pdfrb 0.6.0 → 0.7.10

data/lib/pdfrb/conformance/ltv.rb

@@ -0,0 +1,112 @@
+# frozen_string_literal: true
+
+# rubocop:disable Metrics/BlockLength
+module Pdfrb
+  module Conformance
+    # Long-Term Validation (LTV) per ETSI EN 319 102-1 Annex B. LTV
+    # preserves the validity of a signature beyond the validity
+    # period of the signer's certificate by archiving revocation
+    # data and timestamping the archive over time.
+    #
+    # LTV requires:
+    #   * At least one signature with /ByteRange and /Contents.
+    #   * /DSS dictionary on Catalog with /Certs, /CRLs, /OCSPs as
+    #     applicable.
+    #   * For archival (LTA): a /DocumentTimeStamp on the catalog.
+    module Ltv
+      module_function
+
+      RULESET = RuleSet.new("LTV").tap do |rs|
+        rs.register(Rule.new(
+                      id: "ltv-1",
+                      description: "/DSS dictionary required for LTV",
+                      severity: :error,
+                      spec_clause: "ETSI EN 319 102-1 B.5",
+                      check: ->(doc) {
+                        next nil if doc.catalog[:DSS]
+
+                        Violation.new(
+                          rule_id: "ltv-1",
+                          message: "LTV requires /DSS dictionary on Catalog",
+                          object: "Catalog/DSS",
+                          severity: :error,
+                          spec_clause: "ETSI EN 319 102-1 B.5"
+                        )
+                      }
+                    ))
+
+        rs.register(Rule.new(
+                      id: "ltv-2",
+                      description: "/DSS must contain validation material",
+                      severity: :warning,
+                      spec_clause: "ETSI EN 319 102-1 B.5",
+                      check: ->(doc) {
+                        dss = doc.catalog[:DSS]
+                        dss = doc.object(dss) if dss.is_a?(Pdfrb::Model::Reference)
+                        next nil unless dss
+
+                        has_material = dss[:Certs] || dss[:CRLs] || dss[:OCSPs] ||
+                                       dss[:VRI]
+                        next nil if has_material
+
+                        Violation.new(
+                          rule_id: "ltv-2",
+                          message: "/DSS is empty (no /Certs, /CRLs, /OCSPs, or /VRI)",
+                          object: "Catalog/DSS",
+                          severity: :warning,
+                          spec_clause: "ETSI EN 319 102-1 B.5"
+                        )
+                      }
+                    ))
+
+        rs.register(Rule.new(
+                      id: "ltv-3",
+                      description: "At least one signature should be present",
+                      severity: :warning,
+                      spec_clause: "ETSI EN 319 102-1 B.4",
+                      check: ->(doc) {
+                        fields = Pdfrb::Conformance::Pades.signature_fields(doc)
+                        next nil if fields.any?
+
+                        Violation.new(
+                          rule_id: "ltv-3",
+                          message: "LTV document has no signatures to validate",
+                          object: "AcroForm/Fields",
+                          severity: :warning,
+                          spec_clause: "ETSI EN 319 102-1 B.4"
+                        )
+                      }
+                    ))
+
+        rs.register(Rule.new(
+                      id: "ltv-4",
+                      description: "Document Time Stamp for archival (LTA)",
+                      severity: :warning,
+                      spec_clause: "ETSI EN 319 102-1 B.6",
+                      check: ->(doc) {
+                        fields = Pdfrb::Conformance::Pades.signature_fields(doc)
+                        has_archival = fields.any? do |field|
+                          v = field[:V]
+                          v_obj = v.is_a?(Pdfrb::Model::Reference) ? doc.object(v) : v
+                          v_obj && v_obj[:Type]&.to_sym == :DocTimeStamp
+                        end
+                        next nil if has_archival
+
+                        Violation.new(
+                          rule_id: "ltv-4",
+                          message: "Long-Term Archival (LTA) recommends a Document Time Stamp",
+                          object: "AcroForm/Fields",
+                          severity: :warning,
+                          spec_clause: "ETSI EN 319 102-1 B.6"
+                        )
+                      }
+                    ))
+      end
+
+      def validate(document)
+        RULESET.validate(document)
+      end
+    end
+  end
+end
+# rubocop:enable Metrics/BlockLength

