pdf-codec 1.4.2 → 1.5.0

package/dist/document.js

@@ -2,6 +2,7 @@ import { ByteReader } from "./bytes/reader.js";
 import { nextToken } from "./lexer.js";
 import { PdfEncryptedError, PdfParseError } from "./diagnostics.js";
 import { asArray, asDict, asNumber, dictGet, isName, pdfNull } from "./objects.js";
+import { createStandardDecryptor } from "./encrypt.js";
 import { decodeStream } from "./filters.js";
 import { parseIndirectObject, parseValue } from "./parse.js";
 import { readXref } from "./xref.js";
@@ -13,11 +14,39 @@ const INHERITABLE_PAGE_KEYS = [
 	"CropBox",
 	"Rotate"
 ];
+function firstFileId(trailer) {
+	const first = asArray(dictGet(trailer, "ID"))?.[0];
+	return first?.kind === "string" ? first.bytes : /* @__PURE__ */ new Uint8Array(0);
+}
+function decryptDict(dict, num, gen, decryptor) {
+	return {
+		kind: "dict",
+		entries: new Map(Array.from(dict.entries, ([key, entry]) => [key, decryptObject(entry, num, gen, decryptor)]))
+	};
+}
+function decryptObject(value, num, gen, decryptor) {
+	if (value.kind === "string") return {
+		kind: "string",
+		bytes: decryptor.decryptString(value.bytes, num, gen),
+		hex: value.hex
+	};
+	if (value.kind === "array") return {
+		kind: "array",
+		items: value.items.map((item) => decryptObject(item, num, gen, decryptor))
+	};
+	if (value.kind === "dict") return decryptDict(value, num, gen, decryptor);
+	if (value.kind === "stream") return {
+		kind: "stream",
+		dict: decryptDict(value.dict, num, gen, decryptor),
+		raw: decryptor.decryptStream(value.raw, value.dict, num, gen)
+	};
+	return value;
+}
 function openPdfDocument(bytes, sink) {
 	const xref = readXref(bytes, sink);
-	if (dictGet(xref.trailer, "Encrypt") !== void 0) throw new PdfEncryptedError();
 	const objectCache = /* @__PURE__ */ new Map();
 	const objStmCache = /* @__PURE__ */ new Map();
+	let decryptor;
 	function fetchDirect(num, entry) {
 		const reader = new ByteReader(bytes);
 		reader.seek(entry.offset);
@@ -30,7 +59,8 @@ function openPdfDocument(bytes, sink) {
 			});
 			return pdfNull();
 		}
-		return indirect.value;
+		if (decryptor === void 0) return indirect.value;
+		return decryptObject(indirect.value, num, indirect.gen, decryptor);
 	}
 	function decodeObjectStream(streamObjNum) {
 		const cached = objStmCache.get(streamObjNum);
@@ -112,6 +142,12 @@ function openPdfDocument(bytes, sink) {
 		if (dict === void 0 || !isName(dictGet(dict, "Type"), "Catalog")) throw new PdfParseError("pdf/no-root", "no resolvable /Root catalog was found, even after cross-reference recovery");
 		return dict;
 	}
+	const encryptEntry = dictGet(xref.trailer, "Encrypt");
+	if (encryptEntry !== void 0) {
+		const encryptDict = resolveDict(encryptEntry);
+		if (encryptDict === void 0) throw new PdfEncryptedError("the trailer names an /Encrypt dictionary that does not resolve to a dictionary at all");
+		decryptor = createStandardDecryptor(encryptDict, firstFileId(xref.trailer), sink);
+	}
 	const catalog = requireCatalog(resolveDict(dictGet(xref.trailer, "Root")));
 	function pages() {
 		const pagesRoot = resolveDict(dictGet(catalog, "Pages"));

package/dist/encrypt.cjs

@@ -0,0 +1,264 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_bytes_writer = require("./bytes/writer.cjs");
+const require_diagnostics = require("./diagnostics.cjs");
+const require_crypto_aes = require("./crypto/aes.cjs");
+const require_crypto_md5 = require("./crypto/md5.cjs");
+const require_crypto_rc4 = require("./crypto/rc4.cjs");
+const require_crypto_sha2 = require("./crypto/sha2.cjs");
+const require_objects = require("./objects.cjs");
+//#region src/encrypt.ts
+const PASSWORD_PADDING = new Uint8Array([
+	40,
+	191,
+	78,
+	94,
+	78,
+	117,
+	138,
+	65,
+	100,
+	0,
+	78,
+	86,
+	255,
+	250,
+	1,
+	8,
+	46,
+	46,
+	0,
+	182,
