGoToRAction) if action.key?(:F)
 
         when :URI
             check_rights(:allowURIAction)
@@ -307,7 +330,7 @@ def analyze_action(action, triggered_at_opening, level = 0)
             check_rights(:allow3DAnnotation,:allowGoTo3DAction)
         end
 
-        if action.has_key?(:Next)
+        if action.key?(:Next)
             log(text_prefix + "This action is chained to another action!")
             check_rights(:allowChainedActions)
             analyze_action(action.Next)
@@ -329,7 +352,7 @@ end
 begin
     log("PDFcop is running on target `#{TARGET}', policy = `#{@options[:policy]}'", :green)
     log("  File size: #{File.size(TARGET)} bytes", :magenta)
-    log("  MD5: #{Digest::MD5.hexdigest(File.read(TARGET))}", :magenta)
+    log("  SHA256: #{Digest::SHA256.file(TARGET)}", :magenta)
 
     @pdf = Origami::PDF.read(TARGET,
         verbosity: Origami::Parser::VERBOSE_QUIET,
@@ -349,31 +372,31 @@ begin
     catalog = @pdf.Catalog
     reject("Invalid document catalog") unless catalog.is_a?(Origami::Catalog)
 
-    if catalog.has_key?(:OpenAction)
+    if catalog.key?(:OpenAction)
         log("  . OpenAction entry = YES")
         check_rights(:allowOpenAction)
         action = catalog.OpenAction
         analyze_action(action, true, 1)
     end
 
-    if catalog.has_key?(:AA)
+    if catalog.key?(:AA)
         if catalog.AA.is_a?(Origami::Dictionary)
             aa = Origami::CatalogAdditionalActions.new(catalog.AA); aa.parent = catalog;
             log("  . Additional actions dictionary = YES")
-            analyze_action(aa.WC, false, 1) if aa.has_key?(:WC)
-            analyze_action(aa.WS, false, 1) if aa.has_key?(:WS)
-            analyze_action(aa.DS, false, 1) if aa.has_key?(:DS)
-            analyze_action(aa.WP, false, 1) if aa.has_key?(:WP)
-            analyze_action(aa.DP, false, 1) if aa.has_key?(:DP)
+            analyze_action(aa.WC, false, 1) if aa.key?(:WC)
+            analyze_action(aa.WS, false, 1) if aa.key?(:WS)
+            analyze_action(aa.DS, false, 1) if aa.key?(:DS)
+            analyze_action(aa.WP, false, 1) if aa.key?(:WP)
+            analyze_action(aa.DP, false, 1) if aa.key?(:DP)
         end
     end
 
-    if catalog.has_key?(:AcroForm)
+    if catalog.key?(:AcroForm)
         acroform = catalog.AcroForm
         if acroform.is_a?(Origami::Dictionary)
             log("  . AcroForm = YES")
             check_rights(:allowAcroForms)
-            if acroform.has_key?(:XFA)
+            if acroform.key?(:XFA)
                 log("  . XFA = YES")
                 check_rights(:allowXFAForms)
 
@@ -400,7 +423,7 @@ begin
 
     log("> Inspecting document streams...", :yellow)
     @pdf.indirect_objects.find_all{|obj| obj.is_a?(Origami::Stream)}.each do |stream|
-        if stream.dictionary.has_key?(:Filter)
+        if stream.dictionary.key?(:Filter)
             filters = stream.Filter
             filters = [ filters ] if filters.is_a?(Origami::Name)
 

data/lib/origami/graphics/xobject.rb

@@ -659,22 +659,22 @@ module Origami
                     data = fd.read
                 else
                     data = File.binread(File.expand_path(path))
-                    format ||= File.extname(path)
+                    format ||= File.extname(path)[1..-1]
                 end
 
                 image = ImageXObject.new
 
                 raise ArgumentError, "Missing file format" if format.nil?
                 case format.downcase
-                when '.jpg', 'jpeg', '.jpe', '.jif', '.jfif', '.jfi'
+                when 'jpg', 'jpeg', 'jpe', 'jif', 'jfif', 'jfi'
                     image.setFilter :DCTDecode
                     image.encoded_data = data
 
-                when '.jp2','.jpx','.j2k','.jpf','.jpm','.mj2'
+                when 'jp2','jpx','j2k','jpf','jpm','mj2'
                     image.setFilter :JPXDecode
                     image.encoded_data = data
 
-                when '.jb2', '.jbig', '.jbig2'
+                when '.b2', 'jbig', 'jbig2'
                     image.setFilter :JBIG2Decode
                     image.encoded_data = data
                 else

data/lib/origami/parser.rb

@@ -188,26 +188,6 @@ module Origami
             @data.string.dup if @data
         end
 
-        private
-
-        #
-        # Attempt to promote an object using the deferred casts.
-        #
-        def try_object_promotion(obj)
-            return obj unless Origami::OPTIONS[:enable_type_propagation] and @deferred_casts.key?(obj.reference)
-
-            types = @deferred_casts[obj.reference]
-            types = [ types ] unless types.is_a?(::Array)
-
-            # Promote object if a compatible type is found.
-            cast_type = types.find {|type| type < obj.class }
-            if cast_type
-                obj = obj.cast_to(cast_type, self)
-            else
-                obj
-            end
-        end
-
         def error(msg = "") #:nodoc:
             log(VERBOSE_QUIET, 'error', :red, msg.red)
         end
@@ -228,6 +208,26 @@ module Origami
             log(VERBOSE_TRACE, 'trace', :cyan, msg)
         end
 
