@patrickdk77/pdf-defuse 0.0.0-stage → 0.1.0

package/dist/io.js

@@ -0,0 +1,414 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SpillSink = exports.TempDir = exports.Reader = void 0;
+exports.bufferSource = bufferSource;
+exports.fileSource = fileSource;
+exports.bufferSink = bufferSink;
+exports.fileSink = fileSink;
+exports.writableSink = writableSink;
+exports.copyToSink = copyToSink;
+const crypto = __importStar(require("node:crypto"));
+const fsp = __importStar(require("node:fs/promises"));
+const os = __importStar(require("node:os"));
+const path = __importStar(require("node:path"));
+/** A source over bytes already in memory. Reads return views, not copies. */
+function bufferSource(bytes) {
+    return {
+        size: async () => bytes.length,
+        read: async (offset, length) => bytes.subarray(Math.max(0, offset), Math.min(bytes.length, offset + length)),
+    };
+}
+/** A source over a local file, read at offsets through one file handle. */
+function fileSource(filePath) {
+    // The pending open is shared, so concurrent first calls get one handle and close() closes it.
+    let opening;
+    let size;
+    const open = () => {
+        opening ??= fsp.open(filePath, 'r');
+        return opening;
+    };
+    return {
+        async size() {
+            if (size === undefined)
+                size = (await (await open()).stat()).size;
+            return size;
+        },
+        async read(offset, length) {
+            const h = await open();
+            const total = await this.size();
+            const n = Math.max(0, Math.min(length, total - offset));
+            const buf = Buffer.allocUnsafe(n);
+            let done = 0;
+            while (done < n) {
+                const { bytesRead } = await h.read(buf, done, n - done, offset + done);
+                if (bytesRead === 0)
+                    break;
+                done += bytesRead;
+            }
+            return done === n ? buf : buf.subarray(0, done);
+        },
+        async close() {
+            const p = opening;
+            opening = undefined;
+            await p?.then(h => h.close(), () => {
+                // An open that failed left nothing to close.
+            });
+        },
+    };
+}
+/** Collects output in memory. */
+function bufferSink() {
+    const chunks = [];
+    let size = 0;
+    return {
+        async write(chunk) {
+            chunks.push(Buffer.from(chunk));
+            size += chunk.length;
+        },
+        async close() {
+            // Nothing to release. The chunks stay for result().
+        },
+        result: () => Buffer.concat(chunks),
+        size: () => size,
+    };
+}
+/** FileHandle.write may write less than asked, for example at a file size limit; the next write then reports why. */
+async function writeAll(handle, chunk) {
+    for (let done = 0; done < chunk.length;)
+        done += (await handle.write(chunk, done, chunk.length - done)).bytesWritten;
+}
+/** Writes to a local file. The file is created on the first write. */
+function fileSink(filePath) {
+    let handle;
+    return {
+        async write(chunk) {
+            handle ??= await fsp.open(filePath, 'w');
+            await writeAll(handle, chunk);
+        },
+        async close() {
+            handle ??= await fsp.open(filePath, 'w');
+            await handle.close();
+        },
+        async abort() {
+            const h = handle;
+            handle = undefined;
+            if (!h)
+                return;
+            // A partial regular file goes. abort() never unlinks a device or pipe the caller named.
+            const partial = (await h.stat().catch(() => undefined))?.isFile();
+            await h.close().catch(() => {
+                // abort() runs after a failure, which is the error to report.
+            });
+            if (partial)
+                await fsp.rm(filePath, { force: true });
+        },
+    };
+}
+/**
+ * Wraps any Node Writable, waiting for 'drain' when it applies backpressure. The stream's first error, or its
+ * closing before the end, fails the pending write and every later one.
+ */
+function writableSink(stream) {
+    let failure;
+    const pending = new Set();
+    const fail = (e) => {
+        failure ??= e;
+        for (const reject of pending)
+            reject(failure);
+        pending.clear();
+    };
+    // Node emits some errors after the write callback, and an 'error' with no listener crashes the process, so this
+    // listener stays for the stream's whole life.
