pdf-parser.js 5.2.27 → 5.2.29

package/dist/encrypt-write.js

@@ -14,6 +14,8 @@ var PdfEncryptionError = class extends Error {
 };
 const RC4_128_KEY_BYTES = 16;
 const R6_PASSWORD_MAX_BYTES = 127;
+const BITS_PER_BYTE = 8;
+const MAX_PERMISSION_BITS = 32;
 const RESERVED_BIT_7_AND_8 = 192;
 const DEPRECATED_ALWAYS_ONE_BIT_10 = 512;
 const SCHEME_SPECS = {
@@ -42,11 +44,12 @@ const SCHEME_SPECS = {
 		method: "aes"
 	}
 };
+const MAX_PRINTABLE_ASCII = 127;
 function legacyPasswordBytes(password) {
 	const bytes = new Uint8Array(password.length);
 	for (let i = 0; i < password.length; i++) {
 		const code = password.charCodeAt(i);
-		if (code > 127) throw new PdfEncryptionError(`password contains character code ${String(code)}, outside the printable-ASCII range this writer supports for the rc4-40/rc4-128/aes-128 schemes; use a plain-ASCII password, or the aes-256 scheme, whose revision-6 passwords are Unicode`);
+		if (code > MAX_PRINTABLE_ASCII) throw new PdfEncryptionError(`password contains character code ${String(code)}, outside the printable-ASCII range this writer supports for the rc4-40/rc4-128/aes-128 schemes; use a plain-ASCII password, or the aes-256 scheme, whose revision-6 passwords are Unicode`);
 		bytes[i] = code;
 	}
 	return bytes;
@@ -65,15 +68,16 @@ function permissionsToP(permissions) {
 	p |= DEPRECATED_ALWAYS_ONE_BIT_10;
 	if (permissions?.assemble ?? true) p |= 1024;
 	if (permissions?.printHighRes ?? true) p |= 2048;
-	for (let bit = 13; bit <= 32; bit++) p |= 1 << bit - 1;
+	for (let bit = 13; bit <= MAX_PERMISSION_BITS; bit++) p |= 1 << bit - 1;
 	return p;
 }
+const ITERATED_REVISION_MIN = 3;
 function computeLegacyOwnerValue(ownerPassword, userPassword, revision, keyBytes) {
 	let digest = md5(padOrTruncatePassword(ownerPassword));
-	if (revision >= 3) for (let i = 0; i < 50; i++) digest = md5(digest);
+	if (revision >= ITERATED_REVISION_MIN) for (let i = 0; i < 50; i++) digest = md5(digest);
 	const ownerKey = digest.subarray(0, keyBytes);
 	let value = rc4(ownerKey, padOrTruncatePassword(userPassword));
-	if (revision >= 3) for (let i = 1; i <= 19; i++) {
+	if (revision >= ITERATED_REVISION_MIN) for (let i = 1; i <= 19; i++) {
 		const roundKey = Uint8Array.from(ownerKey, (byte) => byte ^ i);
 		value = rc4(roundKey, value);
 	}
@@ -124,9 +128,9 @@ function buildLegacyEncryptor(spec, options, fileId) {
 		["O", pdfHexString(owner)],
 		["U", pdfHexString(user)],
 		["P", pdfNum(p)],
-		["Length", pdfNum(spec.keyBytes * 8)]
+		["Length", pdfNum(spec.keyBytes * BITS_PER_BYTE)]
 	]);
-	if (spec.v === 4) {
+	if (spec.v === SCHEME_SPECS["aes-128"].v) {
 		entries.set("CF", pdfDict({ StdCF: pdfDict({
 			AuthEvent: pdfName("DocOpen"),
 			CFM: pdfName("AESV2"),
@@ -165,21 +169,21 @@ function buildAes256Encryptor(spec, options) {
 	]);
 	const ownerIntermediateKey = hardenedHash(ownerPassword, ownerKeySalt, u, spec.r);
 	const oe = aesCbcEncrypt(ownerIntermediateKey, ZERO_IV, fileKey);
+	const PERMS_P_BYTES = 4;
+	const PERMS_SIGN_EXTENSION_BYTES = new Uint8Array(PERMS_P_BYTES).fill(255);
+	const PERMS_METADATA_FLAG_OFFSET = 8;
+	const ENCRYPT_METADATA_TRUE_ASCII = 84;
+	const ENCRYPT_METADATA_FALSE_ASCII = 70;
+	const ADB_MARKER_OFFSET = 9;
+	const ADB_MARKER_BYTES = Uint8Array.from("adb", (c) => c.charCodeAt(0));
+	const PERMS_RANDOM_BYTES = 4;