+	208,
+	104,
+	62,
+	128,
+	47,
+	12,
+	169,
+	254,
+	100,
+	83,
+	105,
+	122
+]);
+const AES_OBJECT_KEY_SALT = new Uint8Array([
+	115,
+	65,
+	108,
+	84
+]);
+const MD5_DIGEST_BYTES = 16;
+const OBJECT_KEY_EXTRA_BYTES = 5;
+const LEGACY_KEY_ITERATIONS = 50;
+const ALGORITHM_5_ITERATIONS = 19;
+const R6_MINIMUM_ROUNDS = 64;
+const R6_ROUND_REPEATS = 64;
+const R6_TERMINATION_MARGIN = 32;
+const AESV3_KEY_BYTES = 32;
+const RC4_40_KEY_BYTES = 5;
+const AESV2_KEY_BYTES = 16;
+const DEFAULT_KEY_BITS = 40;
+const BITS_PER_BYTE = 8;
+const MAX_RC4_KEY_BYTES = 16;
+const ZERO_IV = /* @__PURE__ */ new Uint8Array(16);
+function requireStringBytes(dict, key) {
+	const value = require_objects.dictGet(dict, key);
+	if (value?.kind !== "string") throw new require_diagnostics.PdfEncryptedError(`the /Encrypt dictionary's /${key} entry is missing or is not a direct string; this file's encryption cannot be read`);
+	return value.bytes;
+}
+function bytesEqual(a, b, length) {
+	if (a.length < length || b.length < length) return false;
+	for (let i = 0; i < length; i++) if (a[i] !== b[i]) return false;
+	return true;
+}
+function permissionsBytes(p) {
+	const unsigned = Math.trunc(p) >>> 0;
+	return new Uint8Array([
+		unsigned & 255,
+		unsigned >>> 8 & 255,
+		unsigned >>> 16 & 255,
+		unsigned >>> 24 & 255
+	]);
+}
+function computeLegacyFileKey(encryptDict, fileId, revision, keyBytes, encryptMetadata) {
+	const owner = requireStringBytes(encryptDict, "O");
+	const permissions = require_objects.asNumber(require_objects.dictGet(encryptDict, "P")) ?? 0;
+	const parts = [
+		PASSWORD_PADDING,
+		owner.subarray(0, PASSWORD_PADDING.length),
+		permissionsBytes(permissions),
+		fileId
+	];
+	if (revision >= 4 && !encryptMetadata) parts.push(new Uint8Array([
+		255,
+		255,
+		255,
+		255
+	]));
+	let digest = require_crypto_md5.md5(require_bytes_writer.concatBytes(parts));
+	if (revision >= 3) for (let i = 0; i < LEGACY_KEY_ITERATIONS; i++) digest = require_crypto_md5.md5(digest.subarray(0, keyBytes));
+	return digest.subarray(0, keyBytes);
+}
+function legacyUserPasswordVerifies(encryptDict, fileId, revision, fileKey) {
+	const storedUser = requireStringBytes(encryptDict, "U");
+	if (revision === 2) return bytesEqual(require_crypto_rc4.rc4(fileKey, PASSWORD_PADDING), storedUser, PASSWORD_PADDING.length);
+	let value = require_crypto_rc4.rc4(fileKey, require_crypto_md5.md5(require_bytes_writer.concatBytes([PASSWORD_PADDING, fileId])));
+	for (let i = 1; i <= ALGORITHM_5_ITERATIONS; i++) {
+		const roundKey = Uint8Array.from(fileKey, (byte) => byte ^ i);
+		value = require_crypto_rc4.rc4(roundKey, value);
+	}
+	return bytesEqual(value, storedUser, MD5_DIGEST_BYTES);
+}
+function hardenedHash(password, salt, userData, revision) {
+	let k = require_crypto_sha2.sha256(require_bytes_writer.concatBytes([
+		password,
+		salt,
+		userData
+	]));
+	if (revision === 5) return k;
+	let e = new Uint8Array([0]);
+	let round = 0;
+	while (round < R6_MINIMUM_ROUNDS || e[e.length - 1] > round - R6_TERMINATION_MARGIN) {
+		const roundInput = require_bytes_writer.concatBytes([
+			password,
+			k,
+			userData
+		]);
+		const k1 = new Uint8Array(roundInput.length * R6_ROUND_REPEATS);
+		for (let i = 0; i < R6_ROUND_REPEATS; i++) k1.set(roundInput, i * roundInput.length);
+		e = require_crypto_aes.aesCbcEncrypt(k.subarray(0, 16), k.subarray(16, 32), k1);
+		let sum = 0;
+		for (let i = 0; i < 16; i++) sum += e[i];
+		const selector = sum % 3;
+		k = selector === 0 ? require_crypto_sha2.sha256(e) : selector === 1 ? require_crypto_sha2.sha384(e) : require_crypto_sha2.sha512(e);
+		round++;
+	}
+	return k.subarray(0, AESV3_KEY_BYTES);
+}
+function computeAesV3FileKey(encryptDict, revision) {
+	const storedUser = requireStringBytes(encryptDict, "U");
