@patrickdk77/pdf-defuse 0.1.2 → 0.2.0

package/dist/engine.js

@@ -39,7 +39,8 @@ function encryptionFindings(doc, factory) {
         return [];
     const out = [];
     if (r.status === 'ok') {
-        out.push(factory.make(types_1.PdfCategory.Encrypted, r.password === 'empty' ? types_1.PdfDetail.EmptyPassword : r.password === 'owner' ? types_1.PdfDetail.OwnerPassword : types_1.PdfDetail.UserPassword));
+        const detail = { empty: types_1.PdfDetail.EmptyPassword, user: types_1.PdfDetail.UserPassword, owner: types_1.PdfDetail.OwnerPassword, none: types_1.PdfDetail.AttachmentsOnly }[r.password];
+        out.push(factory.make(types_1.PdfCategory.Encrypted, detail));
         const bits = r.handler.keyBits;
         const method = r.handler.streamMethod === 'Identity' ? r.handler.stringMethod : r.handler.streamMethod;
         if (method === 'AES256')
@@ -135,6 +136,8 @@ async function analyzeInner(run, source, options, depth, deadline, verify) {
     findings.push(...encryptionFindings(doc, factory));
     if (doc.securityResult && doc.securityResult.status !== 'ok')
         return finish(findings, options, true, doc.headerVersion);
+    if (doc.missingHeader)
+        findings.push(factory.make(types_1.PdfCategory.Corrupted, types_1.PdfDetail.MissingHeader));
     if (doc.headerOffset > 0)
         findings.push(factory.make(types_1.PdfCategory.Corrupted, types_1.PdfDetail.LeadingBytes, undefined, { bytes: doc.headerOffset }));
     if (doc.trailingBytes > 0)
@@ -180,6 +183,14 @@ async function analyzeInner(run, source, options, depth, deadline, verify) {
         findings.push(factory.make(types_1.PdfCategory.Corrupted, types_1.PdfDetail.MalformedObject, 'cross-reference table', { reason: '/XRefStm entries for objects the table marks free', count: issues.xrefStmOverFree }));
     if (issues.badObjStm.size)
         findings.push(factory.make(types_1.PdfCategory.Corrupted, types_1.PdfDetail.MalformedObject, 'object stream', { reason: 'a header pdf.js cannot follow', count: issues.badObjStm.size }));
+    if (issues.objStmType.size)
+        findings.push(factory.make(types_1.PdfCategory.Corrupted, types_1.PdfDetail.MalformedObject, 'object stream', { reason: 'a /Type other than /ObjStm', count: issues.objStmType.size }));
+    if (issues.directRoot)
+        findings.push(factory.make(types_1.PdfCategory.Corrupted, types_1.PdfDetail.MalformedObject, 'trailer', { reason: 'a catalog written in the trailer' }));
+    if (issues.directStreams.size)
+        findings.push(factory.make(types_1.PdfCategory.Corrupted, types_1.PdfDetail.MalformedObject, undefined, { reason: 'streams written inside other objects', count: issues.directStreams.size }));
+    if (issues.objStmStreams.size)
+        findings.push(factory.make(types_1.PdfCategory.Corrupted, types_1.PdfDetail.MalformedObject, 'object stream', { reason: 'streams stored in an object stream', count: issues.objStmStreams.size }));
     if (issues.refGen.size)
         findings.push(factory.make(types_1.PdfCategory.Corrupted, types_1.PdfDetail.MalformedObject, undefined, { reason: 'references whose generation does not match the object', count: issues.refGen.size }));
     if (issues.duplicateKeys.size)