+	const PERMS_RANDOM_OFFSET = ADB_MARKER_OFFSET + ADB_MARKER_BYTES.length;
 	const permsBlock = /* @__PURE__ */ new Uint8Array(16);
 	permsBlock.set(permissionsBytes(p), 0);
-	permsBlock.set([
-		255,
-		255,
-		255,
-		255
-	], 4);
-	permsBlock[8] = encryptMetadata ? 84 : 70;
-	permsBlock.set([
-		97,
-		100,
-		98
-	], 9);
-	permsBlock.set(randomBytes(4), 12);
+	permsBlock.set(PERMS_SIGN_EXTENSION_BYTES, PERMS_P_BYTES);
+	permsBlock[PERMS_METADATA_FLAG_OFFSET] = encryptMetadata ? ENCRYPT_METADATA_TRUE_ASCII : ENCRYPT_METADATA_FALSE_ASCII;
+	permsBlock.set(ADB_MARKER_BYTES, ADB_MARKER_OFFSET);
+	permsBlock.set(randomBytes(PERMS_RANDOM_BYTES), PERMS_RANDOM_OFFSET);
 	const perms = aesCbcEncrypt(fileKey, ZERO_IV, permsBlock);
 	const entries = /* @__PURE__ */ new Map([
 		["Filter", pdfName("Standard")],
@@ -191,7 +195,7 @@ function buildAes256Encryptor(spec, options) {
 		["UE", pdfHexString(ue)],
 		["P", pdfNum(p)],
 		["Perms", pdfHexString(perms)],
-		["Length", pdfNum(spec.keyBytes * 8)],
+		["Length", pdfNum(spec.keyBytes * BITS_PER_BYTE)],
 		["CF", pdfDict({ StdCF: pdfDict({
 			AuthEvent: pdfName("DocOpen"),
 			CFM: pdfName("AESV3"),
@@ -206,7 +210,7 @@ function buildAes256Encryptor(spec, options) {
 function createStandardEncryptor(options, fileId) {
 	const scheme = options.scheme ?? "aes-256";
 	const spec = SCHEME_SPECS[scheme];
-	return spec.v === 5 ? buildAes256Encryptor(spec, options) : buildLegacyEncryptor(spec, options, fileId);
+	return spec.v === SCHEME_SPECS["aes-256"].v ? buildAes256Encryptor(spec, options) : buildLegacyEncryptor(spec, options, fileId);
 }
 function encryptIndirectObject(value, num, gen, encryptor) {
 	if (value.kind === "string") return {

package/dist/encrypt.cjs

@@ -7,46 +7,18 @@ const require_crypto_md5 = require("./crypto/md5.cjs");
 const require_crypto_rc4 = require("./crypto/rc4.cjs");
 const require_crypto_sha2 = require("./crypto/sha2.cjs");
 //#region src/encrypt.ts
-const PASSWORD_PADDING = new Uint8Array([
-	40,
-	191,
-	78,
-	94,
-	78,
-	117,
-	138,
-	65,
-	100,
-	0,
-	78,
-	86,
-	255,
-	250,
-	1,
-	8,
-	46,
-	46,
-	0,
-	182,
-	208,
-	104,
-	62,
-	128,
-	47,
-	12,
-	169,
-	254,
-	100,
-	83,
-	105,
-	122
-]);
-const AES_OBJECT_KEY_SALT = new Uint8Array([
-	115,
-	65,
-	108,
-	84
-]);
+const HEX_RADIX = 16;
+const HEX_CHARS_PER_BYTE = 2;
+function bytesFromHex(hex) {
+	const bytes = new Uint8Array(hex.length / HEX_CHARS_PER_BYTE);
+	for (let i = 0; i < bytes.length; i++) {
+		const start = i * HEX_CHARS_PER_BYTE;
+		bytes[i] = parseInt(hex.substring(start, start + HEX_CHARS_PER_BYTE), HEX_RADIX);
+	}
+	return bytes;
+}
+const PASSWORD_PADDING = bytesFromHex("28bf4e5e4e758a4164004e56fffa01082e2e00b6d0683e802f0ca9fe6453697a");
+const AES_OBJECT_KEY_SALT = new TextEncoder().encode("sAlT");
 const MD5_DIGEST_BYTES = 16;
 const OBJECT_KEY_EXTRA_BYTES = 5;
 const LEGACY_KEY_ITERATIONS = 50;
@@ -60,6 +32,9 @@ const RC4_40_KEY_BYTES = 5;
 const AESV2_KEY_BYTES = 16;
 const DEFAULT_KEY_BITS = 40;
 const BITS_PER_BYTE = 8;
+const BYTE_MASK = 255;
+const UINT32_BYTE_2_SHIFT = 16;
+const UINT32_BYTE_3_SHIFT = 24;
 const MAX_RC4_KEY_BYTES = 16;
 const ZERO_IV = /* @__PURE__ */ new Uint8Array(16);
 function requireStringBytes(dict, key) {
@@ -74,10 +49,10 @@ function bytesEqual(a, b, length) {
 function permissionsBytes(p) {
 	const unsigned = Math.trunc(p) >>> 0;
 	return new Uint8Array([
-		unsigned & 255,