+	const expectedLength = 48;
+	if (storedUser.length < expectedLength) throw new require_diagnostics.PdfEncryptedError(`the /Encrypt dictionary's /U entry is ${String(storedUser.length)} bytes; revision ${String(revision)} requires ${String(expectedLength)}`);
+	const empty = /* @__PURE__ */ new Uint8Array(0);
+	const validationSalt = storedUser.subarray(AESV3_KEY_BYTES, 40);
+	const keySalt = storedUser.subarray(40, expectedLength);
+	if (!bytesEqual(hardenedHash(empty, validationSalt, empty, revision), storedUser, AESV3_KEY_BYTES)) throw new require_diagnostics.PdfPasswordRequiredError();
+	const intermediateKey = hardenedHash(empty, keySalt, empty, revision);
+	const wrappedKey = requireStringBytes(encryptDict, "UE");
+	if (wrappedKey.length < AESV3_KEY_BYTES) throw new require_diagnostics.PdfEncryptedError(`the /Encrypt dictionary's /UE entry is ${String(wrappedKey.length)} bytes; revision ${String(revision)} requires ${String(AESV3_KEY_BYTES)}`);
+	return require_crypto_aes.aesCbcDecrypt(intermediateKey, ZERO_IV, wrappedKey.subarray(0, AESV3_KEY_BYTES));
+}
+function methodFromCryptFilterName(encryptDict, entryKey) {
+	const name = require_objects.asName(require_objects.dictGet(encryptDict, entryKey)) ?? "Identity";
+	if (name === "Identity") return "identity";
+	const filters = require_objects.asDict(require_objects.dictGet(encryptDict, "CF"));
+	const filter = filters !== void 0 ? require_objects.asDict(require_objects.dictGet(filters, name)) : void 0;
+	if (filter === void 0) throw new require_diagnostics.PdfEncryptedError(`the /Encrypt dictionary names a crypt filter /${name} for /${entryKey} that its own /CF dictionary does not define`);
+	const method = require_objects.asName(require_objects.dictGet(filter, "CFM"));
+	if (method === "None") return "identity";
+	if (method === "V2") return "rc4";
+	if (method === "AESV2" || method === "AESV3") return "aes";
+	throw new require_diagnostics.PdfEncryptedError(`crypt filter /${name} uses an unsupported /CFM ${method === void 0 ? "(absent)" : `/${method}`}`);
+}
+function cryptFilterKeyBytes(encryptDict, declaredBits) {
+	const streamFilterName = require_objects.asName(require_objects.dictGet(encryptDict, "StmF")) ?? "Identity";
+	const filters = require_objects.asDict(require_objects.dictGet(encryptDict, "CF"));
+	const filter = filters !== void 0 ? require_objects.asDict(require_objects.dictGet(filters, streamFilterName)) : void 0;
+	if ((filter !== void 0 ? require_objects.asName(require_objects.dictGet(filter, "CFM")) : void 0) === "AESV2") return AESV2_KEY_BYTES;
+	const declared = filter !== void 0 ? require_objects.asNumber(require_objects.dictGet(filter, "Length")) : void 0;
+	if (declared === void 0) return Math.floor(declaredBits / BITS_PER_BYTE);
+	return declared >= DEFAULT_KEY_BITS ? Math.floor(declared / BITS_PER_BYTE) : declared;
+}
+function setUpHandler(encryptDict, fileId) {
+	const version = require_objects.asNumber(require_objects.dictGet(encryptDict, "V")) ?? 0;
+	const revision = require_objects.asNumber(require_objects.dictGet(encryptDict, "R")) ?? 0;
+	const declaredBits = require_objects.asNumber(require_objects.dictGet(encryptDict, "Length")) ?? DEFAULT_KEY_BITS;
+	const encryptMetadataEntry = require_objects.dictGet(encryptDict, "EncryptMetadata");
+	const encryptMetadata = encryptMetadataEntry?.kind === "bool" ? encryptMetadataEntry.value : true;
+	if (version === 5) {
+		if (revision !== 5 && revision !== 6) throw new require_diagnostics.PdfEncryptedError(`/V 5 encryption with an unsupported revision /R ${String(revision)}`);
+		return {
+			fileKey: computeAesV3FileKey(encryptDict, revision),
+			streamMethod: methodFromCryptFilterName(encryptDict, "StmF"),
+			stringMethod: methodFromCryptFilterName(encryptDict, "StrF"),
+			perObjectKeys: false,