+    stream.on('error', fail);
+    stream.on('close', () => {
+        if (!stream.writableFinished)
+            fail(stream.errored ?? new Error('The output stream closed before all data was written'));
+    });
+    const settle = (start) => new Promise((resolve, reject) => {
+        if (failure)
+            return reject(failure);
+        if (stream.destroyed)
+            return reject(stream.errored ?? new Error('The output stream was destroyed'));
+        pending.add(reject);
+        start(err => {
+            pending.delete(reject);
+            if (err)
+                reject(err);
+            else
+                resolve();
+        });
+    });
+    return {
+        write: chunk => settle(done => (stream.write(chunk) ? done() : stream.once('drain', () => done()))),
+        close: () => settle(done => stream.end((err) => done(err))),
+        // The reader sees an error instead of an end, so it cannot mistake a partial output for a whole one.
+        abort: async (error) => {
+            stream.destroy(error instanceof Error ? error : new Error(String(error)));
+        },
+    };
+}
+/** Random-access reader with a small block cache, so the parser can ask for overlapping windows cheaply. */
+class Reader {
+    source;
+    size;
+    blockSize;
+    maxBlocks;
+    cache = new Map();
+    order = [];
+    constructor(source, size, blockSize = 65536, maxBlocks = 64) {
+        this.source = source;
+        this.size = size;
+        this.blockSize = blockSize;
+        this.maxBlocks = maxBlocks;
+    }
+    async block(index) {
+        const hit = this.cache.get(index);
+        if (hit)
+            return hit;
+        const data = await this.source.read(index * this.blockSize, this.blockSize);
+        this.cache.set(index, data);
+        this.order.push(index);
+        if (this.order.length > this.maxBlocks) {
+            const evicted = this.order.shift();
+            if (evicted !== undefined)
+                this.cache.delete(evicted);
+        }
+        return data;
+    }
+    /** Reads up to `length` bytes at `offset`; shorter only at the end of the source. */
+    async read(offset, length) {
+        if (offset >= this.size || length <= 0)
+            return new Uint8Array(0);
+        const end = Math.min(this.size, offset + length);
+        if (end - offset > this.blockSize * 4)
+            return this.source.read(offset, end - offset);
+        const first = Math.floor(offset / this.blockSize);
+        const last = Math.floor((end - 1) / this.blockSize);
+        if (first === last) {
+            const b = await this.block(first);
+            return b.subarray(offset - first * this.blockSize, end - first * this.blockSize);
+        }
+        const out = new Uint8Array(end - offset);
+        let pos = 0;
+        for (let i = first; i <= last; i++) {
+            const b = await this.block(i);
+            const from = i === first ? offset - first * this.blockSize : 0;
+            const to = i === last ? end - i * this.blockSize : b.length;
+            out.set(b.subarray(from, to), pos);
+            pos += to - from;
+        }
+        return out;
+    }
+    /** Yields the range in chunks without caching them. */
+    async *chunks(offset, length, chunkSize = 262144) {
+        let pos = offset;
+        const end = Math.min(this.size, offset + length);
+        while (pos < end) {
+            const n = Math.min(chunkSize, end - pos);
+            const c = await this.source.read(pos, n);
+            if (c.length === 0)
+                break;
+            yield c;
+            pos += c.length;
+        }
+    }
+}
+exports.Reader = Reader;
+/** A private temporary directory, removed by cleanup(). It also keeps the run's first I/O error. */
+class TempDir {
+    base;
+    // The pending mkdtemp is shared, so concurrent first calls make one directory and cleanup() removes it.
+    dir;
+    seq = 0;
+    /**
+     * The first error from a temporary file or a watched source. The parser recovers from a failed read as if the
+     * file were damaged, so the engine checks this to report an I/O error instead of a verdict on the PDF.
+     */
+    ioError;
+    constructor(base = os.tmpdir()) {
+        this.base = base;
+    }
+    async file(suffix = '.bin') {
+        this.dir ??= fsp.mkdtemp(path.join(this.base, 'pdf-defuse-'));
+        return path.join(await this.dir, `${this.seq++}${suffix}`);
+    }
+    async cleanup() {
+        const dir = await this.dir?.catch(() => undefined);
+        this.dir = undefined;
+        if (dir)
+            await fsp.rm(dir, { recursive: true, force: true });
+    }
+    /**
+     * Wraps a source so that its errors also land in ioError. Once the source has given its size, a read that returns
+     * more or fewer bytes than that size allows is an error too: the parser would take the shifted bytes for the file.
