pdfrb 0.8.7 → 0.8.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b0edf5439bfe359af4b900aeb846047b168d741271eb78a7f78315ca5b0bba55
-  data.tar.gz: 0b30e0edb04dcc2a4d26a493ba782379a8a864904eafc72f07c0c49ca4a25e57
+  metadata.gz: af5b6aea283bcc7325c584008268aaedc228f78882cb5408b615c55576cb8154
+  data.tar.gz: 29c3a794f7829144e4fa2275ba4a7b4124087abd7279f076689b06d14d5ac4c3
 SHA512:
-  metadata.gz: bd9802dee13e72edb052c80bd4fea095eade14c95b0fe8cb31277c0a9c36de9f9c202d99bbc3a485911dc5035d6253589b3f50358f0d2b789f4756c19d211e72
-  data.tar.gz: c44636603bba32db00de362646b378238fcb884008b085627c1e19d66e899472d9c1a2539ffffd3eb076a58788afb3abec2eaecfb9b44274960e025d31c7ed34
+  metadata.gz: 6491c0a75e0ef6eb6fa849fdf25de0d546c2055b099e3f533595a073e370a30c37693604b31620e5d3707237e1960f18f6ba7ee05555698c21b081e6300cf493
+  data.tar.gz: 569d900685cc748edba60dfcdc426987343025c4ccae008a715b188ce41ce9d56abf29901debb39e1292d856ba34951394b85a57efb297ac9b5af0b67f706eb6

data/lib/pdfrb/cli.rb

@@ -325,9 +325,10 @@ module Pdfrb
                   )
                 end
 
+      cf_entries = Pdfrb::Encryption.v4_crypt_filters(v)
       encrypt_dict = doc.add(
         { Filter: :Standard, V: v, R: r, Length: length, P: perms,
-          O: o_entry, U: u_entry },
+          O: o_entry, U: u_entry, **cf_entries },
         type: Pdfrb::Model::Cos::Dictionary
       )
       doc.trailer[:Encrypt] = encrypt_dict.ref
@@ -336,7 +337,7 @@ module Pdfrb
       handler = Pdfrb::Encryption::StandardSecurityHandler.new(
         {
           Encrypt: { V: v, R: r, Length: length, P: perms,
-                     O: o_entry, U: u_entry },
+                     O: o_entry, U: u_entry, **cf_entries },
           ID: [id0.b, id0.b],
         }
       )

data/lib/pdfrb/document/encryption.rb

@@ -65,6 +65,30 @@ module Pdfrb
         !trailer.nil? && !trailer[:Encrypt].nil?
       end
 
+      # Handler for reading an encrypted document: memoized, built
+      # from the trailer /Encrypt, verifying the configured password
+      # (config "encryption.password"). Returns nil for unencrypted
+      # documents. Raises EncryptionError when the password does not
+      # verify — the reader must never hand back ciphertext as
+      # plaintext.
+      def reader_handler
+        return nil unless encrypted?
+
+        @reader_handler ||= begin
+          trailer = document.trailer
+          encrypt_dict = document.resolve(trailer[:Encrypt])
+          handler = Pdfrb::Encryption::StandardSecurityHandler.new(
+            { Encrypt: encrypt_dict.value, ID: trailer[:ID] }
+          )
+          password = document.config["encryption.password"] || ""
+          unless handler.verify_user_password?(password)
+            raise Pdfrb::EncryptionError,
+                  "document is encrypted and the password does not verify"
+          end
+          handler
+        end
+      end
+
       # Remove /Encrypt from the trailer (decrypt use case). Returns
       # self for chaining; use encrypted? to check the result.
       def decrypt!
@@ -78,6 +102,7 @@ module Pdfrb
           document.config["encryption.handler"] = nil
           document.config["encryption.password"] = nil
         end
+        @reader_handler = nil
         self
       end
 
@@ -123,8 +148,9 @@ module Pdfrb
             )
           end
 
+        cf_entries = Pdfrb::Encryption.v4_crypt_filters(v)
         register({ Filter: :Standard, V: v, R: r, Length: length,
-                   P: p_bits, O: o_entry, U: u_entry },
+                   P: p_bits, O: o_entry, U: u_entry, **cf_entries },
                  user_password: user_pw)
       end
 