+			encryptMetadata
+		};
+	}
+	if (version !== 1 && version !== 2 && version !== 4) throw new require_diagnostics.PdfEncryptedError(`unsupported standard security handler version /V ${String(version)}`);
+	if (revision < 2 || revision > 4) throw new require_diagnostics.PdfEncryptedError(`unsupported standard security handler revision /R ${String(revision)}`);
+	const streamMethod = version === 4 ? methodFromCryptFilterName(encryptDict, "StmF") : "rc4";
+	const stringMethod = version === 4 ? methodFromCryptFilterName(encryptDict, "StrF") : "rc4";
+	const keyBytes = version === 1 ? RC4_40_KEY_BYTES : version === 2 ? Math.floor(declaredBits / BITS_PER_BYTE) : cryptFilterKeyBytes(encryptDict, declaredBits);
+	if (keyBytes < RC4_40_KEY_BYTES || keyBytes > MAX_RC4_KEY_BYTES) throw new require_diagnostics.PdfEncryptedError(`the /Encrypt dictionary declares a ${String(keyBytes * BITS_PER_BYTE)}-bit file key, outside the 40-128 bit range /V ${String(version)} permits`);
+	const fileKey = computeLegacyFileKey(encryptDict, fileId, revision, keyBytes, encryptMetadata);
+	if (!legacyUserPasswordVerifies(encryptDict, fileId, revision, fileKey)) throw new require_diagnostics.PdfPasswordRequiredError();
+	return {
+		fileKey,
+		streamMethod,
+		stringMethod,
+		perObjectKeys: true,
+		encryptMetadata
+	};
+}
+function objectKey(fileKey, num, gen, method) {
+	const extra = new Uint8Array(OBJECT_KEY_EXTRA_BYTES);
+	extra[0] = num & 255;
+	extra[1] = num >>> 8 & 255;
+	extra[2] = num >>> 16 & 255;
+	extra[3] = gen & 255;
+	extra[4] = gen >>> 8 & 255;
+	return require_crypto_md5.md5(require_bytes_writer.concatBytes(method === "aes" ? [
+		fileKey,
+		extra,
+		AES_OBJECT_KEY_SALT
+	] : [fileKey, extra])).subarray(0, Math.min(fileKey.length + OBJECT_KEY_EXTRA_BYTES, MD5_DIGEST_BYTES));
+}
+function decryptAes(key, data, sink) {
+	if (data.length <= 16) {
+		if (data.length !== 0 && data.length !== 16) sink({
+			code: "pdf/decrypt-truncated",
+			severity: "warning",
+			message: `an AES-encrypted value is ${String(data.length)} bytes, too short to carry even its own initialisation vector; treating it as empty`
+		});
+		return /* @__PURE__ */ new Uint8Array(0);
+	}
+	const body = data.subarray(16);
+	if (body.length % 16 !== 0) sink({
+		code: "pdf/decrypt-truncated",
+		severity: "warning",
+		message: `an AES-encrypted value's ciphertext is ${String(body.length)} bytes, not a whole number of 16-byte blocks; the trailing partial block is being dropped`
+	});
+	const plain = require_crypto_aes.aesCbcDecrypt(key, data.subarray(0, 16), body);
+	const padLength = plain[plain.length - 1] ?? 0;
+	if (padLength < 1 || padLength > 16 || padLength > plain.length) {
+		sink({
+			code: "pdf/decrypt-bad-padding",
+			severity: "warning",
+			message: "an AES-encrypted value did not end in valid PKCS#7 padding; keeping the decrypted bytes unstripped"
+		});
+		return plain;
+	}
+	return plain.subarray(0, plain.length - padLength);
+}
+function applyMethod(method, fileKey, perObjectKeys, bytes, num, gen, sink) {
+	if (method === "identity") return bytes;
+	const key = perObjectKeys ? objectKey(fileKey, num, gen, method) : fileKey;
+	return method === "rc4" ? require_crypto_rc4.rc4(key, bytes) : decryptAes(key, bytes, sink);
+}
+function createStandardDecryptor(encryptDict, fileId, sink) {
+	const filter = require_objects.asName(require_objects.dictGet(encryptDict, "Filter"));
+	if (filter !== "Standard") throw new require_diagnostics.PdfEncryptedError(`this PDF uses the ${filter === void 0 ? "unnamed" : `/${filter}`} security handler; only the standard security handler is supported`);
+	const setup = setUpHandler(encryptDict, fileId);
+	return {
+		decryptString(bytes, num, gen) {
+			return applyMethod(setup.stringMethod, setup.fileKey, setup.perObjectKeys, bytes, num, gen, sink);
