prawn-git 2.0.1

data/lib/prawn/security.rb

@@ -0,0 +1,288 @@
+# encoding: utf-8
+#
+# encryption.rb : Implements encrypted PDF and access permissions.
+#
+# Copyright August 2008, Brad Ediger. All Rights Reserved.
+#
+# This is free software. Please see the LICENSE and COPYING files for details.
+
+require 'digest/md5'
+
+require 'pdf/core/byte_string'
+
+require_relative 'security/arcfour'
+
+module Prawn
+  class Document
+
+    # Implements PDF encryption (password protection and permissions) as
+    # specified in the PDF Reference, version 1.3, section 3.5 "Encryption".
+    module Security
+
+      # @group Experimental API
+
+      # Encrypts the document, to protect confidential data or control
+      # modifications to the document. The encryption algorithm used is
+      # detailed in the PDF Reference 1.3, section 3.5 "Encryption", and it is
+      # implemented by all major PDF readers.
+      #
+      # +options+ can contain the following:
+      #
+      # <tt>:user_password</tt>:: Password required to open the document. If
+      #                           this is omitted or empty, no password will be
+      #                           required. The document will still be
+      #                           encrypted, but anyone can read it.
+      #
+      # <tt>:owner_password</tt>:: Password required to make modifications to
+      #                            the document or change or override its
+      #                            permissions. If this is set to
+      #                            <tt>:random</tt>, a random password will be
+      #                            used; this can be useful if you never want
+      #                            users to be able to override the document
+      #                            permissions.
+      #
+      # <tt>:permissions</tt>:: A hash mapping permission symbols (see below) to
+      #                         <tt>true</tt> or <tt>false</tt>. True means
+      #                         "permitted", and false means "not permitted".
+      #                         All permissions default to <tt>true</tt>.
+      #
+      # The following permissions can be specified:
+      #
+      # <tt>:print_document</tt>:: Print document.
+      #
+      # <tt>:modify_contents</tt>:: Modify contents of document (other than text
+      #                             annotations and interactive form fields).
+      #
+      # <tt>:copy_contents</tt>:: Copy text and graphics from document.
+      #
+      # <tt>:modify_annotations</tt>:: Add or modify text annotations and
+      #                                interactive form fields.
+      #
+      # == Examples
+      #
+      # Deny printing to everyone, but allow anyone to open without a password:
+      #
+      #   encrypt_document :permissions => { :print_document => false },
+      #                    :owner_password => :random
+      #
+      # Set a user and owner password on the document, with full permissions for
+      # both the user and the owner:
+      #
+      #   encrypt_document :user_password => 'foo', :owner_password => 'bar'
+      #
+      # Set no passwords, grant all permissions (This is useful because the
+      # default in some readers, if no permissions are specified, is "deny"):
+      #
+      #   encrypt_document
+      #
+      # == Caveats
+      #
+      # * The encryption used is weak; the key is password-derived and is
+      #   limited to 40 bits, due to US export controls in effect at the time
+      #   the PDF standard was written.
+      #
+      # * There is nothing technologically requiring PDF readers to respect the
+      #   permissions embedded in a document. Many PDF readers do not.
+      #
+      # * In short, you have <b>no security at all</b> against a moderately
+      #   motivated person. Don't use this for anything super-serious. This is
+      #   not a limitation of Prawn, but is rather a built-in limitation of the
+      #   PDF format.
+      #
+      def encrypt_document(options={})
+        Prawn.verify_options [:user_password, :owner_password, :permissions],
+          options
+        @user_password = options.delete(:user_password) || ""
+
+        @owner_password = options.delete(:owner_password) || @user_password
+        if @owner_password == :random
+          # Generate a completely ridiculous password
+          @owner_password = (1..32).map{ rand(256) }.pack("c*")
+        end
+
+        self.permissions = options.delete(:permissions) || {}
+
+        # Shove the necessary entries in the trailer and enable encryption.