+     */
+    watch(source) {
+        const keep = async (op) => {
+            try {
+                return await op();
+            }
+            catch (e) {
+                this.ioError ??= e;
+                throw e;
+            }
+        };
+        let size;
+        return {
+            size: () => keep(async () => {
+                size = await source.size();
+                return size;
+            }),
+            read: (offset, length) => keep(async () => {
+                const b = await source.read(offset, length);
+                const want = size === undefined ? b.length : Math.max(0, Math.min(length, size - offset));
+                if (b.length !== want)
+                    throw Object.assign(new Error(`The source returned ${b.length} bytes at offset ${offset} where ${want} were expected`), { code: 'EIO' });
+                return b;
+            }),
+            close: source.close &&
+                (() => {
+                    if (!source.close)
+                        throw new Error('The source no longer has close()');
+                    return source.close();
+                }),
+        };
+    }
+}
+exports.TempDir = TempDir;
+/** A sink that keeps small output in memory and moves to a temporary file past a threshold. */
+class SpillSink {
+    temp;
+    threshold;
+    chunks = [];
+    size = 0;
+    filePath;
+    handle;
+    md5 = crypto.createHash('md5');
+    hex;
+    spilled = false;
+    constructor(temp, threshold) {
+        this.temp = temp;
+        this.threshold = threshold;
+    }
+    async write(chunk) {
+        this.md5.update(chunk);
+        this.size += chunk.length;
+        if (!this.handle && this.size <= this.threshold) {
+            this.chunks.push(Buffer.from(chunk));
+            return;
+        }
+        try {
+            if (!this.handle) {
+                this.filePath = await this.temp.file('.spill');
+                this.handle = await fsp.open(this.filePath, 'w');
+                this.spilled = true;
+                for (const c of this.chunks)
+                    await writeAll(this.handle, c);
+                this.chunks = [];
+            }
+            await writeAll(this.handle, chunk);
+        }
+        catch (e) {
+            // Some callers treat a failed spill like undecodable data; the engine still finds the error here.
+            this.temp.ioError ??= e;
+            throw e;
+        }
+    }
+    async close() {
+        await this.handle?.close();
+        this.handle = undefined;
+    }
+    /** Closes the sink and deletes its temporary file, once nothing will read what it holds again. */
+    async dispose() {
+        await this.close();
+        this.chunks = [];
+        const file = this.filePath;
+        this.filePath = undefined;
+        if (file === undefined)
+            return;
+        try {
+            await fsp.rm(file, { force: true });
+        }
+        catch (e) {
+            this.temp.ioError ??= e;
+            throw e;
+        }
+    }
+    get length() {
+        return this.size;
+    }
+    /** The temporary file, once the sink has spilled. */
+    get path() {
+        return this.filePath;
+    }
+    digest() {
+        this.hex ??= this.md5.digest('hex');
+        return this.hex;
+    }
+    /** A source over what was written. Call after close(). */
+    source() {
+        return this.filePath ? this.temp.watch(fileSource(this.filePath)) : bufferSource(Buffer.concat(this.chunks));
+    }
+    async *read(chunkSize = 262144) {
+        const src = this.source();
+        // A consumer that stops early, such as a failed output write, still closes the file.
+        try {
+            const total = await src.size();
+            for (let pos = 0; pos < total; pos += chunkSize)
+                yield await src.read(pos, Math.min(chunkSize, total - pos));
+        }
+        finally {
+            await src.close?.();
+        }
+    }
+}
+exports.SpillSink = SpillSink;
+/**
+ * Copies a whole source, calling `checkTime` before each chunk. A read that returns more or fewer bytes than it asked
+ * for fails the copy, which would otherwise shift every byte after it.