+		},
+		decryptStream(bytes, dict, num, gen) {
+			if (!setup.encryptMetadata && require_objects.asName(require_objects.dictGet(dict, "Type")) === "Metadata") return bytes;
+			return applyMethod(setup.streamMethod, setup.fileKey, setup.perObjectKeys, bytes, num, gen, sink);
+		}
+	};
+}
+//#endregion
+exports.createStandardDecryptor = createStandardDecryptor;

package/dist/encrypt.d.cts

@@ -0,0 +1,11 @@
+import { PdfDiagnosticSink } from "./diagnostics.cjs";
+import { PdfDict } from "./objects.cjs";
+//#region src/encrypt.d.ts
+type CipherMethod = 'identity' | 'rc4' | 'aes';
+interface PdfDecryptor {
+  decryptString(bytes: Uint8Array<ArrayBuffer>, num: number, gen: number): Uint8Array<ArrayBuffer>;
+  decryptStream(bytes: Uint8Array<ArrayBuffer>, dict: PdfDict, num: number, gen: number): Uint8Array<ArrayBuffer>;
+}
+declare function createStandardDecryptor(encryptDict: PdfDict, fileId: Uint8Array<ArrayBuffer>, sink: PdfDiagnosticSink): PdfDecryptor;
+//#endregion
+export { CipherMethod, PdfDecryptor, createStandardDecryptor };

package/dist/encrypt.d.ts

@@ -0,0 +1,11 @@
+import { PdfDiagnosticSink } from "./diagnostics.js";
+import { PdfDict } from "./objects.js";
+//#region src/encrypt.d.ts
+type CipherMethod = 'identity' | 'rc4' | 'aes';
+interface PdfDecryptor {
+  decryptString(bytes: Uint8Array<ArrayBuffer>, num: number, gen: number): Uint8Array<ArrayBuffer>;
+  decryptStream(bytes: Uint8Array<ArrayBuffer>, dict: PdfDict, num: number, gen: number): Uint8Array<ArrayBuffer>;
+}
+declare function createStandardDecryptor(encryptDict: PdfDict, fileId: Uint8Array<ArrayBuffer>, sink: PdfDiagnosticSink): PdfDecryptor;
+//#endregion
+export { CipherMethod, PdfDecryptor, createStandardDecryptor };

package/dist/encrypt.js

@@ -0,0 +1,263 @@
+import { concatBytes } from "./bytes/writer.js";
+import { PdfEncryptedError, PdfPasswordRequiredError } from "./diagnostics.js";
+import { aesCbcDecrypt, aesCbcEncrypt } from "./crypto/aes.js";
+import { md5 } from "./crypto/md5.js";
+import { rc4 } from "./crypto/rc4.js";
+import { sha256, sha384, sha512 } from "./crypto/sha2.js";
+import { asDict, asName, asNumber, dictGet } from "./objects.js";
+//#region src/encrypt.ts
+const PASSWORD_PADDING = new Uint8Array([
+	40,
+	191,
+	78,
+	94,
+	78,
+	117,
+	138,
+	65,
+	100,
+	0,
+	78,
+	86,
+	255,
+	250,
+	1,
+	8,
+	46,
+	46,
+	0,
+	182,
+	208,
+	104,
+	62,
+	128,
+	47,
+	12,
+	169,
+	254,
+	100,
+	83,
+	105,
+	122
+]);
+const AES_OBJECT_KEY_SALT = new Uint8Array([
+	115,
+	65,
+	108,
+	84
+]);
+const MD5_DIGEST_BYTES = 16;
+const OBJECT_KEY_EXTRA_BYTES = 5;
+const LEGACY_KEY_ITERATIONS = 50;
+const ALGORITHM_5_ITERATIONS = 19;
+const R6_MINIMUM_ROUNDS = 64;
+const R6_ROUND_REPEATS = 64;
+const R6_TERMINATION_MARGIN = 32;
+const AESV3_KEY_BYTES = 32;
+const RC4_40_KEY_BYTES = 5;
+const AESV2_KEY_BYTES = 16;
+const DEFAULT_KEY_BITS = 40;
+const BITS_PER_BYTE = 8;
+const MAX_RC4_KEY_BYTES = 16;
+const ZERO_IV = /* @__PURE__ */ new Uint8Array(16);
+function requireStringBytes(dict, key) {
+	const value = dictGet(dict, key);
+	if (value?.kind !== "string") throw new PdfEncryptedError(`the /Encrypt dictionary's /${key} entry is missing or is not a direct string; this file's encryption cannot be read`);
+	return value.bytes;
+}
+function bytesEqual(a, b, length) {
+	if (a.length < length || b.length < length) return false;
+	for (let i = 0; i < length; i++) if (a[i] !== b[i]) return false;
+	return true;
+}
+function permissionsBytes(p) {
+	const unsigned = Math.trunc(p) >>> 0;
+	return new Uint8Array([
+		unsigned & 255,
+		unsigned >>> 8 & 255,
+		unsigned >>> 16 & 255,
+		unsigned >>> 24 & 255
+	]);
+}
+function computeLegacyFileKey(encryptDict, fileId, revision, keyBytes, encryptMetadata) {