data/lib/pdfrb/conformance/pades.rb

@@ -0,0 +1,198 @@
+# frozen_string_literal: true
+
+# rubocop:disable Metrics/BlockLength
+module Pdfrb
+  module Conformance
+    # PAdES (ETSI EN 319 142-1) signature profile validation. Four
+    # baseline levels build on each other:
+    #
+    #   B-B: Basic signatures — just the document hash + signer cert.
+    #   B-T: B-B + trusted timestamp (RFC 3161) on the signature.
+    #   B-LT: B-T + long-term validation material (DSS dictionary
+    #         with revocation data, signer certs, TSA cert chain).
+    #   B-LTA: B-LT + archival timestamp protecting the DSS itself.
+    #
+    # Each rule set checks signature dictionaries on the document's
+    # /AcroForm /Fields for the required components per level.
+    module Pades
+      ALLOWED_SIGNATURE_TYPES = %i[Sig DocTimeStamp].freeze
+
+      module_function
+
+      SHARED = RuleSet.new("PAdES-shared").tap do |rs|
+        rs.register(Rule.new(
+                      id: "pades-1",
+                      description: "At least one signature field must be present",
+                      severity: :error,
+                      spec_clause: "ETSI EN 319 142-1 5.2",
+                      check: ->(doc) {
+                        next nil if signature_fields(doc).any?
+
+                        Violation.new(
+                          rule_id: "pades-1",
+                          message: "PAdES requires at least one signature field",
+                          object: "AcroForm/Fields",
+                          severity: :error,
+                          spec_clause: "ETSI EN 319 142-1 5.2"
+                        )
+                      }
+                    ))
+      end
+
+      BB = RuleSet.new("PAdES-B-B").tap do |rs|
+        SHARED.rules.each { |r| rs.register(r) }
+        rs.register(Rule.new(
+                      id: "bb-1",
+                      description: "B-B: each signature must have /Type /Sig or /DocTimeStamp",
+                      severity: :error,
+                      spec_clause: "ETSI EN 319 142-1 5.3",
+                      check: ->(doc) {
+                        vs = []
+                        signature_fields(doc).each do |field|
+                          v = field[:V]
+                          next unless v
+
+                          v_obj = v.is_a?(Pdfrb::Model::Reference) ? doc.object(v) : v
+                          next if v_obj && ALLOWED_SIGNATURE_TYPES.include?(v_obj[:Type]&.to_sym)
+
+                          vs << Violation.new(
+                            rule_id: "bb-1",
+                            message: "Signature V must be /Type /Sig or /DocTimeStamp",
+                            object: "Field/V",
+                            severity: :error,
+                            spec_clause: "ETSI EN 319 142-1 5.3"
+                          )
+                        end
+                        vs.empty? ? nil : vs
+                      }
+                    ))
+      end
+
+      BT = RuleSet.new("PAdES-B-T").tap do |rs|
+        BB.rules.each { |r| rs.register(r) }
+        rs.register(Rule.new(
+                      id: "bt-1",
+                      description: "B-T: signature must include a trusted timestamp",
+                      severity: :error,
+                      spec_clause: "ETSI EN 319 142-1 5.4",
+                      check: ->(doc) {
+                        vs = []
+                        signature_fields(doc).each do |field|
+                          v = field[:V]
+                          next unless v
+
+                          v_obj = v.is_a?(Pdfrb::Model::Reference) ? doc.object(v) : v
+                          has_timestamp = v_obj && (
+                            v_obj[:Type]&.to_sym == :DocTimeStamp ||
+                              (v_obj[:ByteRange] && timestamp_in_signature?(v_obj))
+                          )
+                          next if has_timestamp
+
+                          vs << Violation.new(
+                            rule_id: "bt-1",