-		unsigned >>> 8 & 255,
-		unsigned >>> 16 & 255,
-		unsigned >>> 24 & 255
+		unsigned & BYTE_MASK,
+		unsigned >>> BITS_PER_BYTE & BYTE_MASK,
+		unsigned >>> UINT32_BYTE_2_SHIFT & BYTE_MASK,
+		unsigned >>> UINT32_BYTE_3_SHIFT & BYTE_MASK
 	]);
 }
 function padOrTruncatePassword(password) {
@@ -85,6 +60,9 @@ function padOrTruncatePassword(password) {
 	padded.set(password.subarray(0, PASSWORD_PADDING.length));
 	return padded;
 }
+const METADATA_FLAG_MIN_REVISION = 4;
+const METADATA_NOT_ENCRYPTED_FLAG_BYTES = 4;
+const ITERATED_REVISION_MIN = 3;
 function computeLegacyFileKeyFromPaddedPassword(paddedPassword, owner, permissions, fileId, revision, keyBytes, encryptMetadata) {
 	const parts = [
 		paddedPassword,
@@ -92,14 +70,9 @@ function computeLegacyFileKeyFromPaddedPassword(paddedPassword, owner, permissio
 		permissionsBytes(permissions),
 		fileId
 	];
-	if (revision >= 4 && !encryptMetadata) parts.push(new Uint8Array([
-		255,
-		255,
-		255,
-		255
-	]));
+	if (revision >= METADATA_FLAG_MIN_REVISION && !encryptMetadata) parts.push(new Uint8Array(METADATA_NOT_ENCRYPTED_FLAG_BYTES).fill(BYTE_MASK));
 	let digest = require_crypto_md5.md5(require_bytes_writer.concatBytes(parts));
-	if (revision >= 3) for (let i = 0; i < 50; i++) digest = require_crypto_md5.md5(digest.subarray(0, keyBytes));
+	if (revision >= ITERATED_REVISION_MIN) for (let i = 0; i < 50; i++) digest = require_crypto_md5.md5(digest.subarray(0, keyBytes));
 	return digest.subarray(0, keyBytes);
 }
 function computeLegacyFileKey(encryptDict, fileId, revision, keyBytes, encryptMetadata) {
@@ -120,13 +93,16 @@ function legacyUserPasswordVerifies(encryptDict, fileId, revision, fileKey) {
 	const storedUser = requireStringBytes(encryptDict, "U");
 	return bytesEqual(legacyUserValueCore(fileKey, fileId, revision), storedUser, revision === 2 ? PASSWORD_PADDING.length : 16);
 }
+const HARDENED_HASH_SHA256_ONLY_REVISION = 5;
+const STANDARD_AESV3_REVISION = 6;
+const HASH_SELECTOR_MODULUS = 3;
 function hardenedHash(password, salt, userData, revision) {
 	let k = require_crypto_sha2.sha256(require_bytes_writer.concatBytes([
 		password,
 		salt,
 		userData
 	]));
-	if (revision === 5) return k;
+	if (revision === HARDENED_HASH_SHA256_ONLY_REVISION) return k;
 	let e;
 	let round = 0;
 	do {
@@ -140,7 +116,7 @@ function hardenedHash(password, salt, userData, revision) {
 		e = require_crypto_aes.aesCbcEncrypt(k.subarray(0, 16), k.subarray(16, 32), k1);
 		let sum = 0;
 		for (let i = 0; i < 16; i++) sum += e[i];
-		const selector = sum % 3;
+		const selector = sum % HASH_SELECTOR_MODULUS;
 		k = selector === 0 ? require_crypto_sha2.sha256(e) : selector === 1 ? require_crypto_sha2.sha384(e) : require_crypto_sha2.sha512(e);
 		round++;
 	} while (round < R6_MINIMUM_ROUNDS || e[e.length - 1] > round - R6_TERMINATION_MARGIN);
@@ -180,14 +156,17 @@ function cryptFilterKeyBytes(encryptDict, declaredBits) {
 	if (declared === void 0) return Math.floor(declaredBits / BITS_PER_BYTE);
 	return declared >= DEFAULT_KEY_BITS ? Math.floor(declared / BITS_PER_BYTE) : declared;
 }
+const V5_HANDLER_VERSION = 5;
+const V4_HANDLER_VERSION = 4;
+const LEGACY_MAX_REVISION = 4;
 function setUpHandler(encryptDict, fileId) {
 	const version = require_objects.asNumber(require_objects.dictGet(encryptDict, "V")) ?? 0;