+        private
+
+        #
+        # Attempt to promote an object using the deferred casts.
+        #
+        def try_object_promotion(obj)
+            return obj unless Origami::OPTIONS[:enable_type_propagation] and @deferred_casts.key?(obj.reference)
+
+            types = @deferred_casts[obj.reference]
+            types = [ types ] unless types.is_a?(::Array)
+
+            # Promote object if a compatible type is found.
+            cast_type = types.find {|type| type < obj.class }
+            if cast_type
+                obj = obj.cast_to(cast_type, self)
+            else
+                obj
+            end
+        end
+
         def log(level, prefix, color, message) #:nodoc:
             return unless @options[:verbosity] >= level
 

data/lib/origami/pdf.rb

@@ -543,7 +543,7 @@ module Origami
         #
         # Iterates over the children of an object, avoiding cycles.
         #
-        def walk_object(object, excludes: [])
+        def walk_object(object, excludes: [], &block)
             return enum_for(__method__, object, excludes: excludes) unless block_given?
 
             return if excludes.include?(object)
@@ -553,18 +553,18 @@ module Origami
             when Dictionary
                 object.each_value do |value|
                     yield(value)
-                    walk_object(value, excludes: excludes)
+                    walk_object(value, excludes: excludes, &block)
                 end
 
             when Array
                 object.each do |child|
                     yield(child)
-                    walk_object(child, excludes: excludes)
+                    walk_object(child, excludes: excludes, &block)
                 end
 
             when Stream
                 yield(object.dictionary)
-                walk_object(object.dictionary, excludes: excludes)
+                walk_object(object.dictionary, excludes: excludes, &block)
             end
         end
 

data/lib/origami/trailer.rb

@@ -123,13 +123,13 @@ module Origami
             end
 
             if not stream.scan(@@regexp_xref)
-                #raise InvalidTrailerError, "Cannot get startxref value"
+                raise InvalidTrailerError, "Cannot get startxref value"
             end
 
             startxref = stream['startxref'].to_i
 
             if not stream.scan(@@regexp_close)
-                #raise InvalidTrailerError, "No %%EOF token found"
+                parser.warn("No %%EOF token found") if parser
             end
 
             Trailer.new(startxref, dictionary)

data/lib/origami/version.rb

@@ -19,5 +19,5 @@
 =end
 
 module Origami
-    VERSION   = "2.0.3"
+    VERSION   = "2.0.4"
 end 

data/test/test_objects.rb

@@ -0,0 +1,33 @@
+require 'minitest/autorun'
+require 'stringio'
+
+class TestPDFObjects < Minitest::Test
+
+    def setup
+        @pdf = PDF.new.append_page
+        @contents = ContentStream.new("abc")
+        @pdf.pages.first.Contents = @contents
+        @pdf.Catalog.Loop = @pdf.Catalog
+        @pdf.save StringIO.new
+    end
+
+    def test_pdf_object_tree
+        assert_instance_of Catalog, @pdf.Catalog
+        assert_nil @pdf.Catalog.parent
+
+        @pdf.each_object(recursive: true) do |obj|
+            assert_kind_of Origami::Object, obj
+            assert_equal obj.document, @pdf
+
+            unless obj.indirect?
+                assert_kind_of Origami::Object, obj.parent
+                assert_equal obj.parent.document, @pdf
+            end
+        end
+
+        enum = @pdf.each_object(recursive: true)
+        assert_kind_of Enumerator, enum
+        assert enum.include?(@pdf.Catalog.Pages)
+        assert enum.include?(@contents.dictionary)
+    end
+end

data/test/test_pdf.rb

@@ -16,3 +16,4 @@ require_relative 'test_actions'
 require_relative 'test_annotations'
 require_relative 'test_forms'
 require_relative 'test_xrefs'
+require_relative 'test_objects'

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: origami
 version: !ruby/object:Gem::Version
-  version: 2.0.3
+  version: 2.0.4
 platform: ruby
 authors:
 - Guillaume Delugré
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-06-14 00:00:00.000000000 Z
+date: 2017-10-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: colorize
@@ -39,7 +39,7 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '5.0'
 description: Origami is a pure Ruby library to parse, modify and generate PDF documents.
-email: gdelugre@security-labs.org
+email: origami@subvert.technology
 executables:
 - pdfsh
 - pdfwalker
@@ -194,6 +194,7 @@ files:
 - test/test_actions.rb
 - test/test_annotations.rb
 - test/test_forms.rb
+- test/test_objects.rb
 - test/test_pages.rb
 - test/test_pdf.rb
 - test/test_pdf_attachment.rb
@@ -225,7 +226,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
 requirements:
 - gtk2 to run the graphical interface
 rubyforge_project: 
-rubygems_version: 2.6.11
+rubygems_version: 2.6.13
 signing_key: 
 specification_version: 4
 summary: Ruby framework to manipulate PDF documents