@reekon-tools/react-native-pdf-canvas 0.1.0 → 0.2.0

package/android/src/androidTest/java/tools/reekon/pdfcanvas/PdfCanvasPoisonGuardTest.java

@@ -1,98 +0,0 @@
-package tools.reekon.pdfcanvas;
-
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
-
-import android.content.Context;
-import android.os.Build;
-import android.util.Log;
-
-import androidx.test.ext.junit.runners.AndroidJUnit4;
-import androidx.test.platform.app.InstrumentationRegistry;
-
-import org.junit.Test;
-import org.junit.runner.RunWith;
-
-import java.io.File;
-
-/**
- * The end-to-end proof of the poison guard: BREAK the platform for real, then
- * show that the backend refuses instead of segfaulting.
- *
- * EXCLUDED from `connectedDebugAndroidTest` by the `notAnnotation` filter in
- * `android/build.gradle`, because on API 24 it leaves PDFium unusable for the
- * rest of the process and every test scheduled after it would die. Run it alone:
- *
- * <pre>
- *   ./gradlew installDebugAndroidTest
- *   adb -s &lt;device&gt; shell am instrument -w \
- *     -e class tools.reekon.pdfcanvas.PdfCanvasPoisonGuardTest \
- *     -e annotation tools.reekon.pdfcanvas.PoisonsTheProcess \
- *     tools.reekon.pdfcanvas.test/androidx.test.runner.AndroidJUnitRunner
- * </pre>
- *
- * The fixture is a file with a real {@code %PDF-} header and unparseable
- * contents — a truncated download, in other words. Preflight cannot reject it,
- * which is the point: it is precisely the residue preflight leaves behind, and
- * therefore the only case the latch has to handle.
- */
-@RunWith(AndroidJUnit4.class)
-public class PdfCanvasPoisonGuardTest {
-
-  private static final String TAG = "PDFCANVAS";
-
-  private static Context ctx() {
-    return InstrumentationRegistry.getInstrumentation().getTargetContext();
-  }
-
-  @Test
-  @PoisonsTheProcess
-  public void aFileThatPreflightCannotJudgeIsHandledWithoutCrashing() throws Exception {
-    File garbage = TestPdfs.headerOnlyGarbage(ctx(), "poison-header-only.pdf");
-    File good = TestPdfs.pattern(ctx(), "poison-good.pdf", 100, 100);
-
-    PdfPlatformQuirks.setPdfiumPoisonedForTesting(false);
-
-    // Opening it must fail as CORRUPT — preflight let it through, PdfRenderer
-    // rejected it.
-    try {
-      PdfCanvasRasterizer.openFile(garbage, null, 1).close();
-      fail("header-only garbage should not have opened");
-    } catch (PdfRasterException e) {
-      assertEquals(PdfErrorCode.CORRUPT, e.code());
-    }
-
-    boolean poisoned = PdfPlatformQuirks.isPdfiumPoisoned();
-    Log.i(TAG, "poison-guard: API " + Build.VERSION.SDK_INT + " latched=" + poisoned);
-    assertEquals(
-        "the latch should have been set exactly on the platforms treated as affected",
-        PdfPlatformQuirks.failedNativeOpenIsPoisonous(),
-        poisoned);
-
-    // Force the collection that actually corrupts PDFium's reference count. On
-    // an unguarded build, the next open is the SIGSEGV.
-    for (int i = 0; i < 3; i++) {
-      System.gc();
-      System.runFinalization();
-      Thread.sleep(150);
-    }
-
-    if (poisoned) {
-      try {
-        PdfCanvasRasterizer.openFile(good, null, 1).close();
-        fail("a poisoned process must refuse rather than segfault");
-      } catch (PdfRasterException e) {
-        assertEquals(PdfErrorCode.BACKEND_FAILURE, e.code());
-        assertTrue(e.getMessage(), e.getMessage().contains("PDFium"));
-      }
-      Log.i(TAG, "poison-guard: refused after real poisoning, process alive");
-    } else {
-      // Unaffected platform: opening must still work after the collection.