+        state.trailer[:Encrypt] = encryption_dictionary
+        state.encrypt = true
+        state.encryption_key = user_encryption_key
+      end
+
+      # Encrypts the given string under the given key, also requiring the
+      # object ID and generation number of the reference.
+      # See Algorithm 3.1.
+      def self.encrypt_string(str, key, id, gen)
+        # Convert ID and Gen number into little-endian truncated byte strings
+        id = [id].pack('V')[0,3]
+        gen = [gen].pack('V')[0,2]
+        extended_key = "#{key}#{id}#{gen}"
+
+        # Compute the RC4 key from the extended key and perform the encryption
+        rc4_key = Digest::MD5.digest(extended_key)[0, 10]
+        Arcfour.new(rc4_key).encrypt(str)
+      end
+
+      private
+
+      # Provides the values for the trailer encryption dictionary.
+      def encryption_dictionary
+        { :Filter => :Standard, # default PDF security handler
+          :V      => 1,         # "Algorithm 3.1", PDF reference 1.3
+          :R      => 2,         # Revision 2 of the algorithm
+          :O      => PDF::Core::ByteString.new(owner_password_hash),
+          :U      => PDF::Core::ByteString.new(user_password_hash),
+          :P      => permissions_value }
+      end
+
+      # Flags in the permissions word, numbered as LSB = 1
+      PermissionsBits = { :print_document     => 3,
+                          :modify_contents    => 4,
+                          :copy_contents      => 5,
+                          :modify_annotations => 6 }
+
+      FullPermissions = 0b1111_1111_1111_1111_1111_1111_1111_1111
+
+      def permissions=(perms={})
+        @permissions ||= FullPermissions
+        perms.each do |key, value|
+          unless PermissionsBits[key]
+            raise ArgumentError, "Unknown permission :#{key}. Valid options: " +
+              PermissionsBits.keys.map { |k| k.inspect }.join(", ")
+          end
+
+          # 0-based bit number, from LSB
+          bit_position = PermissionsBits[key] - 1
+
+          if value # set bit
+            @permissions |= (1 << bit_position)
+          else # clear bit
+            @permissions &= ~(1 << bit_position)
+          end
+        end
+      end
+
+      def permissions_value
+        @permissions || FullPermissions
+      end
+
+      PasswordPadding =
+        "28BF4E5E4E758A4164004E56FFFA01082E2E00B6D0683E802F0CA9FE6453697A".
+        scan(/../).map{|x| x.to_i(16)}.pack("c*")
+
+      # Pads or truncates a password to 32 bytes as per Alg 3.2.
+      def pad_password(password)
+        password = password[0, 32]
+        password + PasswordPadding[0, 32 - password.length]
+      end
+
+      def user_encryption_key
+        @user_encryption_key ||= begin
+          md5 = Digest::MD5.new
+          md5 << pad_password(@user_password)
+          md5 << owner_password_hash
+          md5 << [permissions_value].pack("V")
+          md5.digest[0, 5]
+        end
+      end
+
+      # The O (owner) value in the encryption dictionary. Algorithm 3.3.
+      def owner_password_hash
+        @owner_password_hash ||= begin
+          key = Digest::MD5.digest(pad_password(@owner_password))[0, 5]
+          Arcfour.new(key).encrypt(pad_password(@user_password))
+        end
+      end
+
+      # The U (user) value in the encryption dictionary. Algorithm 3.4.
+      def user_password_hash
+        Arcfour.new(user_encryption_key).encrypt(PasswordPadding)
+      end
+
+    end
+
+  end
+end
+
+# @private
+module PDF
+  module Core
+    module_function
+
+    # Like PdfObject, but returns an encrypted result if required.
+    # For direct objects, requires the object identifier and generation number
+    # from the indirect object referencing obj.