 	const revision = require_objects.asNumber(require_objects.dictGet(encryptDict, "R")) ?? 0;
 	const declaredBits = require_objects.asNumber(require_objects.dictGet(encryptDict, "Length")) ?? DEFAULT_KEY_BITS;
 	const encryptMetadataEntry = require_objects.dictGet(encryptDict, "EncryptMetadata");
 	const encryptMetadata = encryptMetadataEntry?.kind === "bool" ? encryptMetadataEntry.value : true;
-	if (version === 5) {
-		if (revision !== 5 && revision !== 6) throw new require_diagnostics.PdfEncryptedError(`/V 5 encryption with an unsupported revision /R ${String(revision)}`);
+	if (version === V5_HANDLER_VERSION) {
+		if (revision !== HARDENED_HASH_SHA256_ONLY_REVISION && revision !== STANDARD_AESV3_REVISION) throw new require_diagnostics.PdfEncryptedError(`/V 5 encryption with an unsupported revision /R ${String(revision)}`);
 		return {
 			fileKey: computeAesV3FileKey(encryptDict, revision),
 			streamMethod: methodFromCryptFilterName(encryptDict, "StmF"),
@@ -196,10 +175,10 @@ function setUpHandler(encryptDict, fileId) {
 			encryptMetadata
 		};
 	}
-	if (version !== 1 && version !== 2 && version !== 4) throw new require_diagnostics.PdfEncryptedError(`unsupported standard security handler version /V ${String(version)}`);
-	if (revision < 2 || revision > 4) throw new require_diagnostics.PdfEncryptedError(`unsupported standard security handler revision /R ${String(revision)}`);
-	const streamMethod = version === 4 ? methodFromCryptFilterName(encryptDict, "StmF") : "rc4";
-	const stringMethod = version === 4 ? methodFromCryptFilterName(encryptDict, "StrF") : "rc4";
+	if (version !== 1 && version !== 2 && version !== V4_HANDLER_VERSION) throw new require_diagnostics.PdfEncryptedError(`unsupported standard security handler version /V ${String(version)}`);
+	if (revision < 2 || revision > LEGACY_MAX_REVISION) throw new require_diagnostics.PdfEncryptedError(`unsupported standard security handler revision /R ${String(revision)}`);
+	const streamMethod = version === V4_HANDLER_VERSION ? methodFromCryptFilterName(encryptDict, "StmF") : "rc4";
+	const stringMethod = version === V4_HANDLER_VERSION ? methodFromCryptFilterName(encryptDict, "StrF") : "rc4";
 	const keyBytes = version === 1 ? 5 : version === 2 ? Math.floor(declaredBits / BITS_PER_BYTE) : cryptFilterKeyBytes(encryptDict, declaredBits);
 	if (keyBytes < 5 || keyBytes > MAX_RC4_KEY_BYTES) throw new require_diagnostics.PdfEncryptedError(`the /Encrypt dictionary declares a ${String(keyBytes * BITS_PER_BYTE)}-bit file key, outside the 40-128 bit range /V ${String(version)} permits`);
 	const fileKey = computeLegacyFileKey(encryptDict, fileId, revision, keyBytes, encryptMetadata);
@@ -214,11 +193,11 @@ function setUpHandler(encryptDict, fileId) {
 }
 function objectKey(fileKey, num, gen, method) {
 	const extra = new Uint8Array(OBJECT_KEY_EXTRA_BYTES);
-	extra[0] = num & 255;
-	extra[1] = num >>> 8 & 255;
-	extra[2] = num >>> 16 & 255;
-	extra[3] = gen & 255;
-	extra[4] = gen >>> 8 & 255;
+	extra[0] = num & BYTE_MASK;
+	extra[1] = num >>> BITS_PER_BYTE & BYTE_MASK;
+	extra[2] = num >>> UINT32_BYTE_2_SHIFT & BYTE_MASK;
+	extra[3] = gen & BYTE_MASK;
+	extra[4] = gen >>> BITS_PER_BYTE & BYTE_MASK;
 	return require_crypto_md5.md5(require_bytes_writer.concatBytes(method === "aes" ? [
 		fileKey,
 		extra,

package/dist/encrypt.js

@@ -6,46 +6,18 @@ import { md5 } from "./crypto/md5.js";