+ */
+async function copyToSink(source, sink, checkTime) {
+    const total = await source.size();
+    const chunk = 262144;
+    for (let pos = 0; pos < total; pos += chunk) {
+        checkTime?.();
+        const want = Math.min(chunk, total - pos);
+        const b = await source.read(pos, want);
+        if (b.length !== want)
+            throw Object.assign(new Error(`The source returned ${b.length} bytes at offset ${pos} where ${want} were expected`), { code: 'EIO' });
+        await sink.write(b);
+    }
+}

package/dist/objects.d.ts

@@ -0,0 +1,52 @@
+/** PDF object model. Arrays are plain JS arrays; null is PDF null. */
+export type PdfObject = null | boolean | number | PdfName | PdfString | PdfObject[] | PdfDict | PdfRef | PdfStream;
+export declare class PdfName {
+    readonly name: string;
+    /** `name` is decoded and has no leading slash. */
+    constructor(name: string);
+}
+export declare class PdfString {
+    bytes: Uint8Array;
+    constructor(bytes: Uint8Array);
+}
+export declare class PdfRef {
+    readonly num: number;
+    readonly gen: number;
+    constructor(num: number, gen: number);
+}
+export declare class PdfDict {
+    readonly map: Map<string, PdfObject>;
+    get(key: string): PdfObject | undefined;
+    has(key: string): boolean;
+    set(key: string, value: PdfObject): void;
+    delete(key: string): void;
+    keys(): string[];
+    entries(): Array<[string, PdfObject]>;
+    clone(): PdfDict;
+    /** Name value of `key`, without the slash, or undefined. */
+    name(key: string): string | undefined;
+    number(key: string): number | undefined;
+}
+/** A stream as found in the source. The body is located, not loaded. */
+export declare class PdfStream {
+    dict: PdfDict;
+    /** Absolute offset of the first body byte in the source. */
+    offset: number;
+    /** Raw (encoded, possibly encrypted) body length. */
+    length: number;
+    constructor(dict: PdfDict, 
+    /** Absolute offset of the first body byte in the source. */
+    offset: number, 
+    /** Raw (encoded, possibly encrypted) body length. */
+    length: number);
+}
+/** The dictionary of a dict or a stream. */
+export declare function dictOf(v: PdfObject | undefined): PdfDict | undefined;
+/**
+ * Decode a PDF text string: UTF-16BE, UTF-16LE or UTF-8 with BOM, otherwise PDFDocEncoding. pdf.js reads the UTF-16LE
+ * mark too, so a tooltip or file name written that way shows as text. Each form is decoded in one call, since a string
+ * built one character at a time costs tens of bytes of heap per input byte.
+ */
+export declare function decodeTextString(bytes: Uint8Array): string;
+/** Encode a JS string as a PDF text string: Latin-1 bytes when PDFDocEncoding reads them back unchanged, else UTF-16BE. */
+export declare function encodeTextString(text: string): Uint8Array;

package/dist/objects.js

@@ -0,0 +1,178 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PdfStream = exports.PdfDict = exports.PdfRef = exports.PdfString = exports.PdfName = void 0;
+exports.dictOf = dictOf;
+exports.decodeTextString = decodeTextString;
+exports.encodeTextString = encodeTextString;
+class PdfName {
+    name;
+    /** `name` is decoded and has no leading slash. */
+    constructor(name) {
+        this.name = name;
+    }
+}
+exports.PdfName = PdfName;
+class PdfString {
+    bytes;
+    constructor(bytes) {
+        this.bytes = bytes;
+    }
+}
+exports.PdfString = PdfString;
+class PdfRef {
+    num;
+    gen;
+    constructor(num, gen) {
+        this.num = num;
+        this.gen = gen;
+    }
+}
+exports.PdfRef = PdfRef;
+class PdfDict {
+    map = new Map();
+    get(key) {
+        return this.map.get(key);
+    }
+    has(key) {
+        return this.map.has(key);
+    }
+    set(key, value) {
+        this.map.set(key, value);
+    }
+    delete(key) {
+        this.map.delete(key);
+    }
+    keys() {
+        return [...this.map.keys()];
+    }
+    entries() {
+        return [...this.map.entries()];
+    }
+    clone() {
+        const d = new PdfDict();