+                            message: "B-T requires a trusted timestamp (RFC 3161)",
+                            object: "Field/V",
+                            severity: :error,
+                            spec_clause: "ETSI EN 319 142-1 5.4"
+                          )
+                        end
+                        vs.empty? ? nil : vs
+                      }
+                    ))
+      end
+
+      BLT = RuleSet.new("PAdES-B-LT").tap do |rs|
+        BT.rules.each { |r| rs.register(r) }
+        rs.register(Rule.new(
+                      id: "blt-1",
+                      description: "B-LT: DSS dictionary required for LTV material",
+                      severity: :error,
+                      spec_clause: "ETSI EN 319 142-1 5.5",
+                      check: ->(doc) {
+                        next nil if doc.catalog[:DSS]
+
+                        Violation.new(
+                          rule_id: "blt-1",
+                          message: "B-LT requires /DSS dictionary with validation material",
+                          object: "Catalog/DSS",
+                          severity: :error,
+                          spec_clause: "ETSI EN 319 142-1 5.5"
+                        )
+                      }
+                    ))
+      end
+
+      BLTA = RuleSet.new("PAdES-B-LTA").tap do |rs|
+        BLT.rules.each { |r| rs.register(r) }
+        rs.register(Rule.new(
+                      id: "blta-1",
+                      description: "B-LTA: archival Document Time Stamp required",
+                      severity: :error,
+                      spec_clause: "ETSI EN 319 142-1 5.6",
+                      check: ->(doc) {
+                        # B-LTA needs a DocTimeStamp as the last signature,
+                        # protecting the DSS.
+                        has_archival = signature_fields(doc).any? do |field|
+                          v = field[:V]
+                          v_obj = v.is_a?(Pdfrb::Model::Reference) ? doc.object(v) : v
+                          v_obj && v_obj[:Type]&.to_sym == :DocTimeStamp
+                        end
+                        next nil if has_archival
+
+                        Violation.new(
+                          rule_id: "blta-1",
+                          message: "B-LTA requires an archival Document Time Stamp",
+                          object: "AcroForm/Fields",
+                          severity: :error,
+                          spec_clause: "ETSI EN 319 142-1 5.6"
+                        )
+                      }
+                    ))
+      end
+
+      LEVEL_RULESETS = {
+        "B-B": BB, "B-T": BT, "B-LT": BLT, "B-LTA": BLTA
+      }.freeze
+
+      def profiles
+        LEVEL_RULESETS.dup
+      end
+
+      def validate(document, level: :"B-B")
+        rs = LEVEL_RULESETS[level] || SHARED
+        rs.validate(document)
+      end
+
+      def signature_fields(document)
+        acroform = document.catalog[:AcroForm]
+        acroform = document.object(acroform) if acroform.is_a?(Pdfrb::Model::Reference)
+        return [] unless acroform
+
+        fields = acroform[:Fields]
+        fields = fields.value if fields.is_a?(Pdfrb::Model::PdfArray)
+        return [] unless fields.is_a?(::Array)
+
+        fields.filter_map do |ref|
+          obj = ref.is_a?(Pdfrb::Model::Reference) ? document.object(ref) : ref
+          next nil unless obj
+
+          obj[:FT]&.to_sym == :Sig ? obj : nil
+        end
+      end
+
+      # Heuristic: look for the standard ASN.1 timestamp OID
+      # (1.2.840.113549.1.7.2 signedData, with a TSTInfo content
+      # type). Real validation requires parsing the PKCS#7 — out of
+      # scope for this rule set, which only checks the structural
+      # presence of a ByteRange + Contents long enough to hold a
+      # timestamp token.
+      def timestamp_in_signature?(signature)
+        contents = signature[:Contents]
+        return false unless contents.is_a?(::String)
+
+        contents.bytesize > 1024
+      end
+    end
+  end
+end
+# rubocop:enable Metrics/BlockLength

