@patrickdk77/pdf-defuse 0.1.2 → 0.2.0

package/dist/walker.js

@@ -307,6 +307,8 @@ class Walker {
     inlinePages = new Map();
     /** Objects first reached as file specifications, which stay file specifications whatever their content says. */
     fileRole = new Set();
+    /** Page content streams, which pdf.js draws whatever their /Type says. */
+    contentRole = new Set();
     /** Objects listed in /Annots and kept there though they are not annotations, which get the annotation rules. */
     annotRole = new Set();
     /** Objects that only removed content refers to, which are not unreferenced. */
@@ -829,6 +831,11 @@ class Walker {
                 if (slot)
                     this.inlinePages.set(slot, { index, box });
             }
+            const contents = own?.get('Contents');
+            const parts = contents instanceof objects_1.PdfRef ? await this.doc.getObject(contents) : contents;
+            for (const c of Array.isArray(parts) ? parts : [contents])
+                if (c instanceof objects_1.PdfRef)
+                    this.contentRole.add(c.num);
             // Many pages can share one /Annots array, or inherit one. Each array is keyed by the owner and path the walk
             // reaches it at: the last reference that leads to it, or the dictionary that holds it.
             const annots = await read('Annots');
@@ -1057,7 +1064,8 @@ class Walker {
                 this.strippedMeta.has(num) ||
                 filterRefs.has(num) ||
                 doc.encryptRefs.has(num) ||
-                doc.encryptRef?.num === num)
+                doc.encryptRef?.num === num ||
+                doc.issues.objStmType.has(num))
                 continue;
             doc.checkTime();
             let obj;
@@ -1122,7 +1130,8 @@ class Walker {
                         if (!(x instanceof objects_1.PdfRef))
                             continue;
                         const s = await this.doc.getObject(x);
-                        if (s instanceof objects_1.PdfStream && classify(s) !== 'structural')
+                        // A stream that cannot be decrypted is not written, so it adds nothing.
+                        if (s instanceof objects_1.PdfStream && classify(s) !== 'structural' && this.doc.canDecrypt(s, x.num))
                             total += await this.doc.plainLength(s, x.num);
                     }
                     if (arrayNum !== undefined)
@@ -1181,8 +1190,18 @@ class Walker {
             const info = d;
             if (special === 'info' && ['Author', 'Creator', 'Producer', 'Title', 'Subject', 'Keywords'].some(k => info.has(k)) && this.aggregate(types_1.PdfCategory.Metadata, types_1.PdfDetail.InfoDictionary).action === 'strip')
                 return undefined;
-            // A stream decided as a contained file stays one, whether or not it says /Type /EmbeddedFile.
-            const kind = obj instanceof objects_1.PdfStream && this.fileDecisions.has(num) ? 'efStream' : this.kindOf(obj, num, await this.actionType(d));
+            // A stream decided as a contained file stays one, whether or not it says /Type /EmbeddedFile, unless it is a page's
+            // content: only the reference that made it a contained file goes then.
+            let kind = obj instanceof objects_1.PdfStream && this.fileDecisions.has(num) ? 'efStream' : this.kindOf(obj, num, await this.actionType(d));
+            if (kind === 'efStream' && this.contentRole.has(num))
+                kind = 'generic';
+            // Nothing reads a stream encrypted with a key the password does not give, and pdf.js draws a page without it.
+            // An attached file reports its own removal.
+            if (obj instanceof objects_1.PdfStream && kind !== 'efStream' && kind !== 'structural' && !this.doc.canDecrypt(obj, num)) {
+                if (this.phase === 'A' && !ctx.shadow)
+                    this.emitRemoval(types_1.PdfCategory.Encrypted, types_1.PdfDetail.NoKey, ctx.location);
+                return undefined;
+            }
             switch (kind) {
                 case 'structural':
                     this.doc.issues.structuralRefs++;
@@ -1509,7 +1528,8 @@ class Walker {
         for (const [k, v] of d.entries()) {
             const p = `${path}/${k}`;
             taken.add(k);
-            if (k === 'Annots') {
+            // A null /Annots or /Contents is the same as none. The writer puts null where a reference led to no object.
