nodebb-plugin-pdf-secure 1.2.5 → 1.2.6

package/library.js

@@ -26,6 +26,14 @@ plugin.init = async (params) => {
 		console.error('[PDF-Secure] Failed to cache viewer template:', err.message);
 	}
 
+	// Double slash bypass protection - catches /uploads//files/ attempts
+	router.use((req, res, next) => {
+		if (req.path.includes('//') && req.path.toLowerCase().includes('.pdf')) {
+			return res.status(403).json({ error: 'Invalid path' });
+		}
+		next();
+	});
+
 	// PDF direct access blocker middleware
 	// Intercepts requests to uploaded PDF files and returns 403
 	router.get('/assets/uploads/files/:filename', (req, res, next) => {
@@ -115,4 +123,35 @@ plugin.addAdminNavigation = (header) => {
 	return header;
 };
 
+// Filter meta tags to hide PDF URLs and filenames
+plugin.filterMetaTags = async (hookData) => {
+	if (!hookData || !hookData.tags) {
+		return hookData;
+	}
+
+	// Filter out PDF-related meta tags
+	hookData.tags = hookData.tags.filter(tag => {
+		// Remove og:image if it contains .pdf
+		if (tag.property === 'og:image' && tag.content && tag.content.toLowerCase().includes('.pdf')) {
+			return false;
+		}
+		// Remove twitter:image if it contains .pdf
+		if (tag.name === 'twitter:image' && tag.content && tag.content.toLowerCase().includes('.pdf')) {
+			return false;
+		}
+		return true;
+	});
+
+	// Sanitize description to hide .pdf extensions
+	hookData.tags = hookData.tags.map(tag => {
+		if ((tag.name === 'description' || tag.property === 'og:description') && tag.content) {
+			// Replace .pdf extension with empty string in description
+			tag.content = tag.content.replace(/\.pdf/gi, '');
+		}
+		return tag;
+	});
+
+	return hookData;
+};
+
 module.exports = plugin;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nodebb-plugin-pdf-secure",
-  "version": "1.2.5",
+  "version": "1.2.6",
   "description": "Secure PDF viewer plugin for NodeBB - prevents downloading, enables canvas-only rendering with Premium group support",
   "main": "library.js",
   "repository": {

package/plugin.json

@@ -14,6 +14,10 @@
 		{
 			"hook": "filter:admin.header.build",
 			"method": "addAdminNavigation"
+		},
+		{
+			"hook": "filter:meta.getMetaTags",
+			"method": "filterMetaTags"
 		}
 	],
 	"staticDirs": {

package/static/viewer.html

@@ -1334,6 +1334,34 @@
         (function () {
             'use strict';
 
+            // ============================================
+            // CANVAS EXPORT PROTECTION
+            // Block toDataURL/toBlob for PDF render canvas only
+            // Allows: thumbnails, annotations, other canvases
+            // ============================================
+            const originalToDataURL = HTMLCanvasElement.prototype.toDataURL;
+            const originalToBlob = HTMLCanvasElement.prototype.toBlob;
+
+            HTMLCanvasElement.prototype.toDataURL = function () {
+                // Block only main PDF page canvases (inside .page elements in #viewerContainer)
+                if (this.closest && this.closest('.page') && this.closest('#viewerContainer')) {
+                    console.warn('[Security] Canvas toDataURL blocked for PDF page');
+                    return 'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg==';  // 1x1 transparent
+                }
+                return originalToDataURL.apply(this, arguments);
+            };
+
+            HTMLCanvasElement.prototype.toBlob = function (callback) {
+                // Block only main PDF page canvases
+                if (this.closest && this.closest('.page') && this.closest('#viewerContainer')) {
+                    console.warn('[Security] Canvas toBlob blocked for PDF page');
+                    // Return empty blob
+                    if (callback) callback(new Blob([], { type: 'image/png' }));
+                    return;
+                }
+                return originalToBlob.apply(this, arguments);
+            };
+
             pdfjsLib.GlobalWorkerOptions.workerSrc = '';
 
             // State - now private, not accessible from console
@@ -1520,6 +1548,10 @@
                     // Security: Delete config containing sensitive data (nonce, key)
                     delete window.PDF_SECURE_CONFIG;
 
+                    // Security: Remove PDF.js globals to prevent console manipulation
+                    delete window.pdfjsLib;
+                    delete window.pdfjsViewer;
+
                     // Security: Block dangerous PDF.js methods
                     if (pdfDoc) {
                         pdfDoc.getData = function () {