data/lib/pdfrb/conformance/pdf_2_af.rb

@@ -0,0 +1,185 @@
+# frozen_string_literal: true
+
+# rubocop:disable Metrics/BlockLength
+module Pdfrb
+  module Conformance
+    # PDF 2.0 Associated Files (AF) validation per Application Note
+    # 002 (sources at ~/src/pdfa/appnote-pdf20-002-af/). The AF
+    # mechanism attaches external files to PDF objects with a typed
+    # relationship (Source, Data, Alternative, Supplement,
+    # EncryptedPayload, Unspecified).
+    #
+    # This rule set checks:
+    #   * /AF arrays are present where required (PDF 2.0 catalog).
+    #   * Each /AF entry is a /Type /AssociatedFile or FileSpec dict
+    #     with an /AFRelationship.
+    #   * /AFRelationship is one of the six allowed values.
+    #   * FileSpec dicts carry /UF + /EF.
+    #   * EmbeddedFile streams carry /Subtype (MIME type).
+    module Pdf2AF
+      ALLOWED_RELATIONSHIPS = %i[Source Data Alternative Supplement
+                                 EncryptedPayload Unspecified].freeze
+
+      module_function
+
+      RULESET = RuleSet.new("PDF 2.0 AF").tap do |rs|
+        rs.register(Rule.new(
+                      id: "af-1",
+                      description: "/AF entries must declare AFRelationship",
+                      severity: :error,
+                      spec_clause: "PDF 2.0 App Note 002 3.1",
+                      check: ->(doc) {
+                        violations = []
+                        each_af_entry(doc) do |container, entry|
+                          next if relationship_of(entry)
+
+                          violations << Violation.new(
+                            rule_id: "af-1",
+                            message: "/AF entry on #{container_label(container)} missing /AFRelationship",
+                            object: container_label(container),
+                            severity: :error,
+                            spec_clause: "PDF 2.0 App Note 002 3.1"
+                          )
+                        end
+                        violations
+                      }
+                    ))
+
+        rs.register(Rule.new(
+                      id: "af-2",
+                      description: "/AFRelationship must be one of the allowed values",
+                      severity: :error,
+                      spec_clause: "PDF 2.0 App Note 002 3.2",
+                      check: ->(doc) {
+                        violations = []
+                        each_af_entry(doc) do |container, entry|
+                          rel = relationship_of(entry)
+                          next unless rel
+                          next if ALLOWED_RELATIONSHIPS.include?(rel.to_sym)
+
+                          violations << Violation.new(
+                            rule_id: "af-2",
+                            message: "/AFRelationship '#{rel}' is not one of #{ALLOWED_RELATIONSHIPS.join(', ')}",
+                            object: container_label(container),
+                            severity: :error,
+                            spec_clause: "PDF 2.0 App Note 002 3.2"
+                          )
+                        end
+                        violations
+                      }
+                    ))
+
+        rs.register(Rule.new(
+                      id: "af-3",
+                      description: "FileSpec dicts must carry /UF and /EF",
+                      severity: :error,
+                      spec_clause: "PDF 2.0 7.11.3",
+                      check: ->(doc) {
+                        violations = []
+                        each_filespec(doc) do |_container, fs|
+                          ok = fs[:UF] && fs[:EF]
+                          next if ok
+