package/dist/filters.js

@@ -484,6 +484,14 @@ function syncDecoder(name, parms) {
             return [new RunLengthDecoder()];
         case 'Crypt':
             return [];
+        case 'BrotliDecode': {
+            // PDFium applies a predictor named here and pdf.js ignores it, so a predicted stream reads two ways and is not
+            // decoded.
+            const predictor = parms?.get('Predictor') ?? null;
+            if (predictor !== null && predictor !== 1)
+                throw new UnsupportedFilterError('A predictor on BrotliDecode, which readers apply differently');
+            return [];
+        }
         default:
             return undefined;
     }
@@ -506,6 +514,11 @@ const SLICE = 4096;
  * context for Flate, and a few thousand nested stages overflow the stack, so a longer chain counts as unsupported.
  */
 const MAX_FILTERS = 32;
+/**
+ * Brotli decoders in one chain. Each can take a 16 MB window from a few hundred bytes of input, and the stages of a
+ * chain all run at once.
+ */
+const MAX_BROTLI = 1;
 /**
  * Where raw deflate data starts: after the zlib header when there is one. The Adler-32 trailer is then never
  * checked, as viewers do not check it.
@@ -541,20 +554,54 @@ async function* inflateChunks(input) {
             yield r.value;
         }
     }
-    const inflater = zlib.createInflateRaw({ finishFlush: zlib.constants.Z_SYNC_FLUSH });
-    const src = stream.Readable.from(rest());
-    src.on('error', e => inflater.destroy(e));
-    src.pipe(inflater);
+    // Truncated data ends quietly with everything decoded. Corrupt data throws: Node drops the output of the write that
+    // failed, so the bytes before the error are not all there.
+    yield* through(rest(), zlib.createInflateRaw({ finishFlush: zlib.constants.Z_SYNC_FLUSH }));
+}
+/** Pipes `input` through a zlib transform and yields its output. */
+async function* through(input, transform) {
+    const src = stream.Readable.from(input);
+    src.on('error', e => transform.destroy(e));
+    src.pipe(transform);
     try {
-        // Truncated data ends quietly with everything decoded. Corrupt data throws: Node drops the output of the write
-        // that failed, so the bytes before the error are not all there.
-        for await (const c of inflater)
+        for await (const c of transform)
             yield c;
     }
     finally {
         src.destroy();
-        inflater.destroy();
+        transform.destroy();
+    }
+}
+/**
+ * BrotliDecode: RFC 7932 data with no header. pdf.js decodes such a stream whole or not at all, so data that is
+ * truncated, corrupt or followed by more bytes throws here. Empty data decodes to nothing, as in pdf.js.
+ */
+async function* brotliChunks(input) {
+    const it = input[Symbol.asyncIterator]();
+    let first;
+    while (!first?.length) {
+        const r = await it.next();
+        if (r.done)
+            return;
+        first = r.value;
+    }
+    let fed = 0;
+    async function* rest(head) {
+        fed += head.length;
+        yield head;
+        for (;;) {
+            const r = await it.next();
+            if (r.done)
+                return;
+            fed += r.value.length;
+            yield r.value;
+        }
     }
+    const decoder = zlib.createBrotliDecompress();
+    yield* through(rest(first), decoder);
+    // Node stops reading at the end of the Brotli data and ignores what follows it.
+    if (decoder.bytesWritten < fed)
+        throw new Error('Data after the end of the Brotli stream');
 }
 /**
  * Decodes a stream chunk by chunk through its whole filter chain. No stage may produce more than `limit` bytes, and
@@ -589,12 +636,16 @@ async function* decodeChunks(input, dict, limit, checkTime) {
         (Array.isArray(f) ? p instanceof objects_1.PdfDict : Array.isArray(p) && p[0] instanceof objects_1.PdfDict)) {
         throw new UnsupportedFilterError('Filter entries that readers take in different ways');
     }
+    if (filters.filter(x => x.name === 'BrotliDecode').length > MAX_BROTLI)
+        throw new UnsupportedFilterError('More than one BrotliDecode in one chain');
     for (const { name, parms } of filters) {
         const decs = syncDecoder(name, parms);
         if (!decs)
             throw new UnsupportedFilterError(`Unsupported filter ${name}`);
         if (name === 'FlateDecode' || name === 'Fl')
             chain = counted(inflateChunks(chain));
+        else if (name === 'BrotliDecode')
+            chain = counted(brotliChunks(chain));
         for (const d of decs) {
             const upstream = chain;
             chain = counted((async function* () {