+	const owner = requireStringBytes(encryptDict, "O");
+	const permissions = asNumber(dictGet(encryptDict, "P")) ?? 0;
+	const parts = [
+		PASSWORD_PADDING,
+		owner.subarray(0, PASSWORD_PADDING.length),
+		permissionsBytes(permissions),
+		fileId
+	];
+	if (revision >= 4 && !encryptMetadata) parts.push(new Uint8Array([
+		255,
+		255,
+		255,
+		255
+	]));
+	let digest = md5(concatBytes(parts));
+	if (revision >= 3) for (let i = 0; i < LEGACY_KEY_ITERATIONS; i++) digest = md5(digest.subarray(0, keyBytes));
+	return digest.subarray(0, keyBytes);
+}
+function legacyUserPasswordVerifies(encryptDict, fileId, revision, fileKey) {
+	const storedUser = requireStringBytes(encryptDict, "U");
+	if (revision === 2) return bytesEqual(rc4(fileKey, PASSWORD_PADDING), storedUser, PASSWORD_PADDING.length);
+	let value = rc4(fileKey, md5(concatBytes([PASSWORD_PADDING, fileId])));
+	for (let i = 1; i <= ALGORITHM_5_ITERATIONS; i++) {
+		const roundKey = Uint8Array.from(fileKey, (byte) => byte ^ i);
+		value = rc4(roundKey, value);
+	}
+	return bytesEqual(value, storedUser, MD5_DIGEST_BYTES);
+}
+function hardenedHash(password, salt, userData, revision) {
+	let k = sha256(concatBytes([
+		password,
+		salt,
+		userData
+	]));
+	if (revision === 5) return k;
+	let e = new Uint8Array([0]);
+	let round = 0;
+	while (round < R6_MINIMUM_ROUNDS || e[e.length - 1] > round - R6_TERMINATION_MARGIN) {
+		const roundInput = concatBytes([
+			password,
+			k,
+			userData
+		]);
+		const k1 = new Uint8Array(roundInput.length * R6_ROUND_REPEATS);
+		for (let i = 0; i < R6_ROUND_REPEATS; i++) k1.set(roundInput, i * roundInput.length);
+		e = aesCbcEncrypt(k.subarray(0, 16), k.subarray(16, 32), k1);
+		let sum = 0;
+		for (let i = 0; i < 16; i++) sum += e[i];
+		const selector = sum % 3;
+		k = selector === 0 ? sha256(e) : selector === 1 ? sha384(e) : sha512(e);
+		round++;
+	}
+	return k.subarray(0, AESV3_KEY_BYTES);
+}
+function computeAesV3FileKey(encryptDict, revision) {
+	const storedUser = requireStringBytes(encryptDict, "U");
+	const expectedLength = 48;
+	if (storedUser.length < expectedLength) throw new PdfEncryptedError(`the /Encrypt dictionary's /U entry is ${String(storedUser.length)} bytes; revision ${String(revision)} requires ${String(expectedLength)}`);
+	const empty = /* @__PURE__ */ new Uint8Array(0);
+	const validationSalt = storedUser.subarray(AESV3_KEY_BYTES, 40);
+	const keySalt = storedUser.subarray(40, expectedLength);
+	if (!bytesEqual(hardenedHash(empty, validationSalt, empty, revision), storedUser, AESV3_KEY_BYTES)) throw new PdfPasswordRequiredError();
+	const intermediateKey = hardenedHash(empty, keySalt, empty, revision);
+	const wrappedKey = requireStringBytes(encryptDict, "UE");
+	if (wrappedKey.length < AESV3_KEY_BYTES) throw new PdfEncryptedError(`the /Encrypt dictionary's /UE entry is ${String(wrappedKey.length)} bytes; revision ${String(revision)} requires ${String(AESV3_KEY_BYTES)}`);
+	return aesCbcDecrypt(intermediateKey, ZERO_IV, wrappedKey.subarray(0, AESV3_KEY_BYTES));
+}
+function methodFromCryptFilterName(encryptDict, entryKey) {
+	const name = asName(dictGet(encryptDict, entryKey)) ?? "Identity";
+	if (name === "Identity") return "identity";
+	const filters = asDict(dictGet(encryptDict, "CF"));
+	const filter = filters !== void 0 ? asDict(dictGet(filters, name)) : void 0;
+	if (filter === void 0) throw new PdfEncryptedError(`the /Encrypt dictionary names a crypt filter /${name} for /${entryKey} that its own /CF dictionary does not define`);
+	const method = asName(dictGet(filter, "CFM"));
+	if (method === "None") return "identity";
+	if (method === "V2") return "rc4";
+	if (method === "AESV2" || method === "AESV3") return "aes";
+	throw new PdfEncryptedError(`crypt filter /${name} uses an unsupported /CFM ${method === void 0 ? "(absent)" : `/${method}`}`);
