@patrickdk77/pdf-defuse 0.0.0-stage → 0.1.2

package/dist/writer.d.ts

@@ -0,0 +1,6 @@
+import { type PdfObject, PdfRef } from './objects';
+export declare function serializeName(name: string): string;
+/** The shortest digits that read back as `n`, written out in full because PDF has no exponent form. */
+export declare function serializeNumber(n: number): string;
+/** Serializes an object. `mapRef` renumbers references and may return null to drop one. */
+export declare function serialize(obj: PdfObject, mapRef?: (r: PdfRef) => PdfRef | null): string;

package/dist/writer.js

@@ -0,0 +1,112 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.serializeName = serializeName;
+exports.serializeNumber = serializeNumber;
+exports.serialize = serialize;
+const objects_1 = require("./objects");
+const NAME_SAFE = new Uint8Array(256);
+for (let c = 0x21; c <= 0x7e; c++)
+    NAME_SAFE[c] = 1;
+for (const c of '()<>[]{}/%#')
+    NAME_SAFE[c.charCodeAt(0)] = 0;
+const HEX = '0123456789ABCDEF';
+function serializeName(name) {
+    let unsafe = 0;
+    for (let i = 0; i < name.length; i++)
+        if (!NAME_SAFE[name.charCodeAt(i)])
+            unsafe++;
+    if (!unsafe)
+        return `/${name}`;
+    // Filled in one buffer: appending to a string per byte costs tens of bytes of heap per byte of name.
+    const bytes = Buffer.from(name, 'latin1');
+    const out = Buffer.allocUnsafe(1 + bytes.length + 2 * unsafe);
+    let p = 0;
+    out[p++] = 0x2f;
+    for (const b of bytes) {
+        if (NAME_SAFE[b])
+            out[p++] = b;
+        else {
+            out[p++] = 0x23;
+            out[p++] = HEX.charCodeAt(b >> 4);
+            out[p++] = HEX.charCodeAt(b & 15);
+        }
+    }
+    return out.toString('latin1', 0, p);
+}
+/**
+ * Short strings as hex; long ones as escaped literals, so a large string is not doubled. A literal writes the "o" of
+ * every "obj" as \157, so text such as "5 0 obj" never reads as an object header to a reader that scans the file.
+ */
+function serializeString(bytes) {
+    if (bytes.length <= 256)
+        return `<${Buffer.from(bytes).toString('hex')}>`;
+    let extra = 0;
+    for (let i = 0; i < bytes.length; i++) {
+        const b = bytes[i];
+        if (b === 0x28 || b === 0x29 || b === 0x5c || b === 0x0d)
+            extra++;
+        else if (b === 0x6f && bytes[i + 1] === 0x62 && bytes[i + 2] === 0x6a)
+            extra += 3;
+    }
+    const out = Buffer.allocUnsafe(bytes.length + extra + 2);
+    let p = 0;
+    out[p++] = 0x28;
+    for (let i = 0; i < bytes.length; i++) {
+        const b = bytes[i];
+        if (b === 0x28 || b === 0x29 || b === 0x5c) {
+            out[p++] = 0x5c;
+            out[p++] = b;
+        }
+        else if (b === 0x0d) {
+            out[p++] = 0x5c;
+            out[p++] = 0x72;
+        }
+        else if (b === 0x6f && bytes[i + 1] === 0x62 && bytes[i + 2] === 0x6a)
+            p += out.write('\\157', p, 'latin1');
+        else
+            out[p++] = b;
+    }
+    out[p++] = 0x29;
+    return out.toString('latin1', 0, p);
+}
+/** The shortest digits that read back as `n`, written out in full because PDF has no exponent form. */
+function serializeNumber(n) {
+    if (!Number.isFinite(n) || n === 0)
+        return '0';
+    const s = String(n);
+    const e = s.indexOf('e');
+    if (e < 0)
+        return s;
+    const sign = n < 0 ? '-' : '';
+    const digits = s.slice(sign.length, e).replace('.', '');
+    const exp = Number(s.slice(e + 1));
+    return exp < 0 ? `${sign}0.${'0'.repeat(-exp - 1)}${digits}` : sign + digits + '0'.repeat(exp + 1 - digits.length);
+}
+/** Serializes an object. `mapRef` renumbers references and may return null to drop one. */
+function serialize(obj, mapRef = r => r) {
+    if (obj === null)
+        return 'null';
+    if (obj === true)
+        return 'true';
+    if (obj === false)
+        return 'false';
+    if (typeof obj === 'number')
+        return serializeNumber(obj);
+    if (obj instanceof objects_1.PdfName)
+        return serializeName(obj.name);
+    if (obj instanceof objects_1.PdfString)
+        return serializeString(obj.bytes);
+    if (obj instanceof objects_1.PdfRef) {
+        const r = mapRef(obj);
+        return r ? `${r.num} ${r.gen} R` : 'null';
+    }
+    if (Array.isArray(obj))
+        return `[${obj.map(v => serialize(v, mapRef)).join(' ')}]`;
+    if (obj instanceof objects_1.PdfDict) {
+        let s = '<<';
+        for (const [k, v] of obj.map)
+            s += `${serializeName(k)} ${serialize(v, mapRef)}`;
+        return `${s}>>`;
+    }
+    throw new Error('Cannot serialize object');
+}