package/dist/findings.js

@@ -13,6 +13,8 @@ def(types_1.PdfCategory.Encrypted, types_1.PdfDetail.EmptyPassword, 'strip', 10,
 def(types_1.PdfCategory.Encrypted, types_1.PdfDetail.UserPassword, 'strip', 0, 'PDF decrypted with the supplied user password');
 def(types_1.PdfCategory.Encrypted, types_1.PdfDetail.OwnerPassword, 'strip', 0, 'PDF decrypted with the supplied owner password');
 def(types_1.PdfCategory.Encrypted, types_1.PdfDetail.PasswordRequired, 'reject', 0, 'PDF requires a password, and the one supplied did not open it');
+def(types_1.PdfCategory.Encrypted, types_1.PdfDetail.AttachmentsOnly, 'strip', 10, 'Only the attached files are encrypted, and the password supplied does not open them');
+def(types_1.PdfCategory.Encrypted, types_1.PdfDetail.NoKey, 'strip', 10, "Content encrypted with the attached files' key was removed, since the password supplied does not give that key");
 def(types_1.PdfCategory.Encrypted, types_1.PdfDetail.CertificateHandler, 'reject', 0, "PDF encrypted for specific recipients' certificates");
 def(types_1.PdfCategory.Encrypted, types_1.PdfDetail.UnknownHandler, 'reject', 0, 'PDF uses an unrecognized security handler');
 def(types_1.PdfCategory.Encrypted, types_1.PdfDetail.UnknownCryptFilter, 'reject', 0, 'PDF uses an unrecognized encryption filter');
@@ -30,6 +32,7 @@ def(types_1.PdfCategory.Corrupted, types_1.PdfDetail.MalformedObject, 'strip', 1
 def(types_1.PdfCategory.Corrupted, types_1.PdfDetail.StreamLengthWrong, 'strip', 10, "A stream's declared length is missing or wrong");
 def(types_1.PdfCategory.Corrupted, types_1.PdfDetail.LeadingBytes, 'strip', 5, 'Data before the PDF header');
 def(types_1.PdfCategory.Corrupted, types_1.PdfDetail.TrailingBytes, 'strip', 10, 'Data after the end of the PDF');
+def(types_1.PdfCategory.Corrupted, types_1.PdfDetail.MissingHeader, 'strip', 5, 'No PDF header at the start of the file');
 // JAVASCRIPT
 def(types_1.PdfCategory.JavaScript, types_1.PdfDetail.Document, 'strip', 70, 'Document-level JavaScript runs when the PDF opens');
 def(types_1.PdfCategory.JavaScript, types_1.PdfDetail.OpenAction, 'strip', 70, 'JavaScript runs when the PDF opens');

package/dist/io.d.ts

@@ -26,7 +26,7 @@ export declare class Reader {
     private readonly order;
     constructor(source: ByteSource, size: number, blockSize?: number, maxBlocks?: number);
     private block;
-    /** Reads up to `length` bytes at `offset`; shorter only at the end of the source. */
+    /** Reads up to `length` bytes at `offset`; shorter only at the end of the source, and empty outside it. */
     read(offset: number, length: number): Promise<Uint8Array>;
     /** Yields the range in chunks without caching them. */
     chunks(offset: number, length: number, chunkSize?: number): AsyncGenerator<Uint8Array>;