+    #
+    # @private
+    def EncryptedPdfObject(obj, key, id, gen, in_content_stream=false)
+      case obj
+      when Array
+        "[" << obj.map { |e|
+            EncryptedPdfObject(e, key, id, gen, in_content_stream)
+        }.join(' ') << "]"
+      when LiteralString
+        obj = ByteString.new(Prawn::Document::Security.encrypt_string(obj, key, id, gen)).gsub(/[\\\n\(\)]/) { |m| "\\#{m}" }
+        "(#{obj})"
+      when Time
+        obj = obj.strftime("D:%Y%m%d%H%M%S%z").chop.chop + "'00'"
+        obj = ByteString.new(Prawn::Document::Security.encrypt_string(obj, key, id, gen)).gsub(/[\\\n\(\)]/) { |m| "\\#{m}" }
+        "(#{obj})"
+      when String
+        PdfObject(
+          ByteString.new(
+            Prawn::Document::Security.encrypt_string(obj, key, id, gen)),
+          in_content_stream)
+      when ::Hash
+        output = "<< "
+        obj.each do |k,v|
+          unless String === k || Symbol === k
+            raise PDF::Core::Errors::FailedObjectConversion,
+              "A PDF Dictionary must be keyed by names"
+          end
+          output << PdfObject(k.to_sym, in_content_stream) << " " <<
+                    EncryptedPdfObject(v, key, id, gen, in_content_stream) << "\n"
+        end
+        output << ">>"
+      when NameTree::Value
+        PdfObject(obj.name) + " " +
+          EncryptedPdfObject(obj.value, key, id, gen, in_content_stream)
+      when PDF::Core::OutlineRoot, PDF::Core::OutlineItem
+        EncryptedPdfObject(obj.to_hash, key, id, gen, in_content_stream)
+      else # delegate back to PdfObject
+        PdfObject(obj, in_content_stream)
+      end
+    end
+
+
+    # @private
+    class Stream
+      def encrypted_object(key, id, gen)
+        if filtered_stream
+          "stream\n#{Prawn::Document::Security.encrypt_string filtered_stream, key, id, gen}\nendstream\n"
+        else
+          ''
+        end
+      end
+    end
+
+    # @private
+    class Reference
+
+      # Returns the object definition for the object this references, keyed from
+      # +key+.
+      def encrypted_object(key)
+        @on_encode.call(self) if @on_encode
+
+        output = "#{@identifier} #{gen} obj\n"
+        unless @stream.empty?
+          output << PDF::Core::EncryptedPdfObject(data.merge(@stream.data), key, @identifier, gen) << "\n" <<
+            @stream.encrypted_object(key, @identifier, gen)
+        else
+          output << PDF::Core::EncryptedPdfObject(data, key, @identifier, gen) << "\n"
+        end
+
+        output << "endobj\n"
+      end
+
+    end
+  end
+end

data/lib/prawn/security/arcfour.rb

@@ -0,0 +1,54 @@
+# encoding: utf-8
+
+# Implementation of the "ARCFOUR" algorithm ("alleged RC4 (tm)"). Implemented
+# as described at:
+# http://www.mozilla.org/projects/security/pki/nss/draft-kaukonen-cipher-arcfour-03.txt
+#
+# "RC4" is a trademark of RSA Data Security, Inc.
+#
+# Copyright August 2009, Brad Ediger. All Rights Reserved.
+#
+# This is free software. Please see the LICENSE and COPYING files for details.
+
+# @private
+class Arcfour
+  def initialize(key)
+    # Convert string key to Array of integers
+    key = key.unpack('c*') if key.is_a?(String)
+
+    # 1. Allocate an 256 element array of 8 bit bytes to be used as an S-box
+    # 2. Initialize the S-box.  Fill each entry first with it's index
+    @sbox = (0..255).to_a
+
+    # 3. Fill another array of the same size (256) with the key, repeating
+    #    bytes as necessary.