+}
+function cryptFilterKeyBytes(encryptDict, declaredBits) {
+	const streamFilterName = asName(dictGet(encryptDict, "StmF")) ?? "Identity";
+	const filters = asDict(dictGet(encryptDict, "CF"));
+	const filter = filters !== void 0 ? asDict(dictGet(filters, streamFilterName)) : void 0;
+	if ((filter !== void 0 ? asName(dictGet(filter, "CFM")) : void 0) === "AESV2") return AESV2_KEY_BYTES;
+	const declared = filter !== void 0 ? asNumber(dictGet(filter, "Length")) : void 0;
+	if (declared === void 0) return Math.floor(declaredBits / BITS_PER_BYTE);
+	return declared >= DEFAULT_KEY_BITS ? Math.floor(declared / BITS_PER_BYTE) : declared;
+}
+function setUpHandler(encryptDict, fileId) {
+	const version = asNumber(dictGet(encryptDict, "V")) ?? 0;
+	const revision = asNumber(dictGet(encryptDict, "R")) ?? 0;
+	const declaredBits = asNumber(dictGet(encryptDict, "Length")) ?? DEFAULT_KEY_BITS;
+	const encryptMetadataEntry = dictGet(encryptDict, "EncryptMetadata");
+	const encryptMetadata = encryptMetadataEntry?.kind === "bool" ? encryptMetadataEntry.value : true;
+	if (version === 5) {
+		if (revision !== 5 && revision !== 6) throw new PdfEncryptedError(`/V 5 encryption with an unsupported revision /R ${String(revision)}`);
+		return {
+			fileKey: computeAesV3FileKey(encryptDict, revision),
+			streamMethod: methodFromCryptFilterName(encryptDict, "StmF"),
+			stringMethod: methodFromCryptFilterName(encryptDict, "StrF"),
+			perObjectKeys: false,
+			encryptMetadata
+		};
+	}
+	if (version !== 1 && version !== 2 && version !== 4) throw new PdfEncryptedError(`unsupported standard security handler version /V ${String(version)}`);
+	if (revision < 2 || revision > 4) throw new PdfEncryptedError(`unsupported standard security handler revision /R ${String(revision)}`);
+	const streamMethod = version === 4 ? methodFromCryptFilterName(encryptDict, "StmF") : "rc4";
+	const stringMethod = version === 4 ? methodFromCryptFilterName(encryptDict, "StrF") : "rc4";
+	const keyBytes = version === 1 ? RC4_40_KEY_BYTES : version === 2 ? Math.floor(declaredBits / BITS_PER_BYTE) : cryptFilterKeyBytes(encryptDict, declaredBits);
+	if (keyBytes < RC4_40_KEY_BYTES || keyBytes > MAX_RC4_KEY_BYTES) throw new PdfEncryptedError(`the /Encrypt dictionary declares a ${String(keyBytes * BITS_PER_BYTE)}-bit file key, outside the 40-128 bit range /V ${String(version)} permits`);
+	const fileKey = computeLegacyFileKey(encryptDict, fileId, revision, keyBytes, encryptMetadata);
+	if (!legacyUserPasswordVerifies(encryptDict, fileId, revision, fileKey)) throw new PdfPasswordRequiredError();
+	return {
+		fileKey,
+		streamMethod,
+		stringMethod,
+		perObjectKeys: true,
+		encryptMetadata
+	};
+}
+function objectKey(fileKey, num, gen, method) {
+	const extra = new Uint8Array(OBJECT_KEY_EXTRA_BYTES);
+	extra[0] = num & 255;
+	extra[1] = num >>> 8 & 255;
+	extra[2] = num >>> 16 & 255;
+	extra[3] = gen & 255;
+	extra[4] = gen >>> 8 & 255;
+	return md5(concatBytes(method === "aes" ? [
+		fileKey,
+		extra,
+		AES_OBJECT_KEY_SALT
+	] : [fileKey, extra])).subarray(0, Math.min(fileKey.length + OBJECT_KEY_EXTRA_BYTES, MD5_DIGEST_BYTES));
+}
+function decryptAes(key, data, sink) {
+	if (data.length <= 16) {
+		if (data.length !== 0 && data.length !== 16) sink({
+			code: "pdf/decrypt-truncated",
+			severity: "warning",
+			message: `an AES-encrypted value is ${String(data.length)} bytes, too short to carry even its own initialisation vector; treating it as empty`
+		});
+		return /* @__PURE__ */ new Uint8Array(0);
+	}
+	const body = data.subarray(16);
+	if (body.length % 16 !== 0) sink({
+		code: "pdf/decrypt-truncated",
+		severity: "warning",
+		message: `an AES-encrypted value's ciphertext is ${String(body.length)} bytes, not a whole number of 16-byte blocks; the trailing partial block is being dropped`