-      PdfCanvasRasterizer r = PdfCanvasRasterizer.openFile(good, null, 1);
-      assertEquals(1, r.pageCount());
-      r.close();
-      Log.i(TAG, "poison-guard: platform unaffected, opened normally after GC");
-    }
-  }
-}

package/android/src/androidTest/java/tools/reekon/pdfcanvas/PdfCanvasQuirksTest.java

@@ -1,324 +0,0 @@
-package tools.reekon.pdfcanvas;
-
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNotEquals;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
-
-import android.content.Context;
-import android.os.Build;
-import android.util.Log;
-
-import androidx.test.ext.junit.runners.AndroidJUnit4;
-import androidx.test.platform.app.InstrumentationRegistry;
-
-import org.junit.Test;
-import org.junit.runner.RunWith;
-
-import java.io.File;
-
-/**
- * The two measured platform quirks, and the guards built for them.
- *
- * These tests are the reason the guards are not superstition. Each one either
- * asserts a fact measured on a device in this suite's own run, or asserts that
- * the guard reports that fact truthfully.
- */
-@RunWith(AndroidJUnit4.class)
-public class PdfCanvasQuirksTest {
-
-  private static final String TAG = "PDFCANVAS";
-
-  private static Context ctx() {
-    return InstrumentationRegistry.getInstrumentation().getTargetContext();
-  }
-
-  /**
-   * THE test that justifies {@link PdfPreflight} existing.
-   *
-   * CATCHES: a bad file reaching {@code new PdfRenderer(...)}. On API 24 that
-   * constructor throwing is a delayed SIGSEGV for the whole process, so
-   * "produces the right error code" is not enough — the file must be turned away
-   * before the platform class sees it, and the observable proof is that the
-   * poison latch is still clear afterwards.
-   *
-   * A backend that dropped preflight would still return the same three codes
-   * here, and would still pass every assertion in PdfCanvasFailureTest. Only the
-   * latch assertion notices.
-   */
-  @Test
-  public void preflightTurnsBadFilesAwayBeforePdfRendererSeesThem() throws Exception {
-    PdfPlatformQuirks.setPdfiumPoisonedForTesting(false);
-
-    assertEquals(PdfErrorCode.CORRUPT, openCode(TestPdfs.notAPdf(ctx(), "q-notes.txt")));
-    assertFalse("a non-PDF reached PdfRenderer", PdfPlatformQuirks.isPdfiumPoisoned());
-
-    assertEquals(PdfErrorCode.CORRUPT, openCode(TestPdfs.empty(ctx(), "q-empty.pdf")));
-    assertFalse("an empty file reached PdfRenderer", PdfPlatformQuirks.isPdfiumPoisoned());
-
-    assertEquals(
-        PdfErrorCode.PASSWORD_REQUIRED, openCode(TestPdfs.encrypted(ctx(), "q-locked.pdf")));
-    assertFalse("an encrypted file reached PdfRenderer", PdfPlatformQuirks.isPdfiumPoisoned());
-
-    Log.i(TAG, "preflight: three bad files rejected, latch still clear on API "
-        + Build.VERSION.SDK_INT);
-  }
-
-  /**
-   * CATCHES: a preflight that never looks at the trailer of a MID-SIZED file.
-   *
-   * Preflight reads a 32 KB head and a 256 KB tail. Every other fixture in this
-   * suite is a few hundred bytes, so the head covers them end to end and the
-   * tail branch is never exercised at all — which is how
-   * {@code tailStart < head.length} survived: for any length between the two
-   * windows {@code tailStart} is 0, the tail is dropped as "already covered",
-   * and everything past 32 KB — INCLUDING THE TRAILER AND ITS /Encrypt
-   * REFERENCE — is never read. A 60 KB encrypted drawing is an ordinary
-   * document, and on API 24 it then reaches {@code new PdfRenderer(...)} and
-   * poisons PDFium for the session.