+    s2 = []
+    while s2.length < 256
+      s2 += key
+    end
+    s2 = s2[0, 256]
+
+    # 4. Set j to zero and initialize the S-box
+    j = 0
+    (0..255).each do |i|
+      j = (j + @sbox[i] + s2[i]) % 256
+      @sbox[i], @sbox[j] = @sbox[j], @sbox[i]
+    end
+
+    @i = @j = 0
+  end
+
+  def encrypt(string)
+    string.unpack('c*').map{|byte| byte ^ key_byte}.pack('c*')
+  end
+
+  private
+
+  # Produces the next byte of key material in the stream (3.2 Stream Generation)
+  def key_byte
+    @i = (@i + 1) % 256
+    @j = (@j + @sbox[@i]) % 256
+    @sbox[@i], @sbox[@j] = @sbox[@j], @sbox[@i]
+    @sbox[(@sbox[@i] + @sbox[@j]) % 256]
+  end
+end

data/lib/prawn/soft_mask.rb

@@ -0,0 +1,94 @@
+# encoding: utf-8
+#
+# soft_mask.rb : Implements soft-masking
+#
+# Copyright September 2012, Alexander Mankuta. All Rights Reserved.
+#
+# This is free software. Please see the LICENSE and COPYING files for details.
+#
+
+module Prawn
+
+  # The Prawn::SoftMask module is used to create arbitrary transparency in
+  # document. Using a soft mask allows creating more visually rich documents.
+  #
+  # You must group soft mask and graphics it's applied to under
+  # save_graphics_state because soft mask is a part of graphic state in PDF.
+  #
+  # Example:
+  #   pdf.save_graphics_state do
+  #     pdf.soft_mask do
+  #       pdf.fill_color "444444"
+  #       pdf.fill_polygon [0, 40], [60, 10], [120, 40], [60, 68]
+  #     end
+  #     pdf.fill_color '000000'
+  #     pdf.fill_rectangle [0, 50], 120, 68
+  #   end
+  #
+  module SoftMask
+    # @group Stable API
+
+    def soft_mask(&block)
+      renderer.min_version(1.4)
+
+      group_attrs = ref!({
+        :Type => :Group,
+        :S => :Transparency,
+        :CS => :DeviceRGB,
+        :I => false,
+        :K => false
+      })
+
+      group = ref!({
+        :Type => :XObject,
+        :Subtype => :Form,
+        :BBox => state.page.dimensions,
+        :Group => group_attrs,
+      })
+
+      state.page.stamp_stream(group, &block)
+
+      mask = ref!({
+        :Type => :Mask,
+        :S => :Luminosity,
+        :G => group
+      })
+
+      g_state = ref!({
+        :Type => :ExtGState,
+        :SMask => mask,
+
+        :AIS => false,
+        :BM => :Normal,
+        :OP => false,
+        :op => false,
+        :OPM => 1,
+        :SA => true,
+      })
+
+      registry_key = {
+        :bbox => state.page.dimensions,
+        :mask => [group.stream.filters.normalized, group.stream.filtered_stream],
+        :page => state.page_count,
+      }.hash
+
+      if soft_mask_registry[registry_key]
+        renderer.add_content "/#{soft_mask_registry[registry_key]} gs"
+      else
+        masks = page.resources[:ExtGState] ||= {}
+        id = masks.empty? ? 'GS1' : masks.keys.sort.last.succ
+        masks[id] = g_state
+
+        soft_mask_registry[registry_key] = id
+
+        renderer.add_content "/#{id} gs"
+      end
+    end
+
+    private
+
+    def soft_mask_registry
+      @soft_mask_registry ||= {}
+    end
+  end
+end

data/lib/prawn/stamp.rb

@@ -0,0 +1,136 @@
+# encoding: utf-8
+#
+# stamp.rb : Implements a repeatable stamp
+#
+# Copyright October 2009, Daniel Nelson. All Rights Reserved.
+#
+# This is free software. Please see the LICENSE and COPYING files for details.
