From cfb71d850e99a41cd47e0c87e2f8449b8abf6a9e Mon Sep 17 00:00:00 2001 From: "Dylan M. Taylor" Date: Thu, 15 Oct 2026 23:57:29 -0400 Subject: [PATCH 1/7] ci: switch to shared nix workflow from craft-common-actions --- .github/workflows/nix.yml | 16 +++------------- 1 file changed, 3 insertions(+), 13 deletions(-) diff --git a/.github/workflows/nix.yml b/.github/workflows/nix.yml index 18392587a8..01cb9cd663 100644 --- a/.github/workflows/nix.yml +++ b/.github/workflows/nix.yml @@ -18,16 +18,6 @@ concurrency: cancel-in-progress: true jobs: - eval: - runs-on: ubuntu-latest - timeout-minutes: 15 - steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1 - - name: nix flake check --no-build - run: | - if [ -f flake.nix ]; then - nix flake check --no-build --all-systems - else - echo "No flake.nix present in this repository; skipping check." - fi + nix: + # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos. + uses: storytold/craft-common-actions/.github/workflows/nix.yml@main From ec0a965074f376a5bf610435948e4e5184bf3299 Mon Sep 17 00:00:00 2001 From: Mex <44814932+MMexicann@users.noreply.github.com> Date: Mon, 19 Oct 2026 20:21:37 +0200 Subject: [PATCH 2/7] M5.6: preserve nested annotation values in FDF exports (#1971) * M5.6: preserve nested annotation values in FDF exports Copy and renumber retained object graphs without expanding aliases or following indirect cycles recursively. Refuse excessive work and propagate export errors before the destination is written. Cover saved geometry, colour and borders, shared graphs, streams, stale references and refusal through automation tools. Co-Authored-By: Codex * Bound FDF annotation copying before allocation Keep selected aliases shared, budget retained keys and values before copying, and add direct-payload and alias-count regressions. Retain copied-graph limits and document source-memory scope. * M5.6: bound FDF cache-eviction discovery and field values Extend the concurrent annotation-budget correction while retaining its direct-payload and alias regressions. Record annotation positions instead of resolved bodies so cache eviction cannot pin repeated parsed copies; borrow direct values and budget retained entries before cloning. Count every emitted multi-select field value before allocating its output array. Observed pre-fix allocation-cap and field-limit failures, then fixed tests passed. Final validation: 549 scoped XFDF/engine/automation tests passed, three existing ignored; strict all-targets Clippy, WASM, fmt, layers, assets, parity and diff checks passed. AI assistance: OpenAI Codex for @MMexicann. * M5.6: record bounded FDF export regression evidence Record comment cache-eviction discovery and emitted-field-value budget regressions without changing feature scores or status. Describe copied-graph limits and existing source-parser limits precisely. Final 549 scoped tests, strict Clippy, WASM, fmt, layers, assets and parity passed. AI assistance: OpenAI Codex for @MMexicann. * M5.6: align FDF progress with budgeted discovery Document lazy annotation positions, cache-eviction coverage and copied-graph limits while retaining the original nested-value progress entry and all upstream notes. Estimates unchanged. AI assistance: OpenAI Codex for @MMexicann. * M5.6: describe FDF discovery and copied-graph limits Align exchange documentation with the tested lazy-position discovery implementation and its copied-graph limits. Source parsing/page discovery keep existing limits. AI assistance: OpenAI Codex for @MMexicann. * M5.6: align milestone notes with FDF discovery limits Retain upstream milestone history and describe the tested discovery/copy budgets without increasing estimates or claiming a total source-memory bound. AI assistance: OpenAI Codex for @MMexicann. * M5.6: keep nested page links out of FDF exports Preserve graph aliases and existing budgets; exclude direct and indirect Page/Pages type names. Add saved-PDF regression and bounded type-resolution controls. Both pre-fix failures observed; 46 scoped tests, strict Clippy, WASM and formatting passed. * M5.6: document bounded nested page exclusion Address maintainer feedback on the existing PR. Preserve upstream work and document the tested scope and remaining validation limits. * M5.6: record nested page-reference regression evidence Address maintainer feedback on the existing PR. Preserve upstream work and document the tested scope and remaining validation limits. * M5.6: retain FDF limits in milestone evidence Address maintainer feedback on the existing PR. Preserve upstream work and document the tested scope and remaining validation limits. * M5.6: cite nested page-reference exclusion tests Address maintainer feedback on the existing PR. Preserve upstream work and document the tested scope and remaining validation limits. * M5.6: respect generations while identifying page references Address maintainer feedback on the existing PR. Preserve upstream work and document tested scope and validation limits. * XFDF: document stale Type preservation regression Address maintainer feedback on the existing PR. Preserve upstream work and document tested scope and validation limits. * M5.6: record generation-aware page exclusion evidence Address maintainer feedback on the existing PR. Preserve upstream work and document tested scope and validation limits. * M5.6: propagate FDF export errors in usage example Address maintainer feedback on the existing PR. Preserve upstream work and document tested scope and validation limits. * M5.6: consolidate roadmap change and target fields Address maintainer feedback on the existing PR. Preserve upstream work and document tested scope and validation limits. --------- Co-authored-by: Codex Co-authored-by: skylar taylor-barrick --- ROADMAP.md | 8 + crates/automation/tests/automation.rs | 59 ++++ crates/engine/src/lib.rs | 2 +- crates/xfdf/README.md | 18 +- crates/xfdf/src/lib.rs | 292 +++++++++++++++++--- crates/xfdf/src/tests.rs | 374 +++++++++++++++++++++++++- docs/roadmap.md | 5 +- parity/acrobat-features.toml | 8 +- 8 files changed, 716 insertions(+), 50 deletions(-) diff --git a/ROADMAP.md b/ROADMAP.md index f4d54ccea5..b1283e7751 100644 --- a/ROADMAP.md +++ b/ROADMAP.md @@ -2,6 +2,7 @@ **Stage: alpha** · next: beta, ~25% (ready for real work 50% → 75%) and ~400–700 h away +> **Last reviewed:** 2026-10-18 · **Last updated:** 2026-10-18 · **Change:** minor (M5, PR #1971: bounded nested FDF export excludes source page/page-tree dictionaries; refreshed against upstream 4db6ac4a; estimates unchanged) > **Last reviewed:** 2026-10-15 · **Last updated:** 2026-10-15 · **Change:** minor (M7: the Edit text caret is as tall as the row it is on; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS) > **Last reviewed:** 2026-10-15 · **Last updated:** 2026-10-15 · **Change:** minor (M6: CSV tab-containing headers; estimates unchanged) > **Last reviewed:** 2026-10-18 · **Last updated:** 2026-10-18 · **Change:** minor (M3, #3149: discard render demand after page geometry changes and check the GPU texture limit before upload; estimates unchanged) @@ -176,6 +177,11 @@ Ranked; detail and the full milestone table in [docs/roadmap.md](docs/roadmap.md - **2026-10-19 (M3, #3387):** Save-prompt shortcuts yield to later consent and utility dialogs; a synthetic UI regression checks that an edited document stays open. Estimates unchanged. - **2026-10-18 (M10, #3120):** Export to Word, PowerPoint, HTML and RTF reads text from form XObjects nested as deep as the renderer draws them (50 levels), and up to 50 000 forms a page (the renderer's budget for nested ones); it stopped at 12 levels and 4 096 forms and left the rest out silently. A page past those limits is listed in `doc_export_office`'s `truncated_pages`, with a warning. Estimates unchanged. + +- **2026-10-18 (M5, PR #1971 review):** Nested FDF annotation values that identify a source `/Page` or `/Pages` dictionary become null at every copy depth. A synthetic three-page PDF saved and reopened before export verifies that destination actions cannot pull source page content into the FDF, while unrelated nested metadata and shared references remain intact. FDF import semantics, copied-graph limits and estimates are unchanged. +- **2026-10-15 (M5, PR #1971 refresh):** Nested FDF annotation values retain shared or cyclic copied graphs. Discovery borrows direct values and records annotation positions with lazy array owners; retained