@@ -193,7 +219,10 @@ module Pdfrb
                     trailer[:ID]
                   end }
           )
-          h.verify_user_password?(user_password)
+          unless h.verify_user_password?(user_password)
+            raise Pdfrb::EncryptionError,
+                  "derived key does not verify against the /U entry"
+          end
           h
         end
         document.config["encryption.handler"] = handler

data/lib/pdfrb/encryption/identity.rb

@@ -7,6 +7,10 @@ module Pdfrb
 
       def encrypt(data, **_opts); data; end
       def decrypt(data, **_opts); data; end
+      def encrypt_string(data, *_); data; end
+      def encrypt_stream(data, *_); data; end
+      def decrypt_string(data, *_); data; end
+      def decrypt_stream(data, *_); data; end
       def key_length; 0; end
     end
   end

data/lib/pdfrb/encryption/password_verification.rb

@@ -99,22 +99,26 @@ module Pdfrb
         rc4.process(pack_bytes(PADDING_BYTES))
       end
 
-      # Algorithm 5 (R>=3): build the /U entry.
-      def build_u_r3plus(file_key:, id0:, revision:)
+      # Algorithm 5 (R>=3): the /U entry. The 19 additional RC4
+      # rounds use the file key XORed with the round index, for
+      # i = 1..19 in ascending order.
+      def user_password_hash_r3plus(file_key:, id0:)
         digest = Digest::MD5.new
         digest.update(pack_bytes(PADDING_BYTES))
         digest.update(id0.b)
         hash = digest.digest
-        rc4 = RC4.new(file_key)
-        encrypted = rc4.process(hash)
-        # 19 more rounds with key XORed by round index.
-        19.times do |i|
+        hash = RC4.new(file_key).process(hash)
+        (1..19).each do |i|
           key = file_key.bytes.map { |b| (b ^ i).chr }.join
-          encrypted = RC4.new(key).process(encrypted)
+          hash = RC4.new(key).process(hash)
         end
-        # Pad / truncate to 32 bytes.
-        encrypted = encrypted + ("\x00" * (32 - encrypted.bytesize))
-        encrypted.byteslice(0, 32)
+        hash
+      end
+
+      def build_u_r3plus(file_key:, id0:, revision:)
+        hash = user_password_hash_r3plus(file_key: file_key, id0: id0)
+        # Pad to 32 bytes.
+        hash + ("\x00" * (32 - hash.bytesize))
       end
 
       # Algorithm 6: verify a user password. Returns true if it

data/lib/pdfrb/encryption/public_key_security_handler.rb

@@ -85,6 +85,22 @@ module Pdfrb
 
       # Per-object encryption: AES-256-CBC with IV prefix. The
       # per-object key is SHA-256(file_key ‖ oid ‖ gen).
+      def encrypt_string(data, oid, gen)
+        encrypt_data(data, oid, gen)
+      end
+
+      def encrypt_stream(data, oid, gen)
+        encrypt_data(data, oid, gen)
+      end
+
+      def decrypt_string(data, oid, gen)
+        decrypt_data(data, oid, gen)
+      end
+
+      def decrypt_stream(data, oid, gen)
+        decrypt_data(data, oid, gen)
+      end
+
       def encrypt_data(data, oid, gen)
         return data unless @file_key
 

data/lib/pdfrb/encryption/standard_security_handler.rb

@@ -173,11 +173,77 @@ module Pdfrb
         end
       end
 
+      # Direction-aware entry points (s7.6.3.2 Table 21): streams
+      # use the StmF crypt filter, strings use StrF. V5 is always
+      # AES-256; V2/V3 are always RC4; V4 resolves the cipher from
+      # the CF dictionary's CFM (defaulting to Identity, per spec).
+      def encrypt_string(data, oid, gen)
+        encrypt_with(str_crypt_method, data, oid, gen)
+      end
+
+      def encrypt_stream(data, oid, gen)
+        encrypt_with(stm_crypt_method, data, oid, gen)
+      end
+
+      def decrypt_string(data, oid, gen)
+        decrypt_with(str_crypt_method, data, oid, gen)
+      end
+
+      def decrypt_stream(data, oid, gen)
+        decrypt_with(stm_crypt_method, data, oid, gen)
+      end
+
       # Serializer-compatible alias for encrypt_data. The Serializer
       # calls encrypter.encrypt(payload, oid, gen) on string/stream
       # payloads during serialization.
       alias encrypt encrypt_data
 