 import { rc4 } from "./crypto/rc4.js";
 import { sha256, sha384, sha512 } from "./crypto/sha2.js";
 //#region src/encrypt.ts
-const PASSWORD_PADDING = new Uint8Array([
-	40,
-	191,
-	78,
-	94,
-	78,
-	117,
-	138,
-	65,
-	100,
-	0,
-	78,
-	86,
-	255,
-	250,
-	1,
-	8,
-	46,
-	46,
-	0,
-	182,
-	208,
-	104,
-	62,
-	128,
-	47,
-	12,
-	169,
-	254,
-	100,
-	83,
-	105,
-	122
-]);
-const AES_OBJECT_KEY_SALT = new Uint8Array([
-	115,
-	65,
-	108,
-	84
-]);
+const HEX_RADIX = 16;
+const HEX_CHARS_PER_BYTE = 2;
+function bytesFromHex(hex) {
+	const bytes = new Uint8Array(hex.length / HEX_CHARS_PER_BYTE);
+	for (let i = 0; i < bytes.length; i++) {
+		const start = i * HEX_CHARS_PER_BYTE;
+		bytes[i] = parseInt(hex.substring(start, start + HEX_CHARS_PER_BYTE), HEX_RADIX);
+	}
+	return bytes;
+}
+const PASSWORD_PADDING = bytesFromHex("28bf4e5e4e758a4164004e56fffa01082e2e00b6d0683e802f0ca9fe6453697a");
+const AES_OBJECT_KEY_SALT = new TextEncoder().encode("sAlT");
 const MD5_DIGEST_BYTES = 16;
 const OBJECT_KEY_EXTRA_BYTES = 5;
 const LEGACY_KEY_ITERATIONS = 50;
@@ -59,6 +31,9 @@ const RC4_40_KEY_BYTES = 5;
 const AESV2_KEY_BYTES = 16;
 const DEFAULT_KEY_BITS = 40;
 const BITS_PER_BYTE = 8;
+const BYTE_MASK = 255;
+const UINT32_BYTE_2_SHIFT = 16;
+const UINT32_BYTE_3_SHIFT = 24;
 const MAX_RC4_KEY_BYTES = 16;
 const ZERO_IV = /* @__PURE__ */ new Uint8Array(16);
 function requireStringBytes(dict, key) {
@@ -73,10 +48,10 @@ function bytesEqual(a, b, length) {
 function permissionsBytes(p) {
 	const unsigned = Math.trunc(p) >>> 0;
 	return new Uint8Array([
-		unsigned & 255,
-		unsigned >>> 8 & 255,
-		unsigned >>> 16 & 255,
-		unsigned >>> 24 & 255
+		unsigned & BYTE_MASK,
+		unsigned >>> BITS_PER_BYTE & BYTE_MASK,
+		unsigned >>> UINT32_BYTE_2_SHIFT & BYTE_MASK,
+		unsigned >>> UINT32_BYTE_3_SHIFT & BYTE_MASK
 	]);
 }
 function padOrTruncatePassword(password) {
@@ -84,6 +59,9 @@ function padOrTruncatePassword(password) {
 	padded.set(password.subarray(0, PASSWORD_PADDING.length));
 	return padded;
 }
+const METADATA_FLAG_MIN_REVISION = 4;
+const METADATA_NOT_ENCRYPTED_FLAG_BYTES = 4;
+const ITERATED_REVISION_MIN = 3;
 function computeLegacyFileKeyFromPaddedPassword(paddedPassword, owner, permissions, fileId, revision, keyBytes, encryptMetadata) {
 	const parts = [
 		paddedPassword,
@@ -91,14 +69,9 @@ function computeLegacyFileKeyFromPaddedPassword(paddedPassword, owner, permissio
 		permissionsBytes(permissions),
 		fileId
 	];
-	if (revision >= 4 && !encryptMetadata) parts.push(new Uint8Array([
-		255,
-		255,
-		255,
-		255
-	]));
+	if (revision >= METADATA_FLAG_MIN_REVISION && !encryptMetadata) parts.push(new Uint8Array(METADATA_NOT_ENCRYPTED_FLAG_BYTES).fill(BYTE_MASK));
 	let digest = md5(concatBytes(parts));
-	if (revision >= 3) for (let i = 0; i < 50; i++) digest = md5(digest.subarray(0, keyBytes));
+	if (revision >= ITERATED_REVISION_MIN) for (let i = 0; i < 50; i++) digest = md5(digest.subarray(0, keyBytes));
 	return digest.subarray(0, keyBytes);
 }
 function computeLegacyFileKey(encryptDict, fileId, revision, keyBytes, encryptMetadata) {
@@ -119,13 +92,16 @@ function legacyUserPasswordVerifies(encryptDict, fileId, revision, fileKey) {
 	const storedUser = requireStringBytes(encryptDict, "U");
 	return bytesEqual(legacyUserValueCore(fileKey, fileId, revision), storedUser, revision === 2 ? PASSWORD_PADDING.length : 16);
 }