entries are budgeted before cloning. Synthetic stress fixtures include repeated aliases and saved-PDF cache eviction. Limits cover the copied graph; source parsing and page discovery retain their existing limits, with no total source-memory bound. FDF import semantics and estimates are unchanged. +- **2026-10-13 (M5, nested FDF values):** Comment export copies and renumbers nested indirect values, retaining geometry, colours, borders and shared graphs. Graph/data limits return an error before the destination is written; synthetic saved-PDF and automation exchange regressions. Estimates unchanged. + - **2026-10-18 (M6, #2892):** Push-button normal labels are editable per widget through Options and form_set_props, independently of field names; rendering, undo/redo and incremental/full save/reopen are covered. Estimates unchanged. - **2026-10-18 (M7, #3212):** Headers, Bates numbers, watermarks and added text stay visible after unfinished marked content, with original content preserved. @@ -546,6 +552,8 @@ Newest first: the date, what moved, and the new overall estimate. | Date | Change | Summary | |---|---|---| +| 2026-10-18 | minor | M5, PR #1971: nested source `/Page` and `/Pages` dictionaries export as null without traversing page content or the page tree. Synthetic saved/reopened three-page regression retains unrelated metadata and aliases. FDF import semantics, copied-graph limits and estimates unchanged. | +| 2026-10-15 | minor | M5: budget retained FDF entries before cloning; discovery keeps lazy array owners and annotation positions, with alias/cache-eviction stress fixtures. Limits cover the copied graph; source parsing/page discovery retain existing COS/parser limits, with no total source-memory bound. FDF import semantics and estimates unchanged. | | 2026-10-15 | minor | M7: the Edit text caret is as tall as the row it is on in a region with several sizes; estimates unchanged. | | 2026-10-18 | minor | M4, PR #1919 review: repeated page indices apply each rotation to the latest page-local value, preserving indirect/inherited angles. Synthetic adjacent/interleaved duplicates retain siblings and page contents through incremental and full saves. Estimates unchanged. | | 2026-10-18 | minor | M3, #3149: page replacement cancels render demand collected for the previous geometry; all viewer raster upload paths reject empty or oversized textures before cache eviction. Synthetic regressions reproduce the reported 1880×2350 upload at a 2048 limit, retain cached images and unsaved edits, and resume bounded backdrops and tiles. Estimates unchanged. | diff --git a/crates/automation/tests/automation.rs b/crates/automation/tests/automation.rs index c6e1a574f0..cbf40f1962 100644 --- a/crates/automation/tests/automation.rs +++ b/crates/automation/tests/automation.rs @@ -6766,6 +6766,65 @@ fn a_root_less_write_output_is_atomic_too() { let _ = std::fs::remove_dir_all(&dir); } +#[test] +fn fdf_nested_comment_values_survive_export_import_and_save_through_tools() { + use pdfcraft_cos::{Dict, Document, Object, PdfString, SaveOptions, write_full}; + use std::sync::Arc; + let dir = workdir("fdf-nested-values"); + let mut source = Document::open(Arc::new(fixture(1))).unwrap(); + let page = pdfcraft_model::pages(&source)[0].obj; + let mut note = Dict::new(); + note.set(b"Type".to_vec(), Object::name("Annot")); + note.set(b"Subtype".to_vec(), Object::name("Square")); + note.set(b"NM".to_vec(), PdfString::text("nested-values")); + note.set(b"Rect".to_vec(), Object::Array([10, 20, 30, 40].map(|value| Object::Ref(source.add(Object::Int(value)))).into())); + note.set(b"C".to_vec(), Object::Array([0.25, 0.5, 0.75].map(|value| Object::Ref(source.add(Object::Real(value)))).into())); + let note = source.add(note); + source.update_dict(page, |dict| dict.set(b"Annots".to_vec(), Object::Array(vec![Object::Ref(note)]))).unwrap(); + std::fs::write(dir.join("source.pdf"), write_full(&source, &SaveOptions::default()).unwrap()).unwrap(); + let mut a = auto(&dir); + let source = ok(&mut a, "doc_open", json!({ "path": "source.pdf" }))["doc"].as_u64().unwrap(); + + ok(&mut a, "doc_export_data", json!({ "doc": source, "path": "notes.fdf", "what": "comments" })); + let target = ok(&mut a, "doc_open", json!({ "path": "b.pdf" }))["doc"].as_u64().unwrap(); + ok(&mut a, "doc_import_data", json!({ "doc": target, "path": "notes.fdf" })); + ok(&mut a, "doc_save", json!({ "doc": target, "path": "restored.pdf" })); + let reopened = ok(&mut a, "doc_open", json!({ "path": "restored.pdf" }))["doc"].as_u64().unwrap(); + let after = ok(&mut a, "comment_list", json!({ "doc": reopened })); + // The saved input has legal indirect scalar numbers. The engine's source inspection + // currently reads those as defaults, so compare the restored data to the fixture's + // known values (converted from PDF bottom-left to the tool's top-left coordinates). + assert_eq!(after["comments"][0]["rect"], json!([10.0, 260.0, 30.0, 280.0])); + assert_eq!(after["comments"][0]["color"], "#4080BF"); +} + +#[test] +fn refused_fdf_export_keeps_the_destination_and_source_through_tools() { + use pdfcraft_cos::{Dict, Document, Object, SaveOptions, write_full}; + use std::sync::Arc; + let dir = workdir("fdf-export-limit"); + let mut source = Document::open(Arc::new(fixture(1))).unwrap(); + let page = pdfcraft_model::pages(&source)[0].obj; + let mut note = Dict::new(); + note.set(b"Type".to_vec(), Object::name("Annot")); + note.set(b"Subtype".to_vec(), Object::name("Square")); + note.set(b"Rect".to_vec(), Object::Array(vec![10.into(), 20.into(), 30.into(), 40.into()])); + note.set(b"PCData".to_vec(), Object::Array(vec![Object::Null; 100_001])); + let note = source.add(note); + source.update_dict(page, |dict| dict.set(b"Annots".to_vec(), Object::Array(vec![Object::Ref(note)]))).unwrap(); + let bytes = write_full(&source, &SaveOptions::default()).unwrap(); + std::fs::write(dir.join("source.pdf"), &bytes).unwrap(); + std::fs::write(dir.join("notes.fdf"), b"existing destination").unwrap(); + let mut a = auto(&dir); + let doc = ok(&mut a, "doc_open", json!({ "path": "source.pdf" }))["doc"].as_u64().unwrap(); + let before = ok(&mut a, "comment_list", json!({ "doc": doc })); + let error = a.call("doc_export_data", &json!({ "doc": doc, "path": "notes.fdf", "what": "comments" })).unwrap_err(); + assert!(error.to_string().contains("100,000 values"), "{error}"); + assert_eq!(std::fs::read(dir.join("notes.fdf")).unwrap(), b"existing destination"); + assert_eq!(std::fs::read(dir.join("source.pdf")).unwrap(), bytes); + assert_eq!(ok(&mut a, "comment_list", json!({ "doc": doc })), before); +} + #[test] fn text_box_and_callout_fill_and_border_through_tools() { let dir = workdir("textbox-fill"); diff --git a/crates/engine/src/lib.rs b/crates/engine/src/lib.rs index 8f39248abd..dfe11b25c6 100644 --- a/crates/engine/src/lib.rs +++ b/crates/engine/src/lib.rs @@ -4342,7 +4342,7 @@ impl Session { } guard(|| match format { DataFormat::Xfdf => Ok(pdfcraft_xfdf::export_xfdf(&cos, comments, fields, &doc.name).into_bytes()), - DataFormat::Fdf => Ok(pdfcraft_xfdf::export_fdf(&cos, comments, fields, &doc.name)), + DataFormat::Fdf => pdfcraft_xfdf::export_fdf(&cos, comments, fields, &doc.name).map_err(|e| e.to_string()), DataFormat::Xml | DataFormat::Xdp if xfa => { pdfcraft_xfa::export_data(&cos, format == DataFormat::Xdp, &doc.name).map(String::into_bytes).map_err(|e| e.to_string()) } diff --git a/crates/xfdf/README.md b/crates/xfdf/README.md index f1ca8ac001..c137aabd93 100644 --- a/crates/xfdf/README.md +++ b/crates/xfdf/README.md @@ -4,7 +4,7 @@ Layer L4: comment and form data exchange (execution plan M5.6, M6.7). ```rust let xml = export_xfdf(&doc, true, true, "form.pdf"); // comments and/or field values -let fdf = export_fdf(&doc, false, true, "form.pdf"); +let fdf = export_fdf(&doc, false, true, "form.pdf")?; let txt = export_data(&doc, Format::Txt); // or Xml, Csv let report = import(&mut doc, &bytes)?; // XFDF, FDF, XML, CSV or text, detected ``` @@ -14,7 +14,21 @@ let report = import(&mut doc, &bytes)?; // XFDF, FDF, XML, CSV o name, author, subject, dates, flags, colours, opacity, width, icon, quads, line ends, ink, default appearance, callouts (`callout`, `fringe`, `intent`, `head`), pop-ups and reply threads (`inreplyto`); field values nested by name, with text preserved across XML comments and processing instructions. -- **FDF**: fields (with `/Kids` hierarchies) and comments as