-   *
-   * The discriminator is the CAUSE, not the code. Both preflight and the
-   * {@code SecurityException} path in {@link PdfRendererPool} report
-   * {@code password-required} with the same user-facing sentence, deliberately
-   * — so the code alone cannot say which one answered. Preflight throws from the
-   * bytes and has no cause; the platform path always wraps the
-   * {@code SecurityException} it caught. A null cause therefore means the file
-   * was turned away BEFORE PdfRenderer saw it, which is the whole claim, and it
-   * is observable on every API level rather than only on the one where the latch
-   * arms.
-   */
-  @Test
-  public void preflightFindsTheEncryptTrailerBeyondTheHeadWindow() throws Exception {
-    PdfPlatformQuirks.setPdfiumPoisonedForTesting(false);
-
-    File pdf = TestPdfs.encrypted(ctx(), "q-locked-60k.pdf", 60 * 1024);
-    long length = pdf.length();
-    Log.i(TAG, "preflight tail scan: fixture is " + length + " bytes");
-    assertTrue(
-        "the fixture must land between the 32 KB head and the 256 KB tail window, "
-            + "which is the band the bug covered: " + length,
-        length > 32 * 1024 && length < 256 * 1024);
-
-    try {
-      PdfCanvasRasterizer.openFile(pdf, null, 1).close();
-      fail("a " + length + "-byte encrypted document should have been refused");
-    } catch (PdfRasterException e) {
-      assertEquals(PdfErrorCode.PASSWORD_REQUIRED, e.code());
-      assertNull(
-          "preflight must have answered from the bytes; a cause means the file "
-              + "reached PdfRenderer and the SecurityException path answered instead: "
-              + e.getCause(),
-          e.getCause());
-    }
-    assertFalse(
-        "a " + length + "-byte encrypted file reached PdfRenderer",
-        PdfPlatformQuirks.isPdfiumPoisoned());
-  }
-
-  /**
-   * CATCHES: a preflight so eager it refuses good documents.
-   *
-   * The encryption test looks for {@code /Encrypt} followed by an indirect
-   * reference precisely so that the string appearing in page CONTENT does not
-   * trip it. This fixture puts that string in an uncompressed content stream,
-   * where a naive substring search finds it.
-   */
-  @Test
-  public void preflightDoesNotMistakeContentForEncryption() throws Exception {
-    File pdf = TestPdfs.withLiteralEncryptInContent(ctx(), "q-decoy.pdf");
-    PdfCanvasRasterizer r = PdfCanvasRasterizer.openFile(pdf, null, 1);
-    try {
-      assertEquals(1, r.pageCount());
-      RasterPixels px = r.render(
-          new RasterRequest(0, 0f, 0f, 200f, 200f, 1f, false, RasterRequest.BACKGROUND_WHITE),
-          null);
-      assertTrue(
-          "the decoy document should render normally",
-          PdfCanvasRasterizerTest.isRed(PdfCanvasRasterizerTest.rgba(px, 100, 100)));
-    } finally {
-      r.close();
-    }
-  }
-
-  /**
-   * CATCHES: a latch that is set but never consulted, and one that cannot be
-   * distinguished from an ordinary backend failure.
-   *
-   * The real poisoning is not triggered here — doing so would take the rest of
-   * the run down with it, which is the whole point of the bug. See
-   * {@code PdfCanvasPoisonGuardTest}, which does trigger it and is excluded from
-   * the default run for exactly that reason.