package/dist/io.js

@@ -44,11 +44,23 @@ const crypto = __importStar(require("node:crypto"));
 const fsp = __importStar(require("node:fs/promises"));
 const os = __importStar(require("node:os"));
 const path = __importStar(require("node:path"));
+/**
+ * The bytes [start, end) a read covers in a source of `size` bytes, or undefined when it covers none. Offsets read
+ * from a file can be negative or fractional, and such a read gets no bytes rather than bytes from somewhere else.
+ */
+function span(offset, length, size) {
+    if (!Number.isSafeInteger(offset) || offset < 0 || offset >= size || !(length >= 1))
+        return undefined;
+    return [offset, Math.min(size, offset + Math.floor(length))];
+}
 /** A source over bytes already in memory. Reads return views, not copies. */
 function bufferSource(bytes) {
     return {
         size: async () => bytes.length,
-        read: async (offset, length) => bytes.subarray(Math.max(0, offset), Math.min(bytes.length, offset + length)),
+        read: async (offset, length) => {
+            const s = span(offset, length, bytes.length);
+            return s ? bytes.subarray(s[0], s[1]) : new Uint8Array(0);
+        },
     };
 }
 /** A source over a local file, read at offsets through one file handle. */
@@ -68,8 +80,11 @@ function fileSource(filePath) {
         },
         async read(offset, length) {
             const h = await open();
-            const total = await this.size();
-            const n = Math.max(0, Math.min(length, total - offset));
+            // Node reads position -1 from the file's current position, so a negative offset never reaches it.
+            const s = span(offset, length, await this.size());
+            if (!s)
+                return Buffer.alloc(0);
+            const n = s[1] - offset;
             const buf = Buffer.allocUnsafe(n);
             let done = 0;
             while (done < n) {
@@ -208,11 +223,12 @@ class Reader {
         }
         return data;
     }
-    /** Reads up to `length` bytes at `offset`; shorter only at the end of the source. */
+    /** Reads up to `length` bytes at `offset`; shorter only at the end of the source, and empty outside it. */
     async read(offset, length) {
-        if (offset >= this.size || length <= 0)
+        const s = span(offset, length, this.size);
+        if (!s)
             return new Uint8Array(0);
-        const end = Math.min(this.size, offset + length);
+        const end = s[1];
         if (end - offset > this.blockSize * 4)
             return this.source.read(offset, end - offset);
         const first = Math.floor(offset / this.blockSize);
@@ -234,8 +250,11 @@ class Reader {
     }
     /** Yields the range in chunks without caching them. */
     async *chunks(offset, length, chunkSize = 262144) {
+        const s = span(offset, length, this.size);
+        if (!s)
+            return;
         let pos = offset;
-        const end = Math.min(this.size, offset + length);
+        const end = s[1];
         while (pos < end) {
             const n = Math.min(chunkSize, end - pos);
             const c = await this.source.read(pos, n);
@@ -292,8 +311,12 @@ class TempDir {
                 return size;
             }),
             read: (offset, length) => keep(async () => {
-                const b = await source.read(offset, length);
-                const want = size === undefined ? b.length : Math.max(0, Math.min(length, size - offset));
+                // A read outside the source is not passed on: a caller's source, such as a ranged S3 request, may fail on it.
+                const s = span(offset, length, size ?? Number.MAX_SAFE_INTEGER);
+                if (!s)
+                    return new Uint8Array(0);
+                const b = await source.read(offset, s[1] - offset);
+                const want = size === undefined ? b.length : s[1] - offset;
                 if (b.length !== want)
                     throw Object.assign(new Error(`The source returned ${b.length} bytes at offset ${offset} where ${want} were expected`), { code: 'EIO' });
                 return b;