direct objects. +- **FDF**: fields (with `/Kids` hierarchies) and indirect comments. Nested annotation values + are copied under FDF object numbers; shared references and cycles remain shared. Document + links and appearances are excluded. Source `/Page` and `/Pages` dictionaries become null + at every copy depth, so nested destination actions cannot carry the source page tree or content. + Type names may be indirect; lookup checks each reference generation, is iterative, stops at + cycles and refuses chains beyond + 64 references. Discovery borrows direct arrays and dictionaries, + retains array owners lazily and records annotation positions instead of resolved bodies. + Retained entries are budgeted before their keys or values are cloned, including when + saved-PDF cache eviction causes annotation bodies to be parsed again. Export returns + `Result` and refuses copied graphs above 100,000 comments/objects/values, 64 direct nesting + levels or a conservative 64 MiB serialization budget instead of exporting partial data. + These are copied-graph limits: source parsing and page discovery retain their existing + COS/parser limits, with no total source-memory bound. Unknown indirect streams retain their + encoded bytes. FDF import semantics are unchanged. - **Form data**: Acrobat's XML (`xfdf:original` keeps names that aren't XML names), CSV and tab-delimited text (a row of names, a row of values). diff --git a/crates/xfdf/src/lib.rs b/crates/xfdf/src/lib.rs index ef5a30a90f..35bc781541 100644 --- a/crates/xfdf/src/lib.rs +++ b/crates/xfdf/src/lib.rs @@ -11,7 +11,7 @@ #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)] -use std::collections::HashMap; +use std::collections::{HashMap, HashSet}; use std::fmt::Write as _; use std::io::Write as _; @@ -29,6 +29,8 @@ pub enum DataError { Malformed(String), #[error("nothing in the file matches this document")] NothingImported, + #[error("FDF export exceeds the {0} limit; no data was exported")] + ExportLimit(&'static str), #[error(transparent)] Cos(#[from] pdfcraft_cos::CosError), } @@ -467,19 +469,223 @@ fn pdf_string(s: &str) -> Vec { v } +// Keep aliases as aliases instead of expanding a shared graph once per use. References are +// queued, not followed recursively, so cycles and long indirect chains cost linear work. +const MAX_FDF_OBJECTS: usize = 100_000; +const MAX_FDF_BYTES: usize = 64 * 1024 * 1024; + +/// Direct values stay borrowed: `Document::resolve` would deep-clone them. Only +/// indirect values need an owner, and annotation bodies are never retained in discovery. +enum FdfValue<'a> { + Borrowed(&'a Object), + Indirect(std::sync::Arc), +} + +impl<'a> FdfValue<'a> { + fn resolve(doc: &Document, value: &'a Object) -> Self { + match value { + Object::Ref(_) => Self::Indirect(doc.resolve(value)), + _ => Self::Borrowed(value), + } + } + + fn object(&self) -> &Object { + match self { + Self::Borrowed(value) => value, + Self::Indirect(value) => value.as_ref(), + } + } +} + +struct FdfCopy<'a> { + doc: &'a Document, + objects: Vec, + numbers: HashMap, + pending: Vec<(ObjRef, usize)>, + nodes: usize, + bytes: usize, +} + +impl<'a> FdfCopy<'a> { + fn new(doc: &'a Document) -> Self { + Self { doc, objects: Vec::new(), numbers: HashMap::new(), pending: Vec::new(), nodes: MAX_FDF_OBJECTS, bytes: MAX_FDF_BYTES } + } + + fn charge(&mut self, bytes: usize) -> Result<(), DataError> { + self.bytes = self.bytes.checked_sub(bytes).ok_or(DataError::ExportLimit("64 MiB data"))?; + Ok(()) + } + + fn slot(&mut self) -> Result<(usize, u32), DataError> { + if self.objects.len() >= MAX_FDF_OBJECTS { + return Err(DataError::ExportLimit("100,000 objects")); + } + // Object 1 is the FDF root; arena indices start at object 2. The arena is capped above. + let index = self.objects.len(); + let number = index as u32 + 2; + self.charge(100)?; // indirect-object and xref overhead + self.objects.push(Object::Null); + Ok((index, number)) + } + + fn dict(&mut self, dict: &Dict, depth: usize) -> Result { + if dict.len() > self.nodes { + return Err(DataError::ExportLimit("100,000 values")); + } + let mut out = Dict::new(); + for (key, value) in dict.iter() { + self.dict_entry(&mut out, key, value, depth + 1)?; + } + Ok(out) + } + + fn dict_entry(&mut self, out: &mut Dict, key: &[u8], value: &Object, depth: usize) -> Result<(), DataError> { + self.charge(key.len().saturating_mul(3).saturating_add(2))?; + let value = self.copy(value, depth)?; + out.set(key.to_vec(), value); + Ok(()) + } + + /// Skip source-document links and appearances without cloning their values. The + /// dictionary and every retained entry are charged before any owned copy is made. + fn annotation_dict(&mut self, dict: &Dict) -> Result { + self.charge_value(0)?; + let mut out = Dict::new(); + for (key, value) in dict.iter() { + if matches!(key.as_slice(), b"P" | b"AP" | b"Popup" | b"IRT" | b"Parent" | b"FS" | b"Sound") { + continue; + } + self.dict_entry(&mut out, key, value, 1)?; + } + Ok(out) + } + + fn charge_value(&mut self, depth: usize) -> Result<(), DataError> { + if depth > MAX_DEPTH { + return Err(DataError::ExportLimit("64 direct nesting levels")); + } + self.nodes = self.nodes.checked_sub(1).ok_or(DataError::ExportLimit("100,000 values"))?; + // Includes delimiters, spacing and even the longest finite f64 in plain decimal form. + self.charge(330)?; + Ok(()) + } + + fn is_source_page(&self, dict: &Dict) -> Result { + let Some(value) = dict.get(b"Type") else { return Ok(false) }; + let mut value = FdfValue::Borrowed(value); + let mut seen = HashSet::new(); + for hops in 0..=MAX_DEPTH { + match value.object() { + Object::Name(name) => return Ok(matches!(name.as_slice(), b"Page" | b"Pages")), + Object::Ref(reference) => { + if self.doc.generation(reference.num) != reference.generation || !seen.insert(*reference) { + return Ok(false); + } + if hops == MAX_DEPTH { + return Err(DataError::ExportLimit("64 Type reference levels")); + } + value = FdfValue::Indirect(self.doc.get(*reference)); + } + _ => return Ok(false), + } + } + Err(DataError::ExportLimit("64 Type reference levels")) + } + + fn copy(&mut self, value: &Object, depth: usize) -> Result { + self.charge_value(depth)?; + Ok(match value { + Object::Ref(source) => { + let number = if let Some(number) = self.numbers.get(source) { + *number + } else { + let (index, number) = self.slot()?; + self.numbers.insert(*source, number); + self.pending.push((*source, index)); + number + }; + Object::Ref(ObjRef::new(number, 0)) + } + Object::Array(values) => { + if values.len() > self.nodes { + return Err(DataError::ExportLimit("100,000 values")); + } + let mut out = Vec::new(); + for value in values { + out.push(self.copy(value, depth + 1)?); + } + Object::Array(out) + } + // Source page links must not drag page contents or the page tree into an FDF. + Object::Dict(dict) if self.is_source_page(dict)? => Object::Null, + Object::Dict(dict) => Object::Dict(self.dict(dict, depth)?), + Object::String(s) => { + self.charge(s.bytes.len().saturating_mul(4))?; + value.clone() + } + Object::Name(name) => { + self.charge(name.len().saturating_mul(3))?; + value.clone() + } + // A PDF stream can only be an indirect object, never a dictionary/array value. + Object::Stream(_) => return Err(DataError::Malformed("FDF export encountered a direct stream".into())), + other => other.clone(), + }) + } + + fn finish(&mut self, doc: &Document) -> Result<(), DataError> { + let mut cursor = 0; + while let Some((source, index)) = self.pending.get(cursor).copied() { + // ISO 32000-2 §7.3.10: an absent or stale reference denotes null. Keep reader + // errors distinct so damaged objects cannot be silently lost during export. + let value = if doc.generation(source.num) != source.generation { + std::sync::Arc::new(Object::Null) + } else { + match doc.try_get(source.num) { + Ok(value) => value, + Err(pdfcraft_cos::CosError::MissingObject(_)) => std::sync::Arc::new(Object::Null), + Err(error) => return Err(error.into()), + } + }; + let copied = match &*value { + Object::Stream(stream) => { + self.charge(stream.raw.len())?; + Object::Stream(pdfcraft_cos::Stream { dict: self.dict(&stream.dict, 0)?, raw: stream.raw.clone() }) + } + other => self.copy(other, 0)?, + }; + let slot = self.objects.get_mut(index).ok_or_else(|| DataError::Malformed("FDF object slot is missing".into()))?; + *slot = copied; + cursor += 1; + } + Ok(()) + } +} + /// FDF with field values and/or comments (appearances are not carried). Each comment is an /// indirect object of the FDF, so a reply's `/IRT` can point at its parent's object there -/// (§12.7.8.3.1); nothing else refers back into the source document. -pub fn export_fdf(doc: &Document, comments: bool, fields: bool, file: &str) -> Vec { +/// (§12.7.8.3.1). Nested values are copied and renumbered, including shared or cyclic graphs. +/// Source `/Page` and `/Pages` dictionaries become null at every copy depth. +/// Refuses exports above the object, value, direct-depth or data budget instead of losing data. +pub fn export_fdf(doc: &Document, comments: bool, fields: bool, file: &str) -> Result, DataError> { + let mut copy = FdfCopy::new(doc); + copy.charge(file.len().saturating_mul(8))?; let mut body: Vec = b"<< /FDF << ".to_vec(); // Comment dictionaries, written after the root as objects 2, 3, … - let mut annots: Vec = Vec::new(); if fields { body.extend_from_slice(b"/Fields ["); for f in pdfcraft_forms::fields(doc) { if matches!