+const HARDENED_HASH_SHA256_ONLY_REVISION = 5;
+const STANDARD_AESV3_REVISION = 6;
+const HASH_SELECTOR_MODULUS = 3;
 function hardenedHash(password, salt, userData, revision) {
 	let k = sha256(concatBytes([
 		password,
 		salt,
 		userData
 	]));
-	if (revision === 5) return k;
+	if (revision === HARDENED_HASH_SHA256_ONLY_REVISION) return k;
 	let e;
 	let round = 0;
 	do {
@@ -139,7 +115,7 @@ function hardenedHash(password, salt, userData, revision) {
 		e = aesCbcEncrypt(k.subarray(0, 16), k.subarray(16, 32), k1);
 		let sum = 0;
 		for (let i = 0; i < 16; i++) sum += e[i];
-		const selector = sum % 3;
+		const selector = sum % HASH_SELECTOR_MODULUS;
 		k = selector === 0 ? sha256(e) : selector === 1 ? sha384(e) : sha512(e);
 		round++;
 	} while (round < R6_MINIMUM_ROUNDS || e[e.length - 1] > round - R6_TERMINATION_MARGIN);
@@ -179,14 +155,17 @@ function cryptFilterKeyBytes(encryptDict, declaredBits) {
 	if (declared === void 0) return Math.floor(declaredBits / BITS_PER_BYTE);
 	return declared >= DEFAULT_KEY_BITS ? Math.floor(declared / BITS_PER_BYTE) : declared;
 }
+const V5_HANDLER_VERSION = 5;
+const V4_HANDLER_VERSION = 4;
+const LEGACY_MAX_REVISION = 4;
 function setUpHandler(encryptDict, fileId) {
 	const version = asNumber(dictGet(encryptDict, "V")) ?? 0;
 	const revision = asNumber(dictGet(encryptDict, "R")) ?? 0;
 	const declaredBits = asNumber(dictGet(encryptDict, "Length")) ?? DEFAULT_KEY_BITS;
 	const encryptMetadataEntry = dictGet(encryptDict, "EncryptMetadata");
 	const encryptMetadata = encryptMetadataEntry?.kind === "bool" ? encryptMetadataEntry.value : true;
-	if (version === 5) {
-		if (revision !== 5 && revision !== 6) throw new PdfEncryptedError(`/V 5 encryption with an unsupported revision /R ${String(revision)}`);
+	if (version === V5_HANDLER_VERSION) {
+		if (revision !== HARDENED_HASH_SHA256_ONLY_REVISION && revision !== STANDARD_AESV3_REVISION) throw new PdfEncryptedError(`/V 5 encryption with an unsupported revision /R ${String(revision)}`);
 		return {
 			fileKey: computeAesV3FileKey(encryptDict, revision),
 			streamMethod: methodFromCryptFilterName(encryptDict, "StmF"),
@@ -195,10 +174,10 @@ function setUpHandler(encryptDict, fileId) {
 			encryptMetadata
 		};
 	}
-	if (version !== 1 && version !== 2 && version !== 4) throw new PdfEncryptedError(`unsupported standard security handler version /V ${String(version)}`);
-	if (revision < 2 || revision > 4) throw new PdfEncryptedError(`unsupported standard security handler revision /R ${String(revision)}`);
-	const streamMethod = version === 4 ? methodFromCryptFilterName(encryptDict, "StmF") : "rc4";
-	const stringMethod = version === 4 ? methodFromCryptFilterName(encryptDict, "StrF") : "rc4";
+	if (version !== 1 && version !== 2 && version !== V4_HANDLER_VERSION) throw new PdfEncryptedError(`unsupported standard security handler version /V ${String(version)}`);
+	if (revision < 2 || revision > LEGACY_MAX_REVISION) throw new PdfEncryptedError(`unsupported standard security handler revision /R ${String(revision)}`);
+	const streamMethod = version === V4_HANDLER_VERSION ? methodFromCryptFilterName(encryptDict, "StmF") : "rc4";
+	const stringMethod = version === V4_HANDLER_VERSION ? methodFromCryptFilterName(encryptDict, "StrF") : "rc4";
 	const keyBytes = version === 1 ? 5 : version === 2 ? Math.floor(declaredBits / BITS_PER_BYTE) : cryptFilterKeyBytes(encryptDict, declaredBits);