-   */
-  @Test
-  public void poisonLatchRefusesInsteadOfOpening() throws Exception {
-    File good = TestPdfs.pattern(ctx(), "q-good.pdf", 100, 100);
-    try {
-      PdfPlatformQuirks.setPdfiumPoisonedForTesting(true);
-      try {
-        PdfCanvasRasterizer.openFile(good, null, 1).close();
-        fail("a poisoned process must refuse to open a document");
-      } catch (PdfRasterException e) {
-        assertEquals(PdfErrorCode.BACKEND_FAILURE, e.code());
-        assertTrue(
-            "the message must name the cause, not just fail: " + e.getMessage(),
-            e.getMessage().contains("PDFium") && e.getMessage().contains("Restarting"));
-      }
-    } finally {
-      PdfPlatformQuirks.setPdfiumPoisonedForTesting(false);
-    }
-    // And the guard lifts cleanly, so a stuck latch is caught too.
-    PdfCanvasRasterizer.openFile(good, null, 1).close();
-  }
-
-  /**
-   * The MEASUREMENTS, written down as literals, and the guard checked against
-   * them.
-   *
-   * CATCHES: the poison bound drifting away from what was measured.
-   *
-   * The previous version of this test could not: it compared
-   * {@code failedNativeOpenIsPoisonous()} — whose entire body is
-   * {@code SDK_INT < LOWEST_SDK_MEASURED_SAFE_AFTER_FAILED_OPEN} — against
-   * {@code SDK_INT < LOWEST_SDK_MEASURED_SAFE_AFTER_FAILED_OPEN}. Both sides
-   * move with the constant, so editing it from 31 to 25 (which would silently
-   * declare five never-tested API levels safe from a process-killing bug) left
-   * every assertion green. A test whose two sides are the same expression is
-   * asserting that {@code ==} works.
-   *
-   * So the expected values are LITERALS here, taken from the measurement in
-   * {@link PdfPreflight}'s class comment: API 24 died after one failed
-   * construction plus a collection, API 31 and 33 survived twelve. The bound is
-   * the lowest level measured GOOD — 31 — deliberately rather than one above the
-   * level measured bad, because 25 to 30 were never tested and treating untested
-   * territory as safe is how a SIGSEGV ships. Changing either the constant or
-   * the rule now requires changing this test, which is the point: the edit
-   * becomes visible in review instead of silent.
-   */
-  @Test
-  public void poisonBoundMatchesWhatWasMeasured() {
-    assertEquals(
-        "the bound must stay at the lowest API level MEASURED to survive a failed "
-            + "PdfRenderer construction. 24 was measured to die; 31 and 33 survived. "
-            + "25-30 were never tested and are deliberately treated as affected.",
-        31,
-        PdfPlatformQuirks.LOWEST_SDK_MEASURED_SAFE_AFTER_FAILED_OPEN);
-
-    boolean poisonous = PdfPlatformQuirks.failedNativeOpenIsPoisonous();
-    Log.i(TAG, "quirk: API " + Build.VERSION.SDK_INT + " failedNativeOpenIsPoisonous="
-        + poisonous);
-
-    Boolean measured = measuredPoisonous(Build.VERSION.SDK_INT);
-    if (measured == null) {
-      // Not one of the levels this suite has ever run against, so there is no
-      // measurement to check the guard against. Say so rather than inventing a
-      // rule and asserting the code against itself again.
-      Log.i(TAG, "quirk: API " + Build.VERSION.SDK_INT + " was never measured; the "
-          + "verdict is derived from the bound and is not pinned here");
-      return;
-    }
-    assertEquals(
-        "API " + Build.VERSION.SDK_INT + " was MEASURED as "
-            + (measured ? "poisonous" : "safe") + " after a failed open",
-        measured.booleanValue(),
-        poisonous);
-  }
-
-  /**
-   * @return what a failed {@code PdfRenderer} construction was OBSERVED to do on
-   *     this API level, or null for a level that was never put on a device. See
-   *     the transcript in {@link PdfPreflight}'s class comment.
-   */
-  private static Boolean measuredPoisonous(int sdkInt) {
-    switch (sdkInt) {
-      case 24:
-        // SIGSEGV in CPDF_Document after one failed open plus System.gc().