(f.kind, FieldKind::PushButton | FieldKind::Signature) { continue; } + // Field dictionary, /T string and /V scalar/array, plus every emitted list + // entry. Other field kinds emit only their first value (or a default). + let field_nodes = if matches!(f.kind, FieldKind::List) && f.value.len() > 1 { f.value.len().saturating_add(3) } else { 3 }; + copy.nodes = copy.nodes.checked_sub(field_nodes).ok_or(DataError::ExportLimit("100,000 values"))?; + copy.charge(f.name.len().saturating_mul(8).saturating_add(100))?; + for value in &f.value { + copy.charge(value.len().saturating_mul(8).saturating_add(100))?; + } body.extend_from_slice(b"<< /T "); body.extend(pdf_string(&f.name)); body.extend_from_slice(b" /V "); @@ -498,44 +704,61 @@ pub fn export_fdf(doc: &Document, comments: bool, fields: bool, file: &str) -> V body.extend_from_slice(b"] "); } if comments { - // Every exported comment with its source reference, numbered in export order. - let mut picked: Vec<(Option, Dict, usize)> = Vec::new(); - for (pi, p) in pdfcraft_model::pages(doc).iter().enumerate() { - for a in p.dict.get(b"Annots").map(|a| doc.resolve(a)).and_then(|a| a.as_array().cloned()).unwrap_or_default() { - let Some(d) = doc.resolve(&a).as_dict().cloned() else { continue }; - if d.name(b"Subtype").is_some_and(|sub| SUBTYPES.iter().any(|(s, _)| s.as_bytes() == sub)) { - picked.push((a.as_ref(), d, pi)); + // Keep the page/array owners once. Handles retain positions, never annotation + // bodies: the document cache can evict and reparse even a repeated source reference. + let pages = pdfcraft_model::pages(doc); + let mut arrays = Vec::new(); + let mut picked: Vec<(Option, usize, usize)> = Vec::new(); + for (pi, page) in pages.iter().enumerate() { + let owner = page.dict.get(b"Annots").map(|value| FdfValue::resolve(doc, value)); + let before = picked.len(); + if let Some(values) = owner.as_ref().and_then(|owner| owner.object().as_array()) { + for (ai, a) in values.iter().enumerate() { + let value = FdfValue::resolve(doc, a); + let Some(d) = value.object().as_dict() else { continue }; + if d.name(b"Subtype").is_some_and(|sub| SUBTYPES.iter().any(|(s, _)| s.as_bytes() == sub)) { + if picked.len() >= MAX_FDF_OBJECTS { + return Err(DataError::ExportLimit("100,000 comments")); + } + picked.push((a.as_ref(), pi, ai)); + } } } + // Empty/unselected arrays need no owner. Resolve subsequent pages only after + // this page passes the cap, rather than loading them all before discovery. + arrays.push(if picked.len() > before { owner } else { None }); } - let numbers: HashMap = - picked.iter().enumerate().filter_map(|(i, (r, _, _))| Some(((*r)?, u32::try_from(i).ok()?.checked_add(2)?))).collect(); - for (_, mut d, pi) in picked { + let mut numbers = HashMap::new(); + for (source, _, _) in &picked { + let (_, number) = copy.slot()?; + if let Some(source) = source { + numbers.insert(*source, number); + } + } + copy.numbers = numbers.clone(); + let count = picked.len(); + for (index, (_, pi, ai)) in picked.into_iter().enumerate() { + let annotation = arrays + .get(pi) + .and_then(Option::as_ref) + .and_then(|owner| owner.object().as_array()) + .and_then(|values| values.get(ai)) + .ok_or_else(|| DataError::Malformed("FDF annotation slot is missing".into()))?; + let value = FdfValue::resolve(doc, annotation); + let d = value.object().as_dict().ok_or_else(|| DataError::Malformed("FDF comment is not a dictionary".into()))?; // A reply points at its parent's object in this FDF; a parent that isn't exported // leaves the reply unthreaded. let irt = d.get(b"IRT").and_then(Object::as_ref).and_then(|r| numbers.get(&r)).copied(); - // Only direct values travel: references into this file would dangle. - for k in [&b"P"[..], b"AP", b"Popup", b"IRT", b"Parent", b"FS", b"Sound"] { - d.remove(k); - } - let keys: Vec> = d.iter().filter(|(_, v)| matches!(v, Object::Ref(_))).map(|(k, _)| k.clone()).collect(); - for k in keys { - let Some(o) = d.get(&k) else { continue }; - let v = (*doc.resolve(o)).clone(); - if matches!(v, Object::Stream(_)) { - d.remove(&k); - } else { - d.set(k, v); - } - } + let mut d = copy.annotation_dict(d)?; if let Some(num) = irt { d.set(b"IRT".to_vec(), Object::Ref(ObjRef::new(num, 0))); } d.set(b"Page".to_vec(), Object::Int(pi as i64)); - annots.push(d); + let slot = copy.objects.get_mut(index).ok_or_else(|| DataError::Malformed("FDF comment slot is missing".into()))?; + *slot = Object::Dict(d); } body.extend_from_slice(b"/Annots ["); - for i in 0..annots.len() { + for i in 0..count { let _ = write!(body, "{} 0 R ", i + 2); } body.extend_from_slice(b"] "); @@ -543,16 +766,17 @@ pub fn export_fdf(doc: &Document, comments: bool, fields: bool, file: &str) -> V body.extend_from_slice(b"/F "); body.extend(pdf_string(file)); body.extend_from_slice(b" >> >>"); + copy.finish(doc)?; let mut out = b"%FDF-1.2\n%\xE2\xE3\xCF\xD3\n".to_vec(); - let mut offsets = Vec::with_capacity(annots.len() + 1); + let mut offsets = Vec::with_capacity(copy.objects.len() + 1); offsets.push(out.len()); out.extend_from_slice(b"1 0 obj\n"); out.extend(body); out.extend_from_slice(b"\nendobj\n"); - for (i, d) in annots.into_iter().enumerate() { + for (i, object) in copy.objects.into_iter().enumerate() { offsets.push(out.len()); let _ = writeln!(out, "{} 0 obj", i + 2); - pdfcraft_cos::serialize(&Object::Dict(d), &mut out); + pdfcraft_cos::serialize(&object, &mut out); out.extend_from_slice(b"\nendobj\n"); } let xref = out.len(); @@ -561,7 +785,7 @@ pub fn export_fdf(doc: &Document, comments: bool, fields: bool, file: &str) -> V let _ = writeln!(out, "{o:010} 00000 n "); } let _ = write!(out, "trailer\n<< /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n"); - out + Ok(out) } /// XML 1.0 fifth-edition NameStartChar, excluding `:` for an unprefixed NCName. /// https://www.w3.org/TR/2008/REC-xml-20081126/#NT-NameStartChar diff --git a/crates/xfdf/src/tests.rs b/crates/xfdf/src/tests.rs index a4f6abb2d3..c33c115e75 100644 --- a/crates/xfdf/src/tests.rs +++ b/crates/xfdf/src/tests.rs @@ -311,7 +311,7 @@ fn xfdf_round_trips_comments_and_values() { #[test] fn fdf_round_trips_values_and_comments() { let src = filled(); - let fdf = export_fdf(&src, true, true, "form.pdf"); + let fdf = export_fdf(&src, true, true, "form.pdf").unwrap(); assert!(fdf.starts_with(b"%FDF-1.2")); let mut dst = blank(); let r = import(&mut dst, &fdf).unwrap(); @@ -353,7 +353,7 @@ fn non_utf8_check_box_states_round_trip() { let mut src = shift_jis_check_box(); set_value(&mut src, "agree", &FieldValue::Check(true)).unwrap(); // FDF writes the state's own bytes, not its #XX text. - let fdf = export_fdf(&src, false, true, "form.pdf"); + let fdf = export_fdf(&src, false, true, "form.pdf").unwrap(); let name: &[u8] = b"/#82#CD#82#A2"; assert!(fdf.windows(name.len()).any(|w| w == name), "{}", String::from_utf8_lossy(&fdf)); for data in [fdf, export_xfdf(&src, false, true, "form.pdf").into_bytes()] { @@ -389,7 +389,7 @@ fn fdf_keeps_replies_and_review_status_on_their_note() { let want = threads(&src); assert_eq!(want.iter().filter(|t| t.1.as_deref() == Some("note")).count(), 3, "{want:?