nodebb-plugin-pdf-secure 1.2.0 → 1.2.1

package/lib/controllers.js

@@ -5,6 +5,28 @@ const pdfHandler = require('./pdf-handler');
 
 const Controllers = module.exports;
 
+// XOR key for partial encryption (rotates through this pattern)
+const XOR_KEY = [0x5A, 0x3C, 0x7E, 0x1F, 0x9D, 0xB2, 0x4A, 0xE8];
+
+// Partial XOR - encrypts first 10KB and every 50th byte after that
+function partialXorEncode(buffer) {
+	const data = Buffer.from(buffer);
+	const keyLen = XOR_KEY.length;
+
+	// Encrypt first 10KB fully
+	const fullEncryptLen = Math.min(10240, data.length);
+	for (let i = 0; i < fullEncryptLen; i++) {
+		data[i] = data[i] ^ XOR_KEY[i % keyLen];
+	}
+
+	// Encrypt every 50th byte after that
+	for (let i = fullEncryptLen; i < data.length; i += 50) {
+		data[i] = data[i] ^ XOR_KEY[i % keyLen];
+	}
+
+	return data;
+}
+
 Controllers.renderAdminPage = function (req, res) {
 	res.render('admin/plugins/pdf-secure', {
 		title: 'PDF Secure Viewer',
@@ -34,14 +56,19 @@ Controllers.servePdfBinary = async function (req, res) {
 			pdfBuffer = await pdfHandler.getSinglePagePdf(data.file);
 		}
 
+		// Apply partial XOR encryption
+		const encodedBuffer = partialXorEncode(pdfBuffer);
+
 		res.set({
 			'Content-Type': 'application/octet-stream',
 			'Cache-Control': 'no-store, no-cache, must-revalidate, private',
 			'X-Content-Type-Options': 'nosniff',
 			'Content-Disposition': 'inline',
+			// Send XOR key as header for client decoding
+			'X-PDF-Key': Buffer.from(XOR_KEY).toString('base64'),
 		});
 
-		return res.send(pdfBuffer);
+		return res.send(encodedBuffer);
 	} catch (err) {
 		if (err.message === 'File not found') {
 			return res.status(404).json({ error: 'PDF not found' });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nodebb-plugin-pdf-secure",
-  "version": "1.2.0",
+  "version": "1.2.1",
   "description": "Secure PDF viewer plugin for NodeBB - prevents downloading, enables canvas-only rendering with Premium group support",
   "main": "library.js",
   "repository": {

package/static/viewer.html

@@ -1420,6 +1420,26 @@
             generateThumbnails();
         }
 
+        // Partial XOR decoder - must match backend encoding
+        function partialXorDecode(encodedData, keyBase64) {
+            const key = Uint8Array.from(atob(keyBase64), c => c.charCodeAt(0));
+            const data = new Uint8Array(encodedData);
+            const keyLen = key.length;
+
+            // Decrypt first 10KB fully
+            const fullDecryptLen = Math.min(10240, data.length);
+            for (let i = 0; i < fullDecryptLen; i++) {
+                data[i] = data[i] ^ key[i % keyLen];
+            }
+
+            // Decrypt every 50th byte after that
+            for (let i = fullDecryptLen; i < data.length; i += 50) {
+                data[i] = data[i] ^ key[i % keyLen];
+            }
+
+            return data.buffer;
+        }
+
         // Auto-load PDF if config is present (injected by NodeBB plugin)
         async function autoLoadSecurePDF() {
             if (!window.PDF_SECURE_CONFIG || !window.PDF_SECURE_CONFIG.filename) {
@@ -1457,7 +1477,7 @@
                 const nonceData = await nonceRes.json();
                 const nonce = nonceData.response.nonce;
 
-                // Step 2: Fetch PDF binary
+                // Step 2: Fetch encrypted PDF binary
                 const pdfUrl = config.relativePath + '/api/v3/plugins/pdf-secure/pdf-data?nonce=' + encodeURIComponent(nonce);
                 const pdfRes = await fetch(pdfUrl, { credentials: 'same-origin' });
 
@@ -1465,12 +1485,33 @@
                     throw new Error('PDF yüklenemedi (' + pdfRes.status + ')');
                 }
 
-                const pdfBuffer = await pdfRes.arrayBuffer();
-                console.log('[PDF-Secure] PDF loaded:', pdfBuffer.byteLength, 'bytes');
+                // Get XOR key from header
+                const xorKey = pdfRes.headers.get('X-PDF-Key');
+                const encodedBuffer = await pdfRes.arrayBuffer();
 
-                // Load into viewer
+                console.log('[PDF-Secure] Encrypted data received:', encodedBuffer.byteLength, 'bytes');
+
+                // Step 3: Decode XOR encrypted data
+                let pdfBuffer;
+                if (xorKey) {
+                    console.log('[PDF-Secure] Decoding XOR encrypted data...');
+                    pdfBuffer = partialXorDecode(encodedBuffer, xorKey);
+                } else {
+                    // Fallback for backward compatibility
+                    pdfBuffer = encodedBuffer;
+                }
+
+                console.log('[PDF-Secure] PDF decoded successfully');
+
+                // Step 4: Load into viewer
                 await loadPDFFromBuffer(pdfBuffer);
 
+                // Step 5: Security - clear references to prevent extraction
+                // Nullify the buffer after loading
+                pdfBuffer = null;
+
+                console.log('[PDF-Secure] Buffer references cleared');
+
             } catch (err) {
                 console.error('[PDF-Secure] Auto-load error:', err);
                 if (dropzone) {