 	if (keyBytes < 5 || keyBytes > MAX_RC4_KEY_BYTES) throw new PdfEncryptedError(`the /Encrypt dictionary declares a ${String(keyBytes * BITS_PER_BYTE)}-bit file key, outside the 40-128 bit range /V ${String(version)} permits`);
 	const fileKey = computeLegacyFileKey(encryptDict, fileId, revision, keyBytes, encryptMetadata);
@@ -213,11 +192,11 @@ function setUpHandler(encryptDict, fileId) {
 }
 function objectKey(fileKey, num, gen, method) {
 	const extra = new Uint8Array(OBJECT_KEY_EXTRA_BYTES);
-	extra[0] = num & 255;
-	extra[1] = num >>> 8 & 255;
-	extra[2] = num >>> 16 & 255;
-	extra[3] = gen & 255;
-	extra[4] = gen >>> 8 & 255;
+	extra[0] = num & BYTE_MASK;
+	extra[1] = num >>> BITS_PER_BYTE & BYTE_MASK;
+	extra[2] = num >>> UINT32_BYTE_2_SHIFT & BYTE_MASK;
+	extra[3] = gen & BYTE_MASK;
+	extra[4] = gen >>> BITS_PER_BYTE & BYTE_MASK;
 	return md5(concatBytes(method === "aes" ? [
 		fileKey,
 		extra,

package/dist/filters.cjs

@@ -6,6 +6,8 @@ const require_image_ccitt = require("./image/ccitt.cjs");
 const require_image_jbig2 = require("./image/jbig2.cjs");
 const require_predictors = require("./predictors.cjs");
 //#region src/filters.ts
+const BITS_PER_BYTE = 8;
+const BYTE_MASK = 255;
 function decodeStream(raw, dict, sink, resolve) {
 	const filters = filterNames(dict);
 	const parms = decodeParmsList(dict, filters.length);
@@ -103,7 +105,7 @@ function jbig2Decode(data, parm, dict, sink, resolve) {
 			}
 		});
 		return {
-			bytes: Uint8Array.from(image.bytes, (byte) => byte ^ 255),
+			bytes: Uint8Array.from(image.bytes, (byte) => byte ^ BYTE_MASK),
 			globals
 		};
 	} catch (error) {
@@ -146,6 +148,9 @@ function decodeParmsList(dict, count) {
 const LZW_CLEAR_TABLE = 256;
 const LZW_EOD = 257;
 const LZW_INITIAL_CODE_WIDTH = 9;
+const LZW_CODE_WIDTH_10 = 10;
+const LZW_CODE_WIDTH_11 = 11;
+const LZW_CODE_WIDTH_12 = 12;
 const LZW_FIRST_NEW_CODE = 258;
 function initialLzwDictionary() {
 	return Array.from({ length: 256 }, (_, i) => new Uint8Array([i]));
@@ -169,9 +174,9 @@ function lzwDecode(data, earlyChange, sink) {
 	const readCode = () => {
 		while (bitCount < codeWidth) {
 			if (pos >= data.length) return;
-			bitBuffer = bitBuffer << 8 | data[pos];
+			bitBuffer = bitBuffer << BITS_PER_BYTE | data[pos];
 			pos++;
-			bitCount += 8;
+			bitCount += BITS_PER_BYTE;
 		}
 		const value = bitBuffer >>> bitCount - codeWidth & (1 << codeWidth) - 1;
 		bitCount -= codeWidth;
@@ -203,9 +208,9 @@ function lzwDecode(data, earlyChange, sink) {
 		if (prevEntry !== void 0) {
 			dict[nextCode] = concatTwo(prevEntry, new Uint8Array([entry[0] ?? 0]));
 			nextCode++;
-			if (nextCode + bias === 512) codeWidth = 10;
-			else if (nextCode + bias === 1024) codeWidth = 11;
-			else if (nextCode + bias === 2048) codeWidth = 12;
+			if (nextCode + bias === 2 ** LZW_INITIAL_CODE_WIDTH) codeWidth = LZW_CODE_WIDTH_10;
+			else if (nextCode + bias === 2 ** LZW_CODE_WIDTH_10) codeWidth = LZW_CODE_WIDTH_11;
+			else if (nextCode + bias === 2 ** LZW_CODE_WIDTH_11) codeWidth = LZW_CODE_WIDTH_12;
 		}
 		prevEntry = entry;
 	}
@@ -217,21 +222,26 @@ const ASCII85_END_MARKER = 126;
 const ASCII85_MIN_DIGIT = 33;
 const ASCII85_MAX_DIGIT = 117;
 const ASCII85_MAX_DIGIT_VALUE = 84;
+const ASCII85_RADIX = 85;
+const ASCII85_GROUP_DIGITS = 5;
+const ASCII85_OPTIONAL_PREFIX_LT = 60;