}"); - let fdf = export_fdf(&src, true, false, "notes.pdf"); + let fdf = export_fdf(&src, true, false, "notes.pdf").unwrap(); // Every cross-reference entry points at its object (other readers trust the table). let tail = std::str::from_utf8(&fdf[fdf.windows(5).position(|w| w == b"xref\n").unwrap()..]).unwrap(); let xref: usize = tail.lines().skip_while(|l| *l != "startxref").nth(1).unwrap().parse().unwrap(); @@ -648,7 +648,7 @@ fn bad_data_is_refused_with_a_reason() { fn data_files_merge_into_a_spreadsheet() { let src = filled(); let xfdf = export_xfdf(&src, false, true, "form.pdf"); - let fdf = export_fdf(&src, false, true, "form.pdf"); + let fdf = export_fdf(&src, false, true, "form.pdf").unwrap(); let mut other = blank(); set_value(&mut other, "Name", &FieldValue::Text("Grace \"Amazing\" Hopper, RADM".into())).unwrap(); let pdf = pdfcraft_cos::write_full(&other, &Default::default()).unwrap(); @@ -718,7 +718,7 @@ fn replacing_a_note_keeps_existing_replies_and_review_status() { ) .unwrap(); let original = Arc::new(write_full(&original, &SaveOptions::default()).unwrap()); - for data in [xfdf.as_bytes().to_vec(), export_fdf(&incoming, true, false, "notes.pdf")] { + for data in [xfdf.as_bytes().to_vec(), export_fdf(&incoming, true, false, "notes.pdf").unwrap()] { // Start with the parent, reply and review status in the existing PDF revision. let mut doc = Document::open(original.clone()).unwrap(); let mut want = threads(&doc); @@ -741,7 +741,7 @@ fn replacing_a_note_keeps_existing_replies_and_review_status() { let reopened = Document::open(Arc::new(saved)).unwrap(); let note = summaries(&reopened).into_iter().find(|s| s.name.as_deref() == Some("n1")).unwrap(); assert_eq!(note.contents.as_deref(), Some("Updated note")); - let fdf = export_fdf(&reopened, true, false, "notes.pdf"); + let fdf = export_fdf(&reopened, true, false, "notes.pdf").unwrap(); let mut dst = blank(); import(&mut dst, &fdf).unwrap(); let mut got = threads(&dst); @@ -785,7 +785,7 @@ fn replacing_an_indirectly_named_note_preserves_its_identity_and_thread() { let original = Arc::new(write_full(&original, &SaveOptions::default()).unwrap()); let mut incoming = blank(); import(&mut incoming, update).unwrap(); - for data in [update.to_vec(), export_fdf(&incoming, true, false, "notes.pdf")] { + for data in [update.to_vec(), export_fdf(&incoming, true, false, "notes.pdf").unwrap()] { let mut doc = Document::open(original.clone()).unwrap(); let refs = annotation_refs(&doc); assert_eq!(refs.len(), 3); @@ -848,7 +848,7 @@ fn the_last_same_named_record_controls_its_reply_parent() { refs.push(incoming.add(d)); } incoming.update_dict(page, |p| p.set(b"Annots".to_vec(), Object::Array(refs.into_iter().map(Object::Ref).collect()))).unwrap(); - for data in [export_xfdf(&incoming, true, false, "notes.pdf").into_bytes(), export_fdf(&incoming, true, false, "notes.pdf")] { + for data in [export_xfdf(&incoming, true, false, "notes.pdf").into_bytes(), export_fdf(&incoming, true, false, "notes.pdf").unwrap()] { let mut doc = blank(); import(&mut doc, &data).unwrap(); let notes = summaries(&doc); @@ -1156,6 +1156,238 @@ fn xfdf_import_keeps_text_around_xml_comments_and_instructions() { } } +#[test] +fn fdf_export_keeps_indirect_values_nested_in_annotation_properties() { + let mut src = blank(); + let page = pdfcraft_model::pages(&src)[0].obj; + let mut annotation = Dict::new(); + annotation.set(b"Type".to_vec(), Object::name("Annot")); + annotation.set(b"Subtype".to_vec(), Object::name("Square")); + annotation.set(b"NM".to_vec(), PdfString::text("indirect-values")); + let rect = [50.0, 60.0, 100.0, 120.0].map(|v| Object::Ref(src.add(Object::Real(v)))); + annotation.set(b"Rect".to_vec(), Object::Array(rect.into())); + let color = [0.25, 0.5, 0.75].map(|v| Object::Ref(src.add(Object::Real(v)))); + annotation.set(b"C".to_vec(), Object::Array(color.into())); + let mut border = Dict::new(); + border.set(b"W".to_vec(), Object::Ref(src.add(Object::Real(2.5)))); + border.set(b"S".to_vec(), Object::name("D")); + let dash = [3.0, 2.0].map(|v| Object::Ref(src.add(Object::Real(v)))); + border.set(b"D".to_vec(), Object::Ref(src.add(Object::Array(dash.into())))); + annotation.set(b"BS".to_vec(), Object::Ref(src.add(border))); + let note = src.add(annotation); + src.update_dict(page, |p| p.set(b"Annots".to_vec(), Object::Array(vec![Object::Ref(note)]))).unwrap(); + + // This is an actual saved PDF: indirect scalar numbers, arrays and dictionaries are legal + // PDF objects, and source object numbers have no meaning in an exported FDF. + let src = Document::open(Arc::new(write_full(&src, &SaveOptions::default()).unwrap())).unwrap(); + assert_eq!(summaries(&src)[0].rect, [50.0, 60.0, 100.0, 120.0]); + assert_eq!(summaries(&src)[0].color, Some([0.25, 0.5, 0.75])); + let fdf = export_fdf(&src, true, false, "source.pdf").unwrap(); + let exported = Document::open(Arc::new(fdf.clone())).unwrap(); + let body = fdf_body(&exported).unwrap(); + let annots = exported.resolve(body.get(b"Annots").unwrap()); + let note = exported.resolve(&annots.as_array().unwrap()[0]); + let d = note.as_dict().unwrap(); + assert_eq!(nums_of(&exported, d.get(b"Rect")), [50.0, 60.0, 100.0, 120.0], "{}", String::from_utf8_lossy(&fdf)); + assert_eq!(nums_of(&exported, d.get(b"C")), [0.25, 0.5, 0.75]); + let bs = exported.resolve(d.get(b"BS").unwrap()); + let bs = bs.as_dict().unwrap(); + assert_eq!(exported.resolve(bs.get(b"W").unwrap()).as_f64(), Some(2.5)); + assert_eq!(nums_of(&exported, bs.get(b"D")), [3.0, 2.0]); + + let mut dst = blank(); + import(&mut dst, &fdf).unwrap(); + let dst = Document::open(Arc::new(write_full(&dst, &SaveOptions::default()).unwrap())).unwrap(); + let notes = summaries(&dst); + assert_eq!(notes[0].rect, [50.0, 60.0, 100.0, 120.0]); + assert_eq!(notes[0].color, Some([0.25, 0.5, 0.75])); +} + +/// Put extension data on a real exported comment without changing its normal properties. +fn fdf_note_with_data(doc: &mut Document, data: Object) { + let page = pdfcraft_model::pages(doc)[0].obj; + let mut note = Dict::new(); + note.set(b"Type".to_vec(), Object::name("Annot")); + note.set(b"Subtype".to_vec(), Object::name("Square")); + note.set(b"Rect".to_vec(), Object::Array(vec![10.into(), 20.into(), 30.into(), 40.into()])); + note.set(b"PCData".to_vec(), data); + let note = doc.add(note); + doc.update_dict(page, |dict| dict.set(b"Annots".to_vec(), Object::Array(vec![Object::Ref(note)]))).unwrap(); +} + +fn exported_note_data(doc: &Document) -> Object { + let body = fdf_body(doc).unwrap(); + let annots = doc.resolve(body.get(b"Annots").unwrap()); + let note = doc.resolve(&annots.as_array().unwrap()[0]); + note.as_dict().unwrap().get(b"PCData").unwrap().clone() +} + +#[test] +fn fdf_export_preserves_shared_cycles_and_nested_streams_without_expansion() { + let mut src = blank(); + let leaf = src.add(PdfString::text("shared")); + let mut shared = leaf; + for _ in 0..35 { + shared = src.add(Object::Array(vec![Object::Ref(shared), Object::Ref(shared)])); + } + let cycle = src.add(Object::Null); + src.set(cycle, Object::Array(vec![Object::Ref(cycle)])); + let mut stream_dict = Dict::new(); + stream_dict.set(b"PCMeta".to_vec(), Object::Ref(leaf)); + let stream = src.add(pdfcraft_cos::Stream::from_raw(stream_dict, b"original bytes".to_vec())); + let data = Object::Array(vec![Object::Ref(shared), Object::Ref(shared), Object::Ref(cycle), Object::Ref(stream)]); + fdf_note_with_data(&mut src, data); + let src = Document::open(Arc::new(write_full(&src, &SaveOptions::default()).unwrap())).unwrap(); + let bytes = export_fdf(&src, true, false, "source.pdf").unwrap(); + assert!(bytes.len() < 10_000, "a shared graph must not expand"); + let fdf = Document::open(Arc::new(bytes)).unwrap(); + let data = exported_note_data(&fdf); + let data = data.as_array().unwrap(); + assert_eq!(data[0], data[1]); + let mut current = data[0].clone(); + for _ in 0..35 { + let next = fdf.resolve(¤t); + let values = next.as_array().unwrap(); + assert_eq!(values[0], values[1]); + current = values[0].clone(); + } + assert_eq!(fdf.resolve(¤t).as_string().unwrap().to_text(), "shared"); + let cycle = fdf.resolve(&data[2]); + assert_eq!(cycle.as_array().unwrap()[0], data[2]); + let stream = fdf.resolve(&data[3]); + let Object::Stream(stream) = &*stream else { panic!("copied stream") }; + assert_eq!(&*stream.raw, b"original bytes"); + assert_eq!(fdf.resolve(stream.dict.get(b"PCMeta").unwrap()).as_string().unwrap().to_text(), "shared"); +} + +#[test] +fn fdf_export_walks_long_indirect_chains_and_nulls_absent_or_stale_refs() { + let mut src = blank(); + let live = src.add(PdfString::text("live")); + let mut head = live; + for _ in 0..3_000 { + head = src.add(Object::Array(vec![Object::Ref(head)])); + } + fdf_note_with_data(&mut src, Object::Array(vec![Object::Ref(head), Object::Ref(ObjRef::new(999_999, 0)), Object::Ref(ObjRef::new(live.num, 1))])); + let fdf = Document::open(Arc::new(export_fdf(&src, true, false, "source.pdf").unwrap())).unwrap(); + let data = exported_note_data(&fdf); + let data = data.as_array().unwrap(); + assert_eq!