+#
+
+module Prawn
+
+  # The Prawn::Stamp module is used to create content that will be
+  # included multiple times in a document. Using a stamp has three
+  # advantages over creating content anew each time it is placed on
+  # the page:
+  #   i.   faster document creation
+  #   ii.  smaller final document
+  #   iii. faster display on subsequent displays of the repeated
+  #   element because the viewer application can cache the rendered
+  #   results
+  #
+  # Example:
+  #   pdf.create_stamp("my_stamp") {
+  #     pdf.fill_circle([10, 15], 5)
+  #     pdf.draw_text("hello world", :at => [20, 10])
+  #   }
+  #   pdf.stamp("my_stamp")
+  #
+  module Stamp
+
+    # @group Stable API
+
+    # Renders the stamp named <tt>name</tt> to the page
+    # raises <tt>Prawn::Errors::InvalidName</tt> if name.empty?
+    # raises <tt>Prawn::Errors::UndefinedObjectName</tt> if no stamp
+    # has been created with this name
+    #
+    # Example:
+    #   pdf.create_stamp("my_stamp") {
+    #     pdf.fill_circle([10, 15], 5)
+    #     pdf.text("hello world", :at => [20, 10])
+    #   }
+    #   pdf.stamp("my_stamp")
+    #
+    def stamp(name)
+      dictionary_name, dictionary = stamp_dictionary(name)
+      renderer.add_content "/#{dictionary_name} Do"
+      state.page.xobjects.merge!(dictionary_name => dictionary)
+    end
+
+    # Renders the stamp named <tt>name</tt> at a position offset from
+    # the initial coords at which the elements of the stamp was
+    # created
+    #
+    # Example:
+    #   pdf.create_stamp("circle") do
+    #     pdf.fill_circle([0, 0], 25)
+    #   end
+    #   # draws a circle at 100, 100
+    #   pdf.stamp_at("circle", [100, 100])
+    #
+    # See stamp() for exceptions that might be raised
+    #
+    def stamp_at(name, point)
+      translate(point[0], point[1]) { stamp(name) }
+    end
+
+    # Creates a re-usable stamp named <tt>name</tt>
+    #
+    # raises <tt>Prawn::Errors::NameTaken</tt> if a stamp already
+    # exists in this document with this name
+    # raises <tt>Prawn::Errors::InvalidName</tt> if name.empty?
+    #
+    # Example:
+    #   pdf.create_stamp("my_stamp") {
+    #     pdf.fill_circle([10, 15], 5)
+    #     pdf.draw_text("hello world", :at => [20, 10])
+    #   }
+    #
+    def create_stamp(name, &block)
+      dictionary = create_stamp_dictionary(name)
+
+      state.page.stamp_stream(dictionary, &block)
+    end
+
+    private
+
+    def stamp_dictionary_registry
+      @stamp_dictionary_registry ||= {}
+    end
+
+    def next_stamp_dictionary_id
+      stamp_dictionary_registry.length + 1
+    end
+
+    def stamp_dictionary(name)
+      raise Prawn::Errors::InvalidName if name.empty?
+      if stamp_dictionary_registry[name].nil?
+        raise Prawn::Errors::UndefinedObjectName
+      end
+
+      dict = stamp_dictionary_registry[name]
+
+      dictionary_name = dict[:stamp_dictionary_name]
+      dictionary = dict[:stamp_dictionary]
+      [dictionary_name, dictionary]
+    end
+
+    def create_stamp_dictionary(name)
+      raise Prawn::Errors::InvalidName if name.empty?
+      raise Prawn::Errors::NameTaken unless stamp_dictionary_registry[name].nil?
+      # BBox origin is the lower left margin of the page, so we need
+      # it to be the full dimension of the page, or else things that
+      # should appear near the top or right margin are invisible
+      dictionary = ref!(:Type    => :XObject,
+                        :Subtype => :Form,
+                        :BBox    => [0, 0,
+                                     state.page.dimensions[2], state.page.dimensions[3]])
+
+      dictionary_name = "Stamp#{next_stamp_dictionary_id}"
+
+      stamp_dictionary_registry[name] = { :stamp_dictionary_name => dictionary_name,
+                                          :stamp_dictionary      => dictionary }
+      dictionary
+    end
+
+    def freeze_stamp_graphics
+      update_colors
+      write_line_width
+      write_stroke_cap_style
+      write_stroke_join_style
+      write_stroke_dash
+    end
+
+  end
+end