package/dist/parser.d.ts

@@ -1,10 +1,53 @@
 import { type PdfObject, PdfRef } from './objects';
 export declare class ParseError extends Error {
 }
-/** Thrown when the window ended before the object did. The caller retries with more bytes. */
+/** The data ended inside an object. */
+export declare class EndOfData extends ParseError {
+}
+/**
+ * Thrown when the window ended before the object did. The caller retries with more bytes. `idle` says the window ended
+ * in a run of whitespace, and of comments when `comments` is set, that started at window position `from`, so the
+ * caller can skip the rest of the run in the source instead of holding it. `body` says it ended in the body of a stream
+ * written inside an object, and `line` before the end of the line after a "stream" keyword. The caller can find either
+ * end in the source.
+ */
 export declare class NeedMoreData extends Error {
+    readonly idle?: {
+        from: number;
+        comments: boolean;
+    } | undefined;
+    readonly body?: {
+        start: number;
+        declared?: number;
+    } | undefined;
+    readonly line?: {
+        from: number;
+    } | undefined;
+    constructor(idle?: {
+        from: number;
+        comments: boolean;
+    } | undefined, body?: {
+        start: number;
+        declared?: number;
+    } | undefined, line?: {
+        from: number;
+    } | undefined);
+}
+/** Thrown when a stream inside an object has a /Length the caller has not read yet. The caller reads it and retries. */
+export declare class NeedObject extends Error {
+    readonly ref: PdfRef;
+    constructor(ref: PdfRef);
 }
 export declare const isWhite: (c: number) => boolean;
+/**
+ * Where pdf.js ends a stream body it searches for: at "endstream", or at "endsteam" or "endstrea" before a space, tab,
+ * CR or LF, which it takes too. Returns the first such place in `b` from `from` on and the keyword's length. A
+ * misspelling whose next byte `b` does not hold is left for a longer window.
+ */
+export declare function endstreamIn(b: Uint8Array, from: number): {
+    at: number;
+    length: number;
+} | undefined;
 interface ParseHooks {
     /** Called when a name used #xx to encode a letter or digit. */
     onEscapedName?(name: string): void;
@@ -19,6 +62,35 @@ interface ParseHooks {
     /** Called every 65536 values, so a caller can stop a long parse at its deadline. */
     onProgress?(): void;
 }
+/** How to read a stream written inside an object, as pdf.js reads one, and the end of the line after "stream". */
+export interface DirectStreams {
+    /** Where window byte `pos` sits in the source. */
+    at(pos: number): number;
+    /** The value of an indirect /Length. Throws NeedObject when the caller has not read it yet. */
+    length(ref: PdfRef): number | undefined;
+    /**
+     * A body the caller found in the source, by where it starts there: its length, or null when no "endstream" follows.
+     * The window then holds one byte for the body and goes on after "endstream".
+     */
+    known(start: number): {
+        length: number;
+    } | null | undefined;
+    /**
+     * The line after a "stream" keyword that the caller read in the source, by where it starts there: whether it held
+     * more than spaces. The window then goes on where the body starts.
+     */
+    line(start: number): {
+        text: boolean;
+    } | undefined;
+}
+export interface ParseOptions {
+    /** Ends a dictionary or array that the end of the data cuts off, as pdf.js reads a trailer it recovers. */
+    recover?: boolean;
+    /** Reads a dictionary followed by "stream" anywhere inside an object as a stream. */
+    streams?: DirectStreams;
+    /** Reads the object itself as a stream in the same way, for an object stored in an object stream. */
+    topStream?: boolean;
+}
 /**
  * Parses PDF objects from a byte window. `eof` tells the parser whether the window ends at the end of the source,
  * so running off the end means NeedMoreData rather than a syntax error.
@@ -27,6 +99,7 @@ export declare class Parser {
     readonly buf: Uint8Array;
     readonly eof: boolean;
     readonly hooks: ParseHooks;
+    readonly options: ParseOptions;
     pos: number;
     depth: number;
     /** Estimated heap bytes of what this parser has built, with the length of every name and string. */
@@ -34,12 +107,21 @@ export declare class Parser {
     /** The part of `cost` that does not grow with the length of a name or string. */
     private overhead;
     private values;
-    constructor(buf: Uint8Array, pos?: number, eof?: boolean, hooks?: ParseHooks);
+    /** The part of `cost` that the dictionaries of streams written inside the object take. */
+    directCost: number;
+    constructor(buf: Uint8Array, pos?: number, eof?: boolean, hooks?: ParseHooks, options?: ParseOptions);
+    /** In recovery, whether nothing but whitespace and comments is left before the end of the data. */
+    private cutOff;
     /** Rough heap costs: a slot for a number or keyword, an object for a name or reference, a buffer for a string. */
     private charge;
     private more;
     peek(): number;
     skipWhitespace(): void;
+    /**
+     * Skips whitespace and comments, and says whether anything follows them. A window that ends first asks for more,
+     * unless it ends the data.
+     */
+    private skipToToken;
     /** Reads a regular-character token without consuming delimiters. */
     readToken(): string;
     matchKeyword(word: string): boolean;
@@ -55,9 +137,16 @@ export declare class Parser {
     /**
      * Skips junk inside a container instead of losing the whole object: an unknown bare keyword, or a delimiter that
      * cannot start an object, such as "]" in a dictionary or ">>" in an array. qpdf reads each of these as null. The
-     * container's own closing delimiter was checked before this is called.
+     * container's own closing delimiter was checked before this is called. Where a key belongs, pdf.js also skips a
+     * number, "R", "true", "false" or "null" one token at a time, and so does this.
      */
     private skipBadToken;
+    /**
+     * After a dictionary inside an object, reads the stream that follows it, if any, as pdf.js does: the body ends at
+     * /Length when "endstream" follows there, and at the first "endstream" otherwise. Returns undefined when no stream
+     * follows. The body stays in the source; the stream records where it is.
+     */
+    private directStream;
     /**
      * After a dictionary, checks for the "stream" keyword. Returns the position of the first body byte,
      * or -1 when the object is not a stream.