+        for (const [k, v] of this.map)
+            d.map.set(k, v);
+        return d;
+    }
+    /** Name value of `key`, without the slash, or undefined. */
+    name(key) {
+        const v = this.map.get(key);
+        return v instanceof PdfName ? v.name : undefined;
+    }
+    number(key) {
+        const v = this.map.get(key);
+        return typeof v === 'number' ? v : undefined;
+    }
+}
+exports.PdfDict = PdfDict;
+/** A stream as found in the source. The body is located, not loaded. */
+class PdfStream {
+    dict;
+    offset;
+    length;
+    constructor(dict, 
+    /** Absolute offset of the first body byte in the source. */
+    offset, 
+    /** Raw (encoded, possibly encrypted) body length. */
+    length) {
+        this.dict = dict;
+        this.offset = offset;
+        this.length = length;
+    }
+}
+exports.PdfStream = PdfStream;
+/** The dictionary of a dict or a stream. */
+function dictOf(v) {
+    if (v instanceof PdfDict)
+        return v;
+    if (v instanceof PdfStream)
+        return v.dict;
+    return undefined;
+}
+const PDF_DOC_HIGH = {
+    24: 0x02d8,
+    25: 0x02c7,
+    26: 0x02c6,
+    27: 0x02d9,
+    28: 0x02dd,
+    29: 0x02db,
+    30: 0x02da,
+    31: 0x02dc,
+    128: 0x2022,
+    129: 0x2020,
+    130: 0x2021,
+    131: 0x2026,
+    132: 0x2014,
+    133: 0x2013,
+    134: 0x0192,
+    135: 0x2044,
+    136: 0x2039,
+    137: 0x203a,
+    138: 0x2212,
+    139: 0x2030,
+    140: 0x201e,
+    141: 0x201c,
+    142: 0x201d,
+    143: 0x2018,
+    144: 0x2019,
+    145: 0x201a,
+    146: 0x2122,
+    147: 0xfb01,
+    148: 0xfb02,
+    149: 0x0141,
+    150: 0x0152,
+    151: 0x0160,
+    152: 0x0178,
+    153: 0x017d,
+    154: 0x0131,
+    155: 0x0142,
+    156: 0x0153,
+    157: 0x0161,
+    158: 0x017e,
+    160: 0x20ac,
+};
+const PDF_DOC = new Uint16Array(256).map((_, b) => PDF_DOC_HIGH[b] ?? b);
+/**
+ * Decode a PDF text string: UTF-16BE, UTF-16LE or UTF-8 with BOM, otherwise PDFDocEncoding. pdf.js reads the UTF-16LE
+ * mark too, so a tooltip or file name written that way shows as text. Each form is decoded in one call, since a string
+ * built one character at a time costs tens of bytes of heap per input byte.
+ */
+function decodeTextString(bytes) {
+    // An odd trailing byte is dropped.
+    if (bytes.length >= 2 && bytes[0] === 0xfe && bytes[1] === 0xff) {
+        return Buffer.from(bytes.subarray(2, bytes.length - (bytes.length & 1)))
+            .swap16()
+            .toString('utf16le');
+    }
+    if (bytes.length >= 2 && bytes[0] === 0xff && bytes[1] === 0xfe) {
+        return Buffer.from(bytes.buffer, bytes.byteOffset + 2, bytes.length - 2 - (bytes.length & 1)).toString('utf16le');
+    }
+    if (bytes.length >= 3 && bytes[0] === 0xef && bytes[1] === 0xbb && bytes[2] === 0xbf) {
+        return Buffer.from(bytes.subarray(3)).toString('utf8');
+    }
+    let remapped = false;
+    for (let i = 0; i < bytes.length && !remapped; i++)
+        remapped = PDF_DOC[bytes[i]] !== bytes[i];
+    if (!remapped)
+        return Buffer.from(bytes.buffer, bytes.byteOffset, bytes.length).toString('latin1');
+    const out = Buffer.allocUnsafe(bytes.length * 2);
+    for (let i = 0; i < bytes.length; i++) {
+        const c = PDF_DOC[bytes[i]];
+        out[2 * i] = c & 0xff;
+        out[2 * i + 1] = c >> 8;
+    }
+    return out.toString('utf16le');
+}
+/** Encode a JS string as a PDF text string: Latin-1 bytes when PDFDocEncoding reads them back unchanged, else UTF-16BE. */
+function encodeTextString(text) {
+    // PDFDocEncoding maps 0x18-0x1F to accents and leaves 0x7F undefined.
+    // biome-ignore lint/suspicious/noControlCharactersInRegex: the range PDFDocEncoding keeps as is starts with control codes.
+    if (/^[\x00-\x17\x20-\x7e]*$/.test(text))
+        return Buffer.from(text, 'latin1');
+    const out = Buffer.alloc(2 + text.length * 2);
+    out[0] = 0xfe;
+    out[1] = 0xff;
+    for (let i = 0; i < text.length; i++)
+        out.writeUInt16BE(text.charCodeAt(i), 2 + i * 2);
+    return out;
+}