+            if (k === 'Annots' && v !== null) {
                 let x;
                 if (Array.isArray(v))
                     x = await this.handleAnnotsArray(v, pctx, owner, p);
@@ -1534,7 +1554,7 @@ class Walker {
                 if (x !== undefined)
                     out.set(k, x);
             }
-            else if (k === 'Contents' && !node && !(v instanceof objects_1.PdfRef) && !Array.isArray(v)) {
+            else if (k === 'Contents' && !node && v !== null && !(v instanceof objects_1.PdfRef) && !Array.isArray(v)) {
                 const f = this.emit(types_1.PdfCategory.Corrupted, types_1.PdfDetail.MalformedObject, `${pctx.location} content`);
                 if (f.action !== 'strip') {
                     const x = await this.tv(v, pctx, owner, p);
@@ -1884,7 +1904,7 @@ class Walker {
         // Only the first 4096 characters of a label are read. Many links can share one chain and one label, so the
         // outcome is kept per chain object and label.
         const labels = shownLabels.map(t => t?.slice(0, 4096));
-        const key = v instanceof objects_1.PdfRef ? `${v.num}:${(0, node_crypto_1.createHash)('md5').update(JSON.stringify(labels)).digest('hex')}` : undefined;
+        const key = v instanceof objects_1.PdfRef ? `${v.num}:${(0, node_crypto_1.createHash)('sha256').update(JSON.stringify(labels)).digest('hex')}` : undefined;
         let found = key === undefined ? undefined : this.labelChecks.get(key);
         if (found === undefined) {
             found = null;
@@ -2614,12 +2634,17 @@ class Walker {
         const record = (keep, replacement) => {
             this.fileDecisions.set(ref.num, { keep, replacement, types });
             // A stream something else reached first and kept goes too.
-            if (!keep && this.visited.has(ref.num))
+            if (!keep && this.visited.has(ref.num) && !this.contentRole.has(ref.num))
                 this.dropped.add(ref.num);
             return keep;
         };
         if (ctx.shadow)
             return false;
+        // No plugin can read a file whose key the password did not give, so it goes whatever the overrides say.
+        if (!this.doc.canDecrypt(st, ref.num)) {
+            this.emitRemoval(types_1.PdfCategory.EmbeddedFile, types_1.PdfDetail.NoPlugin, loc, { name: name ?? '', reason: 'encrypted' });
+            return record(false);
+        }
         const threshold = this.options.memoryThreshold ?? 8 * 1024 * 1024;
         // The first bytes alone stay in memory, however low the threshold.
         const decoded = new io_1.SpillSink(this.cfg.temp, whole ? threshold : Number.POSITIVE_INFINITY);
@@ -2901,6 +2926,7 @@ class Walker {
         this.chainSites.clear();
         this.scriptFree.clear();
         this.fileRole.clear();
+        this.contentRole.clear();
         this.inlinePages.clear();
         return this.doc.release();
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@patrickdk77/pdf-defuse",
-  "version": "0.1.2",
+  "version": "0.2.0",
   "description": "Sanitize and clean PDF files. Detects and removes JavaScript, attached files, launch actions, unsafe links and empty-password encryption, scores the risk, and writes a disarmed copy with bounded memory and no runtime dependencies.",
   "license": "MIT",
   "author": "patrickdk77",
@@ -25,7 +25,7 @@
     "LICENSE"
   ],
   "engines": {
-    "node": ">=22.0.0"
+    "node": ">=18.0.0"
   },
   "scripts": {
     "clean": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true});require('fs').rmSync('build-test',{recursive:true,force:true})\"",
@@ -74,7 +74,7 @@
     "@cantoo/pdf-lib": "^2.11.1",
     "@types/chai": "^5.2.3",
     "@types/mocha": "^10.0.10",
-    "@types/node": "^22.20.5",
+    "@types/node": "^18.19.130",
     "chai": "^6.3.0",
     "husky": "^9.1.7",
     "lint-staged": "^17.6.0",