-        return Boolean.TRUE;
-      case 31:
-      case 33:
-        // SURVIVED 12 failed opens plus forced collections.
-        return Boolean.FALSE;
-      default:
-        return null;
-    }
-  }
-
-  /**
-   * CATCHES: a rotation probe that is really a version check in disguise, or one
-   * that reports UNKNOWN because it silently failed.
-   *
-   * The probe builds its own /Rotate 90 document and looks at where the ink
-   * landed, so its answer is about the device rather than about
-   * {@code Build.VERSION}. Asserting it is never UNKNOWN is what catches a probe
-   * whose scratch write, parse or render failed — that failure mode is otherwise
-   * indistinguishable from a genuinely unknown platform.
-   */
-  @Test
-  public void rotationProbeAnswersAndCaches() {
-    PdfPlatformQuirks.resetRotationSupportForTesting();
-    PdfPlatformQuirks.RotationSupport first =
-        PdfPlatformQuirks.rotationSupport(ctx().getCacheDir());
-    PdfPlatformQuirks.RotationSupport second =
-        PdfPlatformQuirks.rotationSupport(ctx().getCacheDir());
-    Log.i(TAG, "quirk: API " + Build.VERSION.SDK_INT + " rotationSupport=" + first);
-
-    assertNotEquals(
-        "the probe should have reached a verdict, not failed silently",
-        PdfPlatformQuirks.RotationSupport.UNKNOWN,
-        first);
-    assertEquals("the verdict must be cached, not re-probed differently", first, second);
-
-    // The probe file must not be left behind in the cache directory.
-    assertFalse(
-        new File(ctx().getCacheDir(), "pdfcanvas-rotation-probe.pdf").exists());
-  }
-
-  /**
-   * CATCHES: the rotation probe constructing a {@code PdfRenderer} on a process
-   * whose PDFium is already poisoned.
-   *
-   * The probe was the ONE construction site that neither consulted the latch nor
-   * armed it — it built a renderer inside a bare
-   * {@code catch (Throwable) { return UNKNOWN; }}, so on an affected build it
-   * was a segfault waiting for whichever screen asked about rotation first, and
-   * a throw there was swallowed rather than latched. Refusing to probe is the
-   * right answer because UNKNOWN is already a value callers must handle: the
-   * enum's own comment says it is treated as unsupported.
-   *
-   * Asserting UNKNOWN is what makes this observable from outside. A probe that
-   * ignored the latch would return SUPPORTED on API 31/33 and UNSUPPORTED on
-   * API 24, so no single wrong constant passes on all three.
-   */
-  @Test
-  public void theRotationProbeRefusesToRunOnAPoisonedProcess() {
-    PdfPlatformQuirks.resetRotationSupportForTesting();
-    try {
-      PdfPlatformQuirks.setPdfiumPoisonedForTesting(true);
-      assertEquals(
-          "a poisoned process must not construct a PdfRenderer to answer a "
-              + "rotation question",
-          PdfPlatformQuirks.RotationSupport.UNKNOWN,
-          PdfPlatformQuirks.rotationSupport(ctx().getCacheDir()));
-    } finally {
-      PdfPlatformQuirks.setPdfiumPoisonedForTesting(false);
-      // The UNKNOWN above is now CACHED, and every other test that asks about
-      // rotation would inherit it. Drop it so the next caller probes for real.
-      PdfPlatformQuirks.resetRotationSupportForTesting();
-    }
-
-    // And the guard lifts: with the latch clear the probe reaches a real verdict.
-    assertNotEquals(
-        PdfPlatformQuirks.RotationSupport.UNKNOWN,
-        PdfPlatformQuirks.rotationSupport(ctx().getCacheDir()));
-  }
-
-  private static PdfErrorCode openCode(File file) {
-    try {
-      PdfCanvasRasterizer.openFile(file, null, 1).close();
-      return null;
-    } catch (PdfRasterException e) {
-      return e.code();
-    }
-  }
-}