+      def stm_crypt_method
+        crypt_method_for(@encrypt[:StmF])
+      end
+
+      def str_crypt_method
+        crypt_method_for(@encrypt[:StrF])
+      end
+
+      # @return [:aes256, :aes, :rc4, :identity]
+      def crypt_method_for(filter_name)
+        return :aes256 if @version >= 5
+        return :rc4 if @version <= 3
+
+        # V4: resolve CFM from the CF dictionary; absent filters
+        # default to Identity (s7.6.3.2 Table 21).
+        return :identity if filter_name.nil? || filter_name == :Identity
+
+        cf = @encrypt[:CF]
+        cfm = cf && cf[filter_name] ? cf[filter_name][:CFM] : nil
+        case cfm
+        when :AESV2 then :aes
+        when :V2 then :rc4
+        else :identity
+        end
+      end
+
+      def encrypt_with(method, data, oid, gen)
+        return data if method == :identity || @key.nil?
+
+        obj_key = compute_object_key(oid, gen)
+        case method
+        when :aes256, :aes then encrypt_aes_cbc(data, obj_key)
+        else encrypt_rc4(data, obj_key)
+        end
+      end
+
+      def decrypt_with(method, data, oid, gen)
+        return data if method == :identity || @key.nil?
+
+        obj_key = compute_object_key(oid, gen)
+        case method
+        when :aes256, :aes then decrypt_aes_cbc(data, obj_key)
+        else decrypt_rc4(data, obj_key)
+        end
+      end
+
       def decrypt_data(data, oid, gen)
         return data unless @key
 
@@ -194,7 +260,9 @@ module Pdfrb
 
       def pad_password(password)
         pw = password.to_s.encode(Encoding::BINARY)[0, 32]
-        pw + PAD[pw.bytesize, 32 - pw.bytesize]
+        # Algorithm 3.2: append the FIRST (32 - n) bytes of the pad
+        # string — not a slice offset by the password length.
+        pw + PAD[0, 32 - pw.bytesize]
       end
 
       def id_bytes
@@ -205,10 +273,14 @@ module Pdfrb
       end
 
       def verify_user_password_hash?(key)
-        return true if @revision < 3
-
-        hash = compute_user_password_hash(key)
-        stored = @encrypt[:U] || ""
+        stored = @encrypt[:U] || "".b
+        hash = if @revision < 3
+                 # Algorithm 3.4/3.6 (R2): U = RC4(file_key, PAD).
+                 RC4Impl.new(key).process(PAD)
+               else
+                 Pdfrb::Encryption::PasswordVerification
+                   .user_password_hash_r3plus(file_key: key, id0: id_bytes)
+               end
         hash[0, 16] == stored[0, 16]
       end
 
@@ -236,11 +308,15 @@ module Pdfrb
         RC4Impl.new(key).process(data)
       end
 
+      def aes_cipher_name(key)
+        "aes-#{key.bytesize * 8}-cbc"
+      end
+
       def encrypt_aes_cbc(data, key)
         iv = OpenSSL::Random.random_bytes(16)
-        cipher = OpenSSL::Cipher.new("aes-128-cbc")
+        cipher = OpenSSL::Cipher.new(aes_cipher_name(key))
         cipher.encrypt
-        cipher.key = key[0, 16]
+        cipher.key = key
         cipher.iv = iv
         encrypted = cipher.update(data) + cipher.final
         iv + encrypted
@@ -251,9 +327,9 @@ module Pdfrb
 
         iv = data[0, 16]
         ciphertext = data[16..]
-        decipher = OpenSSL::Cipher.new("aes-128-cbc")
+        decipher = OpenSSL::Cipher.new(aes_cipher_name(key))
         decipher.decrypt
-        decipher.key = key[0, 16]
+        decipher.key = key
         decipher.iv = iv
         decipher.update(ciphertext) + decipher.final
       rescue OpenSSL::Cipher::CipherError

