nodebb-plugin-pdf-secure 1.2.0 → 1.2.2

package/lib/controllers.js

@@ -5,6 +5,28 @@ const pdfHandler = require('./pdf-handler');
 
 const Controllers = module.exports;
 
+// XOR key for partial encryption (rotates through this pattern)
+const XOR_KEY = [0x5A, 0x3C, 0x7E, 0x1F, 0x9D, 0xB2, 0x4A, 0xE8];
+
+// Partial XOR - encrypts first 10KB and every 50th byte after that
+function partialXorEncode(buffer) {
+	const data = Buffer.from(buffer);
+	const keyLen = XOR_KEY.length;
+
+	// Encrypt first 10KB fully
+	const fullEncryptLen = Math.min(10240, data.length);
+	for (let i = 0; i < fullEncryptLen; i++) {
+		data[i] = data[i] ^ XOR_KEY[i % keyLen];
+	}
+
+	// Encrypt every 50th byte after that
+	for (let i = fullEncryptLen; i < data.length; i += 50) {
+		data[i] = data[i] ^ XOR_KEY[i % keyLen];
+	}
+
+	return data;
+}
+
 Controllers.renderAdminPage = function (req, res) {
 	res.render('admin/plugins/pdf-secure', {
 		title: 'PDF Secure Viewer',
@@ -34,14 +56,19 @@ Controllers.servePdfBinary = async function (req, res) {
 			pdfBuffer = await pdfHandler.getSinglePagePdf(data.file);
 		}
 
+		// Apply partial XOR encryption
+		const encodedBuffer = partialXorEncode(pdfBuffer);
+
 		res.set({
 			'Content-Type': 'application/octet-stream',
 			'Cache-Control': 'no-store, no-cache, must-revalidate, private',
 			'X-Content-Type-Options': 'nosniff',
 			'Content-Disposition': 'inline',
+			// Send XOR key as header for client decoding
+			'X-PDF-Key': Buffer.from(XOR_KEY).toString('base64'),
 		});
 
-		return res.send(pdfBuffer);
+		return res.send(encodedBuffer);
 	} catch (err) {
 		if (err.message === 'File not found') {
 			return res.status(404).json({ error: 'PDF not found' });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nodebb-plugin-pdf-secure",
-  "version": "1.2.0",
+  "version": "1.2.2",
   "description": "Secure PDF viewer plugin for NodeBB - prevents downloading, enables canvas-only rendering with Premium group support",
   "main": "library.js",
   "repository": {

package/static/viewer.html

@@ -1420,6 +1420,26 @@
             generateThumbnails();
         }
 
+        // Partial XOR decoder - must match backend encoding
+        function partialXorDecode(encodedData, keyBase64) {
+            const key = Uint8Array.from(atob(keyBase64), c => c.charCodeAt(0));
+            const data = new Uint8Array(encodedData);
+            const keyLen = key.length;
+
+            // Decrypt first 10KB fully
+            const fullDecryptLen = Math.min(10240, data.length);
+            for (let i = 0; i < fullDecryptLen; i++) {
+                data[i] = data[i] ^ key[i % keyLen];
+            }
+
+            // Decrypt every 50th byte after that
+            for (let i = fullDecryptLen; i < data.length; i += 50) {
+                data[i] = data[i] ^ key[i % keyLen];
+            }
+
+            return data.buffer;
+        }
+
         // Auto-load PDF if config is present (injected by NodeBB plugin)
         async function autoLoadSecurePDF() {
             if (!window.PDF_SECURE_CONFIG || !window.PDF_SECURE_CONFIG.filename) {
@@ -1457,7 +1477,7 @@
                 const nonceData = await nonceRes.json();
                 const nonce = nonceData.response.nonce;
 
-                // Step 2: Fetch PDF binary
+                // Step 2: Fetch encrypted PDF binary
                 const pdfUrl = config.relativePath + '/api/v3/plugins/pdf-secure/pdf-data?nonce=' + encodeURIComponent(nonce);
                 const pdfRes = await fetch(pdfUrl, { credentials: 'same-origin' });
 
@@ -1465,12 +1485,33 @@
                     throw new Error('PDF yüklenemedi (' + pdfRes.status + ')');
                 }
 