(*fdf.resolve(&data[1]), Object::Null); + assert_eq!(*fdf.resolve(&data[2]), Object::Null); + let mut current = data[0].clone(); + for _ in 0..3_000 { + current = fdf.resolve(¤t).as_array().unwrap()[0].clone(); + } + assert_eq!(fdf.resolve(¤t).as_string().unwrap().to_text(), "live"); +} + +#[test] +fn fdf_export_refuses_excessive_direct_depth_values_and_payload() { + let mut src = blank(); + let mut deep = Object::Null; + for _ in 0..70 { + deep = Object::Array(vec![deep]); + } + fdf_note_with_data(&mut src, deep); + assert_eq!(export_fdf(&src, true, false, "source.pdf"), Err(DataError::ExportLimit("64 direct nesting levels"))); + // Not exporting comments must not inspect their extension data. + assert!(export_fdf(&src, false, true, "source.pdf").is_ok()); + + let mut src = blank(); + fdf_note_with_data(&mut src, Object::Array(vec![Object::Null; MAX_FDF_OBJECTS + 1])); + assert_eq!(export_fdf(&src, true, false, "source.pdf"), Err(DataError::ExportLimit("100,000 values"))); + + let mut src = blank(); + let stream = src.add(pdfcraft_cos::Stream::from_raw(Dict::new(), vec![0; MAX_FDF_BYTES + 1])); + fdf_note_with_data(&mut src, Object::Ref(stream)); + assert_eq!(export_fdf(&src, true, false, "source.pdf"), Err(DataError::ExportLimit("64 MiB data"))); + + let mut src = blank(); + // Strings need up to four serialized bytes per source byte. Refuse before copying + // the direct payload, just as the indirect stream case above refuses its raw data. + fdf_note_with_data(&mut src, Object::String(PdfString::literal(vec![b'x'; MAX_FDF_BYTES / 4 + 1]))); + assert_eq!(export_fdf(&src, true, false, "source.pdf"), Err(DataError::ExportLimit("64 MiB data"))); +} + +#[test] +fn fdf_export_refuses_aliases_before_cloning_large_annotation_values() { + let mut src = blank(); + fdf_note_with_data(&mut src, Object::Array(vec![Object::Null; 1_024])); + let page = pdfcraft_model::pages(&src)[0].obj; + let annots = src.get(page).as_dict().unwrap().get(b"Annots").unwrap().clone(); + let note = annots.as_array().unwrap()[0].as_ref().unwrap(); + // The source holds one 1,024-value dictionary. The aliases must not clone its + // values a hundred thousand times before the comment-count refusal is reached. + src.update_dict(page, |dict| dict.set(b"Annots".to_vec(), Object::Array(vec![Object::Ref(note); MAX_FDF_OBJECTS + 1]))).unwrap(); + assert_eq!(export_fdf(&src, true, false, "source.pdf"), Err(DataError::ExportLimit("100,000 comments"))); +} + +#[test] +fn fdf_export_refuses_repeated_saved_annotations_after_cache_eviction() { + let bytes = { + let mut src = blank(); + let page = pdfcraft_model::pages(&src)[0].obj; + let mut notes = Vec::new(); + // More than the editor cache's 1,024 objects. Four passes force reparsing; + // retaining each resolved body during discovery would pin all four copies. + for _ in 0..1_025 { + let mut note = Dict::new(); + note.set(b"Type".to_vec(), Object::name("Annot")); + note.set(b"Subtype".to_vec(), Object::name("Square")); + note.set(b"Rect".to_vec(), Object::Array(vec![10.into(), 20.into(), 30.into(), 40.into()])); + note.set(b"PCData".to_vec(), Object::Array(vec![Object::Null; 1_024])); + notes.push(Object::Ref(src.add(note))); + } + let aliases = (0..4).flat_map(|_| notes.iter().cloned()).collect(); + src.update_dict(page, |dict| dict.set(b"Annots".to_vec(), Object::Array(aliases))).unwrap(); + write_full(&src, &SaveOptions { object_streams: false, ..SaveOptions::default() }).unwrap() + }; + // Drop the overlay-backed source before reopening: its persistent Arc objects + // would hide the parsed-object cache eviction exercised by this fixture. + let src = Document::open(Arc::new(bytes)).unwrap(); + assert!(src.repair_log().is_empty()); + assert_eq!(export_fdf(&src, true, false, "source.pdf"), Err(DataError::ExportLimit("100,000 values"))); +} + +#[test] +fn fdf_export_counts_emitted_field_values_before_allocating_lists() { + let field_document = |kind: &str, count: usize| { + let mut doc = Document::new_empty(); + let mut field = Dict::new(); + field.set(b"FT".to_vec(), Object::name(kind)); + field.set(b"T".to_vec(), PdfString::text("Pick")); + field.set(b"Ff".to_vec(), Object::Int(1 << 21)); // multi-select for a /Ch list + field.set(b"V".to_vec(), Object::Array(vec![Object::String(PdfString::text("")); count])); + let field = doc.add(field); + let mut form = Dict::new(); + form.set(b"Fields".to_vec(), Object::Array(vec![Object::Ref(field)])); + doc.update_dict(doc.root().unwrap(), |root| root.set(b"AcroForm".to_vec(), Object::Dict(form))).unwrap(); + assert_eq!(fields(&doc)[0].value.len(), count); + doc + }; + + // A field dictionary, /T string and /V array use three nodes before its entries. + let doc = field_document("Ch", MAX_FDF_OBJECTS - 3); + assert_eq!(fields(&doc)[0].kind, FieldKind::List); + let bytes = export_fdf(&doc, false, true, "field.pdf").unwrap(); + assert_eq!(data_values(&bytes).unwrap()[0].1.len(), MAX_FDF_OBJECTS - 3); + for count in [MAX_FDF_OBJECTS - 2, MAX_FDF_OBJECTS + 1] { + let doc = field_document("Ch", count); + assert!(matches!(export_fdf(&doc, false, true, "field.pdf"), Err(DataError::ExportLimit("100,000 values")))); + } + + // A hostile array on a scalar field still emits just its first string. The node + // budget counts output values, rather than charging entries that are not copied. + let doc = field_document("Tx", MAX_FDF_OBJECTS + 1); + assert_eq!(fields(&doc)[0].kind, FieldKind::Text); + let bytes = export_fdf(&doc, false, true, "field.pdf").unwrap(); + let fdf = Document::open(Arc::new(bytes)).unwrap(); + let body = fdf_body(&fdf).unwrap(); + let exported = fdf.resolve(body.get(b"Fields").unwrap()); + let exported = fdf.resolve(&exported.as_array().unwrap()[0]); + assert!(matches!(exported.as_dict().unwrap().get(b"V"), Some(Object::String(_)))); +} + #[test] fn xml_form_import_preserves_text_around_comments_and_instructions() { for (body, expected) in [ @@ -1187,6 +1419,132 @@ fn xml_form_import_preserves_text_around_comments_and_instructions() { } } +#[test] +fn fdf_export_nulls_nested_page_links_without_copying_the_source_page_tree() { + for indirect_type in [false, true] { + let source = { + let mut doc = Document::new_empty(); + let root = doc.root().unwrap(); + let tree = doc.get(root).as_dict().unwrap().reference(b"Pages").unwrap(); + let mut pages = Vec::new(); + for _ in 0..3 { + let contents = doc.add(pdfcraft_cos::Stream::from_raw( + Dict::new(), + b"% source-page-content-must-stay-in-the-PDF\nq 0 g 0 0 10 10 re f Q\n".repeat(1_024), + )); + let mut page = Dict::new(); + let page_type = if indirect_type { Object::Ref(doc.add(Object::name("Page"))) } else { Object::name("Page") }; + page.set(b"Type".to_vec(), page_type); + page.set(b"Parent".to_vec(), Object::Ref(tree)); + page.set(b"MediaBox".to_vec(), Object::Array(vec![0.into(), 0.into(), 600.into(), 800.into()])); + page.set(b"Contents".to_vec(), Object::Ref(contents)); + pages.push(doc.add(page)); + } + let tree_type = if indirect_type { Object::Ref(doc.add(Object::name("Pages"))) } else { Object::name("Pages") }; + doc.update_dict(tree, |dict| { + dict.set(b"Type".to_vec(), tree_type); + dict.set(b"Count".to_vec(), Object::Int(3)); + dict.set(b"Kids".to_vec(), Object::Array(pages.iter().copied().map(Object::Ref).collect())); + }) + .unwrap(); + let mut action = Dict::new(); + action.set(b"S".to_vec(), Object::name("GoTo")); + action.set(b"D".to_vec(), Object::Array(vec![Object::Ref(pages[1]), Object::name("Fit")])); + let mut extension = Dict::new(); + extension.set(b"Type".to_vec(), Object::name("PCMetadata")); + extension.set(b"Target".to_vec(), Object::Ref(pages[1])); + extension.set(b"Label".to_vec(), PdfString::text("retained metadata")); + let extension = doc.add(extension); + let type_cycle = doc.add(Object::Null); + doc.set(type_cycle, Object::Ref(type_cycle)); + let mut cyclic_type = Dict::new(); + cyclic_type.set(b"Type".to_vec(), Object::Ref(type_cycle)); + cyclic_type.set(b"Label".to_vec(), PdfString::text("cyclic type is not a page")); + fdf_note_with_data( + &mut doc, + Object::Array(vec![Object::Dict(action), Object::Ref(extension), Object::Array(vec![Object::Ref(tree)]), Object::Dict(cyclic_type)]), + ); + write_full(&doc, &SaveOptions::default()).unwrap() + }; + let source = Document::open(Arc::new(source)).unwrap(); + assert!