+const ASCII85_BYTE_3_SHIFT = 24;
+const ASCII85_BYTE_2_SHIFT = 16;
 function ascii85GroupBytes(digits, byteCount) {
 	let value = 0;
-	for (const digit of digits) value = value * 85 + digit;
+	for (const digit of digits) value = value * ASCII85_RADIX + digit;
 	return [
-		value >>> 24 & 255,
-		value >>> 16 & 255,
-		value >>> 8 & 255,
-		value & 255
+		value >>> ASCII85_BYTE_3_SHIFT & BYTE_MASK,
+		value >>> ASCII85_BYTE_2_SHIFT & BYTE_MASK,
+		value >>> BITS_PER_BYTE & BYTE_MASK,
+		value & BYTE_MASK
 	].slice(0, byteCount);
 }
 function ascii85Decode(data) {
 	const out = [];
 	let tuple = [];
 	let i = 0;
-	if (data.length >= 2 && data[0] === 60 && data[1] === 126) i = 2;
+	if (data.length >= 2 && data[0] === ASCII85_OPTIONAL_PREFIX_LT && data[1] === ASCII85_END_MARKER) i = 2;
 	for (; i < data.length; i++) {
 		const byte = data[i];
 		if (byte === ASCII85_END_MARKER) break;
@@ -242,36 +252,46 @@ function ascii85Decode(data) {
 		}
 		if (byte < ASCII85_MIN_DIGIT || byte > ASCII85_MAX_DIGIT) continue;
 		tuple.push(byte - ASCII85_MIN_DIGIT);
-		if (tuple.length === 5) {
+		if (tuple.length === ASCII85_GROUP_DIGITS) {
 			out.push(...ascii85GroupBytes(tuple, ASCII85_GROUP_BYTES));
 			tuple = [];
 		}
 	}
 	if (tuple.length > 1) {
 		const padded = tuple.slice();
-		while (padded.length < 5) padded.push(ASCII85_MAX_DIGIT_VALUE);
+		while (padded.length < ASCII85_GROUP_DIGITS) padded.push(ASCII85_MAX_DIGIT_VALUE);
 		out.push(...ascii85GroupBytes(padded, tuple.length - 1));
 	}
 	return Uint8Array.from(out);
 }
+const ASCII_DIGIT_ZERO = 48;
+const ASCII_DIGIT_NINE = 57;
+const ASCII_UPPER_A = 65;
+const ASCII_UPPER_F = 70;
+const ASCII_LOWER_A = 97;
+const ASCII_LOWER_F = 102;
+const HEX_LETTER_DIGIT_OFFSET = 10;
+const ASCII_HEX_TERMINATOR = 62;
+const HEX_NIBBLE_BITS = 4;
 function hexDigitValue(byte) {
-	if (byte >= 48 && byte <= 57) return byte - 48;
-	if (byte >= 65 && byte <= 70) return byte - 65 + 10;
-	if (byte >= 97 && byte <= 102) return byte - 97 + 10;
+	if (byte >= ASCII_DIGIT_ZERO && byte <= ASCII_DIGIT_NINE) return byte - ASCII_DIGIT_ZERO;
+	if (byte >= ASCII_UPPER_A && byte <= ASCII_UPPER_F) return byte - ASCII_UPPER_A + HEX_LETTER_DIGIT_OFFSET;
+	if (byte >= ASCII_LOWER_A && byte <= ASCII_LOWER_F) return byte - ASCII_LOWER_A + HEX_LETTER_DIGIT_OFFSET;
 }
 function asciiHexDecode(data) {
 	const digits = [];
 	for (const byte of data) {
-		if (byte === 62) break;
+		if (byte === ASCII_HEX_TERMINATOR) break;
 		const value = hexDigitValue(byte);
 		if (value !== void 0) digits.push(value);
 	}
 	if (digits.length % 2 === 1) digits.push(0);
 	const out = new Uint8Array(digits.length / 2);
-	for (let i = 0; i < out.length; i++) out[i] = digits[i * 2] << 4 | digits[i * 2 + 1];
+	for (let i = 0; i < out.length; i++) out[i] = digits[i * 2] << HEX_NIBBLE_BITS | digits[i * 2 + 1];
 	return out;
 }
 const RUN_LENGTH_EOD = 128;
+const RUN_LENGTH_REPEAT_COUNT_BASE = 257;
 function runLengthDecode(data) {
 	const out = [];
 	let i = 0;
@@ -283,7 +303,7 @@ function runLengthDecode(data) {
 			const count = length + 1;
 			for (let j = 0; j < count && i < data.length; j++, i++) out.push(data[i]);
 		} else {
-			const count = 257 - length;
+			const count = RUN_LENGTH_REPEAT_COUNT_BASE - length;
 			const byte = data[i] ?? 0;
 			i++;
 			for (let j = 0; j < count; j++) out.push(byte);