+	});
+	const plain = aesCbcDecrypt(key, data.subarray(0, 16), body);
+	const padLength = plain[plain.length - 1] ?? 0;
+	if (padLength < 1 || padLength > 16 || padLength > plain.length) {
+		sink({
+			code: "pdf/decrypt-bad-padding",
+			severity: "warning",
+			message: "an AES-encrypted value did not end in valid PKCS#7 padding; keeping the decrypted bytes unstripped"
+		});
+		return plain;
+	}
+	return plain.subarray(0, plain.length - padLength);
+}
+function applyMethod(method, fileKey, perObjectKeys, bytes, num, gen, sink) {
+	if (method === "identity") return bytes;
+	const key = perObjectKeys ? objectKey(fileKey, num, gen, method) : fileKey;
+	return method === "rc4" ? rc4(key, bytes) : decryptAes(key, bytes, sink);
+}
+function createStandardDecryptor(encryptDict, fileId, sink) {
+	const filter = asName(dictGet(encryptDict, "Filter"));
+	if (filter !== "Standard") throw new PdfEncryptedError(`this PDF uses the ${filter === void 0 ? "unnamed" : `/${filter}`} security handler; only the standard security handler is supported`);
+	const setup = setUpHandler(encryptDict, fileId);
+	return {
+		decryptString(bytes, num, gen) {
+			return applyMethod(setup.stringMethod, setup.fileKey, setup.perObjectKeys, bytes, num, gen, sink);
+		},
+		decryptStream(bytes, dict, num, gen) {
+			if (!setup.encryptMetadata && asName(dictGet(dict, "Type")) === "Metadata") return bytes;
+			return applyMethod(setup.streamMethod, setup.fileKey, setup.perObjectKeys, bytes, num, gen, sink);
+		}
+	};
+}
+//#endregion
+export { createStandardDecryptor };

package/dist/filters.cjs

@@ -1,7 +1,8 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_bytes_reader = require("./bytes/reader.cjs");
-const require_bytes_flate = require("./bytes/flate.cjs");
 const require_objects = require("./objects.cjs");
+const require_bytes_flate = require("./bytes/flate.cjs");
+const require_image_ccitt = require("./image/ccitt.cjs");
 const require_predictors = require("./predictors.cjs");
 //#region src/filters.ts
 function decodeStream(raw, dict, sink) {
@@ -18,6 +19,7 @@ function decodeStream(raw, dict, sink) {
 		} else if (filter === "ASCII85Decode" || filter === "A85") bytes = ascii85Decode(bytes);
 		else if (filter === "ASCIIHexDecode" || filter === "AHx") bytes = asciiHexDecode(bytes);
 		else if (filter === "RunLengthDecode" || filter === "RL") bytes = runLengthDecode(bytes);
+		else if (filter === "CCITTFaxDecode" || filter === "CCF") bytes = ccittFaxDecode(bytes, parm, dict, sink);
 		else if (filter === "DCTDecode" || filter === "DCT") return {
 			bytes,
 			remainingFilter: "DCTDecode"
@@ -39,6 +41,22 @@ function decodeStream(raw, dict, sink) {
 function applyPredictorIfPresent(data, parm, sink) {
 	return require_predictors.applyPredictor(data, require_predictors.readPredictorParams(parm), sink);
 }
+function ccittFaxDecode(data, parm, dict, sink) {
+	const parmGet = (key) => parm !== void 0 ? require_objects.dictGet(parm, key) : void 0;
+	const rows = require_objects.asNumber(parmGet("Rows")) ?? require_objects.asNumber(require_objects.dictGet(dict, "Height") ?? require_objects.dictGet(dict, "H"));
+	return require_image_ccitt.decodeCcittFax(data, {
+		k: require_objects.asNumber(parmGet("K")),
+		columns: require_objects.asNumber(parmGet("Columns")),
+		rows,
+		blackIs1: require_objects.asBool(parmGet("BlackIs1")),
+		encodedByteAlign: require_objects.asBool(parmGet("EncodedByteAlign")),
+		onWarning: (message) => sink({
+			code: "pdf/ccitt-fax-degraded",
+			severity: "warning",
+			message
+		})
+	}).bytes;
+}
 function filterNames(dict) {
 	const filterObj = require_objects.dictGet(dict, "Filter") ?? require_objects.dictGet(dict, "F");
 	if (filterObj === void 0) return [];