-                const pdfBuffer = await pdfRes.arrayBuffer();
-                console.log('[PDF-Secure] PDF loaded:', pdfBuffer.byteLength, 'bytes');
+                // Get XOR key from header
+                const xorKey = pdfRes.headers.get('X-PDF-Key');
+                const encodedBuffer = await pdfRes.arrayBuffer();
+
+                console.log('[PDF-Secure] Encrypted data received:', encodedBuffer.byteLength, 'bytes');
+
+                // Step 3: Decode XOR encrypted data
+                let pdfBuffer;
+                if (xorKey) {
+                    console.log('[PDF-Secure] Decoding XOR encrypted data...');
+                    pdfBuffer = partialXorDecode(encodedBuffer, xorKey);
+                } else {
+                    // Fallback for backward compatibility
+                    pdfBuffer = encodedBuffer;
+                }
+
+                console.log('[PDF-Secure] PDF decoded successfully');
 
-                // Load into viewer
+                // Step 4: Load into viewer
                 await loadPDFFromBuffer(pdfBuffer);
 
+                // Step 5: Security - clear references to prevent extraction
+                // Nullify the buffer after loading
+                pdfBuffer = null;
+
+                console.log('[PDF-Secure] Buffer references cleared');
+
             } catch (err) {
                 console.error('[PDF-Secure] Auto-load error:', err);
                 if (dropzone) {
@@ -3102,14 +3143,10 @@
                 }
             }, true);
 
-            // 2. Block context menu (right-click)
+            // 2. Block context menu (right-click) - EVERYWHERE
             document.addEventListener('contextmenu', function (e) {
-                // Allow our custom context menu for annotations
-                if (e.target.closest('.annotationLayer') || e.target.closest('.pdfViewer')) {
-                    // Keep custom context menu behavior
-                    return;
-                }
                 e.preventDefault();
+                e.stopPropagation();
                 return false;
             }, true);
 
@@ -3131,41 +3168,14 @@
                 return false;
             }, true);
 
-            // 5. DevTools detection (basic)
-            let devToolsOpen = false;
-            const threshold = 160;
-
-            function checkDevTools() {
-                const widthThreshold = window.outerWidth - window.innerWidth > threshold;
-                const heightThreshold = window.outerHeight - window.innerHeight > threshold;
-
-                if (widthThreshold || heightThreshold) {
-                    if (!devToolsOpen) {
-                        devToolsOpen = true;
-                        console.log('[Security] DevTools detected');
-                        // Optional: blur content when devtools open
-                        document.body.classList.add('devtools-open');
-                    }
-                } else {
-                    if (devToolsOpen) {
-                        devToolsOpen = false;
-                        document.body.classList.remove('devtools-open');
-                    }
-                }
-            }
-
-            // Check periodically
-            setInterval(checkDevTools, 1000);
-            window.addEventListener('resize', checkDevTools);
-
-            // 6. Block Print via window.print override
+            // 5. Block Print via window.print override
             window.print = function () {
                 console.log('[Security] Print function blocked');
                 alert('Yazdırma bu belgede engellenmiştir.');
                 return false;
             };
 
-            // 7. Disable beforeprint event
+            // 6. Disable beforeprint event
             window.addEventListener('beforeprint', function (e) {
                 e.preventDefault();
                 document.body.style.display = 'none';
@@ -3175,7 +3185,7 @@
                 document.body.style.display = '';
             });
 
-            // 8. Block screenshot keyboard shortcuts
+            // 7. Block screenshot keyboard shortcuts
             document.addEventListener('keyup', function (e) {
                 // PrintScreen key
                 if (e.key === 'PrintScreen') {
@@ -3184,10 +3194,9 @@
                 }
             }, true);
 
-            // 9. Visibility change detection (tab switching for screenshots)
+            // 8. Visibility change detection (tab switching for screenshots)
             document.addEventListener('visibilitychange', function () {
                 if (document.hidden) {
-                    // User switched tabs - could be for screenshot tools
                     console.log('[Security] Tab hidden');
                 }
             });
@@ -3195,30 +3204,6 @@
             console.log('[Security] All protection features initialized');
         })();
     </script>
-
-    <!-- Security CSS for DevTools detection -->
-    <style>
-        .devtools-open #viewerContainer,
-        .devtools-open #viewer,
-        .devtools-open .pdfViewer {
-            filter: blur(20px) !important;
-            pointer-events: none !important;
-        }
-
-        .devtools-open::after {
-            content: 'Geliştirici araçları açıkken içerik görüntülenemez.';
-            position: fixed;
-            top: 50%;
-            left: 50%;
-            transform: translate(-50%, -50%);
-            background: rgba(0, 0, 0, 0.9);
-            color: #fff;
-            padding: 30px 50px;
-            border-radius: 10px;
-            font-size: 18px;
-            z-index: 99999;
-        }
-    </style>
 </body>
 
 </html>