+                          violations << Violation.new(
+                            rule_id: "af-3",
+                            message: "FileSpec missing /UF or /EF",
+                            object: "FileSpec",
+                            severity: :error,
+                            spec_clause: "PDF 2.0 7.11.3"
+                          )
+                        end
+                        violations
+                      }
+                    ))
+
+        rs.register(Rule.new(
+                      id: "af-4",
+                      description: "EmbeddedFile streams should declare /Subtype MIME",
+                      severity: :warning,
+                      spec_clause: "PDF 2.0 7.11.4",
+                      check: ->(doc) {
+                        violations = []
+                        doc.each_indirect_object do |obj|
+                          next unless obj.value[:Type] == :EmbeddedFile
+                          next if obj.value[:Subtype]
+
+                          violations << Violation.new(
+                            rule_id: "af-4",
+                            message: "EmbeddedFile missing /Subtype (MIME type)",
+                            object: "EmbeddedFile",
+                            severity: :warning,
+                            spec_clause: "PDF 2.0 7.11.4"
+                          )
+                        end
+                        violations
+                      }
+                    ))
+      end
+
+      def validate(document)
+        RULESET.validate(document)
+      end
+
+      # Walk every indirect object that has an /AF key, yielding
+      # (container_object, af_entry) for each entry in each /AF
+      # array. /AF entries may be References (resolves) or dicts.
+      def each_af_entry(document)
+        document.each_indirect_object do |container|
+          af = container.value[:AF]
+          next unless af
+
+          af_value = af.is_a?(Pdfrb::Model::PdfArray) ? af.value : af
+          entries = af_value.is_a?(::Array) ? af_value : [af_value]
+          entries.each do |e|
+            resolved = e.is_a?(Pdfrb::Model::Reference) ? document.object(e) : e
+            yield container, resolved if resolved
+          end
+        end
+      end
+
+      # Walk every FileSpec dict in the document.
+      def each_filespec(document)
+        document.each_indirect_object do |container|
+          fs = container.value[:Type] == :FileSpec ? container : nil
+          if fs
+            yield container, fs
+            next
+          end
+
+          # Also pick up FileSpecs referenced from /AF arrays.
+          af = container.value[:AF]
+          next unless af
+
+          af_value = af.is_a?(Pdfrb::Model::PdfArray) ? af.value : af
+          entries = af_value.is_a?(::Array) ? af_value : [af_value]
+          entries.each do |e|
+            resolved = e.is_a?(Pdfrb::Model::Reference) ? document.object(e) : e
+            next unless resolved && resolved.value[:Type] == :FileSpec
+
+            yield container, resolved
+          end
+        end
+      end
+
+      def relationship_of(entry)
+        return nil unless entry
+
+        value = entry.is_a?(Pdfrb::Model::Cos::Dictionary) ? entry.value : entry
+        return nil unless value.is_a?(::Hash)
+
+        # AssociatedFile dicts put the relationship on
+        # /AFRelationship; FileSpecs put it on the same key when
+        # they're AF-related.
+        value[:AFRelationship]
+      end
+
+      def container_label(obj)
+        type = obj.value[:Type]
+        return "Object/#{obj.oid}" unless type
+
+        "Object/#{type}/#{obj.oid}"
+      end
+    end
+  end
+end
+# rubocop:enable Metrics/BlockLength