data/lib/pdfrb/encryption/value_strings.rb

@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+module Pdfrb
+  module Encryption
+    # The COS value-tree string walk, shared by both directions of
+    # the encryption seam: the Serializer encrypts every literal
+    # string an indirect object carries (building transformed
+    # copies), and the ObjectReader decrypts them back (mutating the
+    # freshly-parsed containers in place). One walk, two adapters —
+    # keeps the string set and traversal rules from drifting.
+    module ValueStrings
+      module_function
+
+      # @return [Object] a transformed copy of +value+ with every
+      #   literal string replaced by the block's result.
+      def encrypt(value, oid, gen, cipher)
+        case value
+        when ::Hash
+          value.each_with_object({}) { |(k, v), h| h[k] = encrypt(v, oid, gen, cipher) }
+        when ::Array
+          value.map { |v| encrypt(v, oid, gen, cipher) }
+        when Pdfrb::Model::PdfArray
+          Pdfrb::Model::PdfArray.new(value.map { |v| encrypt(v, oid, gen, cipher) })
+        when Pdfrb::Model::Object
+          Pdfrb::Model::Object.new(encrypt(value.value, oid, gen, cipher),
+                                   oid: value.oid, gen: value.gen)
+        when ::String
+          bytes = if value.encoding == Encoding::UTF_8
+                    Pdfrb::Model::Cos::StringEncoding.encode_text(value)
+                  else
+                    value.dup.force_encoding(Encoding::BINARY)
+                  end
+          cipher.encrypt_string(bytes, oid, gen)
+        else
+          value
+        end
+      end
+
+      # Replaces every literal string inside the freshly-parsed
+      # +value+ (a Hash/Array container tree) with its decrypted
+      # form, in place. Returns +value+.
+      def decrypt!(value, oid, gen, cipher)
+        case value
+        when ::Hash
+          value.each { |k, v| value[k] = decrypt!(v, oid, gen, cipher) }
+        when ::Array
+          value.map! { |v| decrypt!(v, oid, gen, cipher) }
+        when Pdfrb::Model::PdfArray
+          value.value.map! { |v| decrypt!(v, oid, gen, cipher) }
+          value
+        when ::String
+          cipher.decrypt_string(value, oid, gen)
+        else
+          value
+        end
+      end
+    end
+  end
+end

data/lib/pdfrb/encryption.rb

@@ -17,6 +17,7 @@ module Pdfrb
     autoload :AES, "pdfrb/encryption/aes"
     autoload :PasswordVerification, "pdfrb/encryption/password_verification"
     autoload :Identity, "pdfrb/encryption/identity"
+    autoload :ValueStrings, "pdfrb/encryption/value_strings"
     autoload :PublicKeySecurityHandler, "pdfrb/encryption/public_key_security_handler"
     autoload :V5Writer, "pdfrb/encryption/v5_writer"
 
@@ -32,6 +33,29 @@ module Pdfrb
     def handler_for_document(document, **opts)
       SecurityHandler.for(document, decryption_opts: opts)
     end
+
+    # Crypt-filter entries a V4 /Encrypt dict must carry when the
+    # cipher is AES-128: absent StmF/StrF default to Identity
+    # (s7.6.3.2 Table 21), leaving the ciphertext unreadable.
+    V4_AESV2_FILTERS = {
+      CF: { StdCF: { CFM: :AESV2, Length: 16 } },
+      StmF: :StdCF,
+      StrF: :StdCF,
+    }.freeze
+
+    def v4_crypt_filters(v)
+      v == 4 ? V4_AESV2_FILTERS : {}
+    end
+
+    # Objects whose bytes are never encrypted (both write and read
+    # directions consult this): the /Encrypt dictionary itself
+    # (s7.6.3 — its values carry the password hashes) and
+    # cross-reference streams (always cleartext).
+    def exempt_object?(document, obj)
+      encrypt_oid = (document.trailer || {})[:Encrypt]&.oid
+      obj.oid == encrypt_oid ||
+        (obj.is_a?(Pdfrb::Model::Cos::Stream) && obj.value[:Type] == :XRef)
+    end
   end
 end
 

data/lib/pdfrb/linearization/writer.rb

@@ -71,7 +71,7 @@ module Pdfrb
         ordered.each do |obj|
           offsets[obj.oid] = temp.pos
           temp << @serializer.serialize_indirect(obj,
-                                                 skip_string_encryption: encryption_dict?(obj))
+                                                 skip_encryption: Pdfrb::Encryption.exempt_object?(@document, obj))
         end
         first_page_end = temp.pos if first_page_objects.any?
 