(source.repair_log().is_empty()); + assert_eq!(pdfcraft_model::pages(&source).len(), 3); + let bytes = export_fdf(&source, true, false, "source.pdf").unwrap(); + assert!(bytes.len() < 4_096, "a comment export must not carry source pages or their content ({} bytes)", bytes.len()); + let fdf = Document::open(Arc::new(bytes)).unwrap(); + let data = exported_note_data(&fdf); + let data = data.as_array().unwrap(); + let action = data[0].as_dict().unwrap(); + assert_eq!(action.name(b"S"), Some(b"GoTo".as_slice())); + let destination = action.get(b"D").unwrap().as_array().unwrap(); + assert_eq!(*fdf.resolve(&destination[0]), Object::Null); + assert_eq!(destination[1], Object::name("Fit")); + let extension = fdf.resolve(&data[1]); + let extension = extension.as_dict().unwrap(); + assert_eq!(extension.name(b"Type"), Some(b"PCMetadata".as_slice())); + assert_eq!(extension.get(b"Target"), Some(&destination[0]), "the excluded page reference remains aliased"); + assert_eq!(extension.get(b"Label").unwrap().as_string().unwrap().to_text(), "retained metadata"); + let tree = data[2].as_array().unwrap(); + assert_eq!(*fdf.resolve(&tree[0]), Object::Null); + + let cyclic_type = data[3].as_dict().unwrap(); + assert_eq!(cyclic_type.get(b"Label").unwrap().as_string().unwrap().to_text(), "cyclic type is not a page"); + let type_cycle = cyclic_type.get(b"Type").unwrap(); + assert_eq!(&*fdf.resolve(type_cycle), type_cycle); + } +} + +#[test] +fn fdf_export_bounds_indirect_type_alias_lookups() { + for extra_aliases in [MAX_DEPTH - 1, MAX_DEPTH] { + let mut doc = blank(); + let mut page_type = doc.add(Object::name("Page")); + for _ in 0..extra_aliases { + page_type = doc.add(Object::Ref(page_type)); + } + let mut page = Dict::new(); + page.set(b"Type".to_vec(), Object::Ref(page_type)); + fdf_note_with_data(&mut doc, Object::Dict(page)); + let exported = export_fdf(&doc, true, false, ""); + if extra_aliases < MAX_DEPTH { + let fdf = Document::open(Arc::new(exported.unwrap())).unwrap(); + assert_eq!(exported_note_data(&fdf), Object::Null); + } else { + assert!(matches!(exported, Err(DataError::ExportLimit("64 Type reference levels")))); + } + } +} + +#[test] +fn fdf_export_preserves_metadata_with_stale_type_references() { + for alias in [false, true] { + let mut doc = blank(); + let current = doc.add(Object::name("Page")); + doc.update_dict(doc.root().unwrap(), |dict| dict.set(b"PCPageType".to_vec(), Object::Ref(current))).unwrap(); + let mut doc = Document::open(Arc::new(write_full(&doc, &SaveOptions::default()).unwrap())).unwrap(); + let current = doc.get(doc.root().unwrap()).as_dict().unwrap().reference(b"PCPageType").unwrap(); + let stale = ObjRef::new(current.num, current.generation + 1); + let page_type = if alias { doc.add(Object::Ref(stale)) } else { stale }; + let mut metadata = Dict::new(); + metadata.set(b"Type".to_vec(), Object::Ref(page_type)); + metadata.set(b"Label".to_vec(), PdfString::text("preserved despite stale type")); + fdf_note_with_data(&mut doc, Object::Dict(metadata)); + assert_eq!(doc.generation(stale.num), current.generation); + // A warm number-keyed cache must not make the stale Type reference live. + assert_eq!(*doc.try_get(stale.num).unwrap(), Object::name("Page")); + let bytes = export_fdf(&doc, true, false, "").unwrap(); + let fdf = Document::open(Arc::new(bytes)).unwrap(); + let data = exported_note_data(&fdf); + let metadata = data.as_dict().expect("stale Type must not classify unrelated metadata as a source page"); + assert_eq!(metadata.get(b"Label").unwrap().as_string().unwrap().to_text(), "preserved despite stale type"); + let mut page_type = fdf.resolve(metadata.get(b"Type").unwrap()); + if alias { + page_type = fdf.resolve(&page_type); + } + assert_eq!(*page_type, Object::Null); + } +} + #[test] fn csv_headers_with_tabs_survive_export_import_and_save() { for name in ["First\tName", "\tName", "Name\t", "Name\t\"quoted\"", "Name\nwith\ta tab"] { diff --git a/docs/roadmap.md b/docs/roadmap.md index 19bfac9f14..5d73511e9c 100644 --- a/docs/roadmap.md +++ b/docs/roadmap.md @@ -1,5 +1,6 @@ # PdfCraft roadmap: milestones and what's next +> **Last reviewed:** 2026-10-18 · **Last updated:** 2026-10-18 · **Change:** minor (M5, PR #1971: bounded nested FDF export excludes source page/page-tree dictionaries; refreshed against upstream 4db6ac4a; estimates unchanged) > **Last reviewed:** 2026-10-15 · **Last updated:** 2026-10-15 · **Change:** minor (M14/#2383 GPU-limit candidate; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS) > **Last reviewed:** 2026-10-15 · **Last updated:** 2026-10-15 · **Change:** minor (M7: the Edit text caret is as tall as the row it is on; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS) > **Last reviewed:** 2026-10-15 · **Last updated:** 2026-10-15 · **Change:** minor (M6: CSV tab-containing headers; estimates unchanged) @@ -131,7 +132,7 @@ total matches the parity estimate. | M5 | Comments (all annotation types, XFDF) | 120–200 | 88% | 12–25 | Done: notes, highlight/underline/strikeout/squiggly, text boxes, ink, lines, arrows, rectangles, ovals, stamps (dynamic, Sign Here, Standard Business), with appearance streams; replies, status, checkmarks, locking, move/resize/restyle/delete; properties dialog; panel filter and sort; hide all; summaries (comments only); XFDF/FDF import and export (partial imports preserve existing reply and review-status links); flatten; Fill & Sign with adjustable text/date size; agent tools.
Done since: stamps placed on a rotated page read upright (#1398); polygons, connected lines, clouds, callouts, inserted text, colour and checkmark filters; image signature pointer previews, selection handles and live image movement/resizing with proportional corners and independent edge handles; Ctrl+Enter submission for highlight comment text and replies, with Shift+Enter newlines (reconciled with upstream main for PR #1457 on 2026-10-14). Missing: custom stamps, replace-text proposals, summary layouts with the page | | M4 | Engine, history, save, organize | 100–180 | 95% | 8–15 | Done:
- command registry (menus, shortcuts and palette all use it);
- undo/redo; incremental, atomic and encrypted saves;
- autosave and crash recovery;
- organize, combine, extract, split and insert-from-file, with identical fonts and images stored once;
- CLI `edit/combine/extract/split`.
Done since: Combine files in its own tab (sortable, resizable columns; folders; early warnings; unlocking protected files), bookmark editing, page labels (Number pages), CLI `run`, Set Page Boxes, Crop tool, Duplicate pages, Ctrl+A / Cmd+A to select all pages in Organize, Replace pages, bookmarks from tagged headings. Missing: page transitions, recovery on the web M4: Insert-from-file preserves source bookmarks; integration tests retained with current main. | | M5 | Comments (all annotation types, XFDF) | 120–200 | 88% | 12–25 | Done: notes, highlight/underline/strikeout/squiggly, text boxes, ink, lines, arrows, rectangles, ovals, stamps (dynamic, Sign Here, Standard Business), with appearance streams; replies, status, checkmarks, locking, move/resize/restyle/delete; properties dialog; panel filter and sort; hide all; summaries (comments only); XFDF/FDF import and export (partial imports preserve existing reply and review-status links); flatten; Fill & Sign with adjustable text/date size; agent tools.
Done since: stamps placed on a rotated page read upright (#1398); polygons, connected lines, clouds, callouts, inserted text, colour and checkmark filters; image signature pointer previews, selection handles and live image movement/resizing with proportional corners and independent edge handles. Missing: custom stamps, replace-text proposals, summary layouts with the page | -| M5 | Comments (all annotation types, XFDF) | 120–200 | 88% | 12–25 | Done: notes, highlight/underline/strikeout/squiggly, text boxes, ink, lines, arrows, rectangles, ovals, stamps (dynamic, Sign Here, Standard Business), with appearance streams; replies, status, checkmarks, locking, move/resize/restyle/delete; properties dialog; panel filter and sort; hide all; summaries (comments only); XFDF/FDF import and export (partial imports preserve existing reply and review-status links); flatten; Fill & Sign with adjustable text/date size; agent tools.