package/package.json

@@ -1,6 +1,88 @@
 {
   "name": "@patrickdk77/pdf-defuse",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.2",
+  "description": "Sanitize and clean PDF files. Detects and removes JavaScript, attached files, launch actions, unsafe links and empty-password encryption, scores the risk, and writes a disarmed copy with bounded memory and no runtime dependencies.",
+  "license": "MIT",
+  "author": "patrickdk77",
+  "main": "./dist/index.js",
+  "module": "./dist/index.mjs",
+  "types": "./dist/index.d.ts",
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.mjs",
+      "require": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "bin": {
+    "pdf-defuse": "dist/cli.js"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=22.0.0"
+  },
+  "scripts": {
+    "clean": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true});require('fs').rmSync('build-test',{recursive:true,force:true})\"",
+    "build": "tsc -p tsconfig.json && node scripts/write-esm-wrapper.js",
+    "build:test": "tsc -p tsconfig.test.json",
+    "lint": "biome check .",
+    "format": "biome format --write .",
+    "test": "npm run lint && npm run build && npm run build:test && mocha --timeout 120000 \"build-test/test/**/*.test.js\"",
+    "validate": "npm run build && node scripts/validate-corpus.js",
+    "prepare": "husky || true",
+    "prepublishOnly": "npm run clean && npm test"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/patrickdk77/pdf-defuse.git"
+  },
+  "bugs": {
+    "url": "https://github.com/patrickdk77/pdf-defuse/issues"
+  },
+  "homepage": "https://github.com/patrickdk77/pdf-defuse",
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "pdf",
+    "sanitize",
+    "sanitise",
+    "scrub",
+    "cleaner",
+    "cleaning",
+    "disarm",
+    "defuse",
+    "defang",
+    "cdr",
+    "strip",
+    "security",
+    "inspect",
+    "scanner",
+    "detect",
+    "encrypted",
+    "decrypt",
+    "attachments"
+  ],
+  "devDependencies": {
+    "@biomejs/biome": "^2.5.15",
+    "@cantoo/pdf-lib": "^2.11.1",
+    "@types/chai": "^5.2.3",
+    "@types/mocha": "^10.0.10",
+    "@types/node": "^22.20.5",
+    "chai": "^6.3.0",
+    "husky": "^9.1.7",
+    "lint-staged": "^17.6.0",
+    "mocha": "^12.0.3",
+    "pdfjs-dist": "^6.4.299",
+    "typescript": "^7.0.2"
+  },
+  "lint-staged": {
+    "*.{ts,js,mjs,cjs,json,jsonc}": "biome check --write --no-errors-on-unmatched --files-ignore-unknown=true"
+  }
+}