data/lib/pdfrb/conformance/pdf_a.rb

@@ -80,6 +80,122 @@ module Pdfrb
                     ))
       end
 
+      # Deep preflight rules common to all PDF/A levels. Each is a
+      # categorical ban: JavaScript, PS XObjects, non-A-3 embedded
+      # files, and unencoded text operators.
+      PREFLIGHT_DEEP = RuleSet.new("PDF/A-preflight").tap do |rs|
+        rs.register(Rule.new(
+                      id: "preflight-1",
+                      description: "JavaScript is forbidden",
+                      severity: :error,
+                      spec_clause: "ISO 19005-1 6.6",
+                      check: ->(doc) {
+                        vs = []
+                        catalog = doc.catalog
+                        names = catalog[:Names]
+                        names = doc.object(names) if names.is_a?(Pdfrb::Model::Reference)
+                        if names && (names[:JavaScript] || (names.is_a?(::Hash) && names[:JavaScript]))
+                          vs << Violation.new(
+                            rule_id: "preflight-1",
+                            message: "/Names /JavaScript is forbidden in PDF/A",
+                            object: "Catalog/Names/JavaScript",
+                            severity: :error,
+                            spec_clause: "ISO 19005-1 6.6"
+                          )
+                        end
+                        if catalog[:AA] || catalog[:OpenAction]
+                          vs << Violation.new(
+                            rule_id: "preflight-1",
+                            message: "Additional actions (/AA) and /OpenAction with JavaScript are restricted in PDF/A",
+                            object: "Catalog",
+                            severity: :warning,
+                            spec_clause: "ISO 19005-1 6.6"
+                          )
+                        end
+                        vs.empty? ? nil : vs
+                      }
+                    ))
+
+        rs.register(Rule.new(
+                      id: "preflight-2",
+                      description: "PostScript XObjects are forbidden",
+                      severity: :error,
+                      spec_clause: "ISO 19005-1 6.2.3",
+                      check: ->(doc) {
+                        vs = []
+                        doc.each_indirect_object do |obj|
+                          next unless obj.value[:Type] == :XObject
+                          next unless obj.value[:Subtype] == :PS
+
+                          vs << Violation.new(
+                            rule_id: "preflight-2",
+                            message: "PostScript XObjects are forbidden in PDF/A",
+                            object: "XObject",
+                            severity: :error,
+                            spec_clause: "ISO 19005-1 6.2.3"
+                          )
+                        end
+                        vs.empty? ? nil : vs
+                      }
+                    ))
+
+        rs.register(Rule.new(
+                      id: "preflight-3",
+                      description: "EmbeddedFile streams restricted",
+                      severity: :error,
+                      spec_clause: "ISO 19005-3 6.4",
+                      check: ->(_doc) {
+                        # Only PDF/A-3 allows EmbeddedFile. The rule
+                        # is permissive by default; the per-level
+                        # rule sets filter it down for A-1 and A-2.
+                      }
+                    ))
+
+        rs.register(Rule.new(
+                      id: "preflight-4",
+                      description: "Encryption is forbidden",
+                      severity: :error,
+                      spec_clause: "ISO 19005-1 6.1",
+                      check: ->(doc) {
+                        next nil unless doc.trailer && doc.trailer[:Encrypt]
+
+                        Violation.new(
+                          rule_id: "preflight-4",
+                          message: "Encryption is forbidden in PDF/A",
+                          object: "Trailer/Encrypt",
+                          severity: :error,
+                          spec_clause: "ISO 19005-1 6.1"
+                        )
+                      }
+                    ))
+      end
+
+      # Embeds files forbidden in PDF/A-1 and PDF/A-2 (only A-3
+      # permits them).
+      PREFLIGHT_NO_EMBED = RuleSet.new("PDF/A-no-embedded").tap do |rs|
+        rs.register(Rule.new(
+                      id: "preflight-3-a1a2",
+                      description: "EmbeddedFile streams are forbidden in PDF/A-1 and A-2",
+                      severity: :error,
+                      spec_clause: "ISO 19005-1 6.4",
+                      check: ->(doc) {
+                        vs = []
+                        doc.each_indirect_object do |obj|
+                          next unless obj.value[:Type] == :EmbeddedFile
+
+                          vs << Violation.new(
+                            rule_id: "preflight-3-a1a2",
+                            message: "EmbeddedFile streams are forbidden in PDF/A-1 and A-2",
+                            object: "EmbeddedFile",
+                            severity: :error,
+                            spec_clause: "ISO 19005-1 6.4"
+                          )
+                        end
+                        vs.empty? ? nil : vs
+                      }
+                    ))
+      end
+
       A1_SPECIFIC = RuleSet.new("PDF/A-1-specific").tap do |rs|
         rs.register(Rule.new(
                       id: "a1-1", description: "JPEG2000 not allowed in A-1",
@@ -295,21 +411,28 @@ module Pdfrb
       A1 = RuleSet.new("PDF/A-1").tap do |rs|
         SHARED.rules.each { |r| rs.register(r) }
         A1_SPECIFIC.rules.each { |r| rs.register(r) }
+        PREFLIGHT_DEEP.rules.each { |r| rs.register(r) }
+        PREFLIGHT_NO_EMBED.rules.each { |r| rs.register(r) }
       end
 
       A2 = RuleSet.new("PDF/A-2").tap do |rs|
         SHARED.rules.each { |r| rs.register(r) }
         A2_SPECIFIC.rules.each { |r| rs.register(r) }
+        PREFLIGHT_DEEP.rules.each { |r| rs.register(r) }
+        PREFLIGHT_NO_EMBED.rules.each { |r| rs.register(r) }
       end
 
       A3 = RuleSet.new("PDF/A-3").tap do |rs|
         SHARED.rules.each { |r| rs.register(r) }
         A3_SPECIFIC.rules.each { |r| rs.register(r) }
+        PREFLIGHT_DEEP.rules.each { |r| rs.register(r) }
       end
 
       A4 = RuleSet.new("PDF/A-4").tap do |rs|
         SHARED.rules.each { |r| rs.register(r) }
         A4_SPECIFIC.rules.each { |r| rs.register(r) }
+        PREFLIGHT_DEEP.rules.each { |r| rs.register(r) }
+        PREFLIGHT_NO_EMBED.rules.each { |r| rs.register(r) }
       end
 
       LEVEL_RULESETS = {