@@ -133,7 +133,7 @@ module Pdfrb
 
         layout.ordered_objects.each do |obj|
           buf << @serializer.serialize_indirect(obj,
-                                                skip_string_encryption: encryption_dict?(obj))
+                                                skip_encryption: Pdfrb::Encryption.exempt_object?(@document, obj))
         end
 
         buf << "#{layout.hint_oid} 0 obj\n"
@@ -261,11 +261,6 @@ module Pdfrb
         "%PDF-1.7\n%\xE2\xE3\xCF\xD3\n"
       end
 
-      # The /Encrypt dictionary's own strings must stay in cleartext.
-      def encryption_dict?(obj)
-        (@document.trailer || {})[:Encrypt]&.oid == obj.oid
-      end
-
       def write_non_linearized(io)
         Pdfrb::Writer.write(@document, io)
       end

data/lib/pdfrb/serializer.rb

@@ -53,24 +53,24 @@ module Pdfrb
     # header and (for streams) the stream payload. When an encrypter
     # is set, all strings in the object's dictionaries and the stream
     # payload are encrypted with the per-object key (s7.6.1) — pass
-    # +skip_string_encryption:+ for the /Encrypt dictionary itself,
-    # whose entries must stay readable.
-    def serialize_indirect(obj, skip_string_encryption: false)
+    # +skip_encryption:+ for objects that must stay readable: the
+    # /Encrypt dictionary itself (s7.6.3) and cross-reference streams.
+    def serialize_indirect(obj, skip_encryption: false)
       raise ArgumentError, "not indirect: #{obj.inspect}" unless obj.indirect?
 
-      encrypt_strings = !skip_string_encryption && encrypter
+      encrypt_strings = !skip_encryption && encrypter
       buffer = +""
       buffer << "#{obj.oid} #{obj.gen} obj\n"
       case obj
       when Pdfrb::Model::Cos::Stream
-        dict_value = encrypt_strings ? encrypt_value_strings(obj.value, obj.oid, obj.gen) : obj.value
+        dict_value = encrypt_strings ? Pdfrb::Encryption::ValueStrings.encrypt(obj.value, obj.oid, obj.gen, encrypter) : obj.value
         dict, payload = emit_stream(obj, dict_value)
         buffer << dict
         buffer << "\nstream\n"
-        buffer << (encrypter ? encrypter.encrypt(payload, obj.oid, obj.gen) : payload)
+        buffer << (encrypter && !skip_encryption ? encrypter.encrypt_stream(payload, obj.oid, obj.gen) : payload)
         buffer << "\nendstream\n"
       else
-        value = encrypt_strings ? encrypt_value_strings(obj.value, obj.oid, obj.gen) : obj.value
+        value = encrypt_strings ? Pdfrb::Encryption::ValueStrings.encrypt(obj.value, obj.oid, obj.gen, encrypter) : obj.value
         buffer << serialize(value)
         buffer << "\n"
       end
@@ -80,33 +80,6 @@ module Pdfrb
 
     private
 
-    # Deep-transform +value+ so every literal string carries the
-    # per-object ciphertext (s7.6.1: strings AND streams encrypt).
-    def encrypt_value_strings(value, oid, gen)
-      case value
-      when ::Hash
-        value.each_with_object({}) do |(k, v), h|
-          h[k] = encrypt_value_strings(v, oid, gen)
-        end
-      when ::Array
-        value.map { |v| encrypt_value_strings(v, oid, gen) }
-      when Pdfrb::Model::PdfArray
-        Pdfrb::Model::PdfArray.new(value.map { |v| encrypt_value_strings(v, oid, gen) })
-      when Pdfrb::Model::Object
-        Pdfrb::Model::Object.new(encrypt_value_strings(value.value, oid, gen),
-                                 oid: value.oid, gen: value.gen)
-      when ::String
-        bytes = if value.encoding == Encoding::UTF_8
-                  Pdfrb::Model::Cos::StringEncoding.encode_text(value)
-                else
-                  value.dup.force_encoding(Encoding::BINARY)
-                end
-        encrypter.encrypt(bytes, oid, gen)
-      else
-        value
-      end
-    end
-
     # Build the dict body + payload for a stream object, applying
     # FlateDecode compression when enabled and the stream is large
     # enough to benefit. Returns [dict_bytes, payload_bytes].

data/lib/pdfrb/source/object_reader.rb

@@ -29,13 +29,37 @@ module Pdfrb
         return nil if entry.nil? || entry.free?
 
         obj = case entry.type
-              when :in_use then parse_at(entry.offset, oid, entry.gen)
+              when :in_use then decrypt_loaded(parse_at(entry.offset, oid, entry.gen), entry.gen)
               when :compressed then load_from_objstm(entry.obj_stm_oid, entry.index, oid)
               end
         @cache[oid] = obj
         obj
       end
 
+      # The single funnel for read-side decryption (s7.6.1): strings
+      # in the object's dictionaries and the stream payload decrypt
+      # with the per-object key as the object enters the Model.
+      # Objects inside object streams need no separate treatment —
+      # only the containing ObjStm stream is encrypted — and the
+      # /Encrypt dictionary is exempt (s7.6.3).
+      def decrypt_loaded(obj, gen)
+        return obj if obj.nil?
+        # The exemption check must precede handler construction:
+        # building the handler resolves the /Encrypt dict through
+        # this same funnel, which would recurse before the memo is
+        # set.
+        return obj if Pdfrb::Encryption.exempt_object?(document, obj)
+
+        handler = document.encryption.reader_handler
+        return obj if handler.nil?
+
+        Pdfrb::Encryption::ValueStrings.decrypt!(obj.value, obj.oid, gen, handler)
+        if obj.is_a?(Pdfrb::Model::Cos::Stream) && obj.stream
+          obj.stream = handler.decrypt_stream(obj.stream, obj.oid, gen)
+        end
+        obj
+      end
+
       def clear_cache
         @cache.clear
         @objstm_cache.clear

data/lib/pdfrb/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Pdfrb
-  VERSION = "0.8.7"
+  VERSION = "0.8.8"
 end

data/lib/pdfrb/writer.rb

@@ -74,12 +74,6 @@ module Pdfrb
       { encrypter: handler }
     end
 
-    # The /Encrypt dictionary's own strings (U, O, UE, OE, Perms) must
-    # stay in cleartext — they carry the password hashes.
-    def encryption_dict?(obj)
-      (document.trailer || {})[:Encrypt]&.oid == obj.oid
-    end
-
     def self.write(document, io)
       new(document, io).write
     end
@@ -104,7 +98,7 @@ module Pdfrb
 
         @xref_offsets[obj.oid] = @io.pos
         @io << @serializer.serialize_indirect(obj,
-                                              skip_string_encryption: encryption_dict?(obj))
+                                              skip_encryption: Pdfrb::Encryption.exempt_object?(document, obj))
       end
 
       xref_pos = if use_stream
@@ -139,7 +133,7 @@ module Pdfrb
 
         @xref_offsets[obj.oid] = @io.pos
         @io << @serializer.serialize_indirect(obj,
-                                              skip_string_encryption: encryption_dict?(obj))
+                                              skip_encryption: Pdfrb::Encryption.exempt_object?(document, obj))
       end
       xref_pos = write_xref(prev: previous_xref_offset)
       write_trailer(xref_pos, prev: previous_xref_offset)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: pdfrb
 version: !ruby/object:Gem::Version
-  version: 0.8.7
+  version: 0.8.8
 platform: ruby
 authors:
 - Ribose Inc.
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-08-30 00:00:00.000000000 Z
+date: 2026-08-31 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: benchmark
@@ -891,6 +891,7 @@ files:
 - lib/pdfrb/encryption/security_handler.rb
 - lib/pdfrb/encryption/standard_security_handler.rb
 - lib/pdfrb/encryption/v5_writer.rb
+- lib/pdfrb/encryption/value_strings.rb
 - lib/pdfrb/error.rb
 - lib/pdfrb/filter.rb
 - lib/pdfrb/filter/ascii_85_decode.rb