Done since: polygons, connected lines, clouds, callouts, inserted text, colour and checkmark filters; image signature pointer previews, selection handles and live image movement/resizing with proportional corners and independent edge handles. A refused restyle or resize of a text box another program drew leaves that comment unchanged (#1327). Make Current Properties Default on an arrow updates arrows, not plain lines (#1302). Flattening keeps a visible comment it cannot draw (#1317). Missing: custom stamps, replace-text proposals, summary layouts with the page | +| M5 | Comments (all annotation types, XFDF) | 120–200 | 88% | 12–25 | Done: notes, highlight/underline/strikeout/squiggly, text boxes, ink, lines, arrows, rectangles, ovals, stamps (dynamic, Sign Here, Standard Business), with appearance streams; replies, status, checkmarks, locking, move/resize/restyle/delete; properties dialog; panel filter and sort; hide all; summaries (comments only); XFDF/FDF import and export (partial imports preserve existing reply and review-status links; nested FDF export uses lazy array owners and annotation positions, with retained entries budgeted before cloning under copied-graph limits and source `/Page` and `/Pages` dictionaries replaced by null at every copy depth); flatten; Fill & Sign with adjustable text/date size; agent tools.
Done since: polygons, connected lines, clouds, callouts, inserted text, colour and checkmark filters; image signature pointer previews, selection handles and live image movement/resizing with proportional corners and independent edge handles. A refused restyle or resize of a text box another program drew leaves that comment unchanged (#1327). Make Current Properties Default on an arrow updates arrows, not plain lines (#1302). Flattening keeps a visible comment it cannot draw (#1317). Missing: custom stamps, replace-text proposals, summary layouts with the page | | M6 | Forms + JavaScript | 160–320 | 50% | 40–75 | Done: filling all field types with regenerated appearances; Prepare a form (every field type, multi-select/shared properties, move/resize/delete, Field Properties General/Appearance/Position/Options/Format/Validate/Calculate); Acrobat's AF format/keystroke/validate/calculate functions and simplified field notation run natively in Acrobat's event order; tab order; push-button actions; flatten; agent tools. Form data exchange (FDF, XFDF, XML, CSV, text) done; XFDF values retain text across XML comments and processing instructions. Plain AcroForm XML imports retain all direct text around comments and processing instructions, including CDATA and character references. CSV export and spreadsheet merging quote tabs, and import distinguishes quoted tabs from TSV delimiters without changing field identities. XML/XFDF exports preserve tabs and line breaks in names and comment metadata. Refreshed against upstream `99941daa` (2026-10-15).
Done since: JavaScript engine (boa, sandboxed) running custom keystroke/validate/calculate/format and button scripts, document JavaScripts, console. Done since: Push-button normal labels are editable per widget through Options and form_set_props, independently of field names; rendering, undo/redo and incremental/full save/reopen are covered. (#2892). Missing: Actions tab, wider object model (annotations, layers, dialogs), XFA
Done since: Multi-select choice fields write ascending `/I` option indices while preserving `/V` selection order; synthetic forms/engine regressions cover reverse selection and save/reopen. CSV export preserves carriage returns in names and values. | | M6 | Forms + JavaScript | 160–320 | 50% | 40–75 | Done: filling all field types with regenerated appearances; Prepare a form (every field type, multi-select/shared properties, move/resize/delete, Field Properties General/Appearance/Position/Options/Format/Validate/Calculate); Acrobat's AF format/keystroke/validate/calculate functions and simplified field notation run natively in Acrobat's event order; tab order; push-button actions; flatten; agent tools. Form data exchange (FDF, XFDF, XML, CSV, text) done; XFDF values retain text across XML comments and processing instructions. Plain AcroForm XML imports retain all direct text around comments and processing instructions, including CDATA and character references.
Done since: JavaScript engine (boa, sandboxed) running custom keystroke/validate/calculate/format and button scripts, document JavaScripts, console. Missing: Actions tab, wider object model (annotations, layers, dialogs), XFA
Done since: Multi-select choice fields write ascending `/I` option indices while preserving `/V` selection order; synthetic forms/engine regressions cover reverse selection and save/reopen. CSV export preserves carriage returns in names and values. | | M6 | Forms + JavaScript | 160–320 | 50% | 40–75 | Done: filling all field types with regenerated appearances; Prepare a form (every field type, multi-select/shared properties, move/resize/delete, Field Properties General/Appearance/Position/Options/Format/Validate/Calculate); Acrobat's AF format/keystroke/validate/calculate functions and simplified field notation run natively in Acrobat's event order; tab order; push-button actions; flatten; agent tools. Form data exchange (FDF, XFDF, XML, CSV, text) done; XFDF values retain text across XML comments and processing instructions. XML/XFDF exports preserve tabs and line breaks in names and comment metadata. Refreshed against upstream `99941daa` (2026-10-15).
Done since: JavaScript engine (boa, sandboxed) running custom keystroke/validate/calculate/format and button scripts, document JavaScripts, console. Missing: Actions tab, wider object model (annotations, layers, dialogs), XFA
Done since: Multi-select choice fields write ascending `/I` option indices while preserving `/V` selection order; synthetic forms/engine regressions cover reverse selection and save/reopen. CSV export preserves carriage returns in names and values. | @@ -199,6 +200,8 @@ M2 (renderer), M7 (content editing), M10 (OCR and Office), M11 (Preflight and st | Date | Change | Summary | |---|---|---| +| 2026-10-18 | minor | M5, PR #1971: nested source `/Page` and `/Pages` dictionaries export as null without traversing page content or the page tree. Synthetic saved/reopened three-page regression retains unrelated metadata and aliases. FDF import semantics, copied-graph limits and estimates unchanged. | +| 2026-10-15 | minor | M5: budget retained FDF entries before cloning; discovery keeps lazy array owners and annotation positions, with alias/cache-eviction stress fixtures. Limits cover the copied graph; source parsing/page discovery retain existing COS/parser limits, with no total source-memory bound. FDF import semantics and estimates unchanged. | | 2026-10-15 | minor | M7: Edit text caret height follows its row, with a kittest regression; estimates unchanged | | 2026-10-19 | minor | M3 #3360: retain each document’s scroll position when switching Read and the docking workspace at fixed zoom. Estimates unchanged. | | 2026-10-18 | minor | M4, PR #1919 review: repeated page indices apply each rotation to the latest page-local value, preserving indirect/inherited angles. Synthetic adjacent/interleaved duplicates retain siblings and page contents through incremental and full saves. Estimates unchanged. | diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml index 8d7fabed15..7aca7d5c8b 100644 --- a/parity/acrobat-features.toml +++ b/parity/acrobat-features.toml @@ -4160,8 +4160,8 @@ milestone = "M5" status = "shipped" commands = ["comment.export"] tools = ["doc_export_data"] -evidence = ["crates/xfdf/src/tests.rs::xfdf_round_trips_comments_and_values", "crates/xfdf/src/tests.rs::fdf_round_trips_values_and_comments", "crates/automation/tests/automation.rs::comments_and_form_data_travel_as_xfdf_fdf_and_text", "crates/xfdf/src/tests.rs::xfdf_exports_preserve_whitespace_in_comment_attributes"] -notes = "XFDF exports retain tabs and line breaks in comment identities and metadata." +evidence = ["crates/xfdf/src/tests.rs::fdf_export_nulls_nested_page_links_without_copying_the_source_page_tree", "crates/xfdf/src/tests.rs::fdf_export_bounds_indirect_type_alias_lookups", "crates/xfdf/src/tests.rs::fdf_export_preserves_metadata_with_stale_type_references", "crates/xfdf/src/tests.rs::fdf_export_keeps_indirect_values_nested_in_annotation_properties", "crates/xfdf/src/tests.rs::fdf_export_preserves_shared_cycles_and_nested_streams_without_expansion", "crates/xfdf/src/tests.rs::fdf_export_refuses_excessive_direct_depth_values_and_payload", "crates/xfdf/src/tests.rs::fdf_export_refuses_aliases_before_cloning_large_annotation_values", "crates/xfdf/src/tests.rs::fdf_export_refuses_repeated_saved_annotations_after_cache_eviction", "crates/automation/tests/automation.rs::fdf_nested_comment_values_survive_export_import_and_save_through_tools", "crates/automation/tests/automation.rs::refused_fdf_export_keeps_the_destination_and_source_through_tools", "crates/xfdf/src/tests.rs::xfdf_round_trips_comments_and_values", "crates/xfdf/src/tests.rs::fdf_round_trips_values_and_comments", "crates/automation/tests/automation.rs::comments_and_form_data_travel_as_xfdf_fdf_and_text", "crates/xfdf/src/tests.rs::xfdf_exports_preserve_whitespace_in_comment_attributes"] +notes = "FDF preserves shared/cyclic nested values. Discovery keeps lazy array owners and annotation positions; retained entries are budgeted before cloning, including after saved-PDF cache eviction. Copied-graph limits are 100,000 comments/objects/values, 64 direct levels and a conservative 64 MiB data budget; refusal precedes writing. Source parsing and page discovery retain existing COS/parser limits, with no total source-memory bound. Source /Page and /Pages dictionaries become null at every copy depth; indirect Type names check each reference generation with iterative cycle detection and a 64-reference limit; stale Type references preserve unrelated metadata; a saved/reopened three-page fixture verifies small output and retained unrelated metadata. Appearances and source-document links are not carried; FDF import semantics are unchanged. XFDF exports retain tabs and line breaks in comment identities and metadata." [[feature]] id = "comment.export-selected" @@ -4692,8 +4692,8 @@ milestone = "M6" status = "shipped" commands = ["form.export_data"] tools = ["doc_export_data"] -evidence = ["crates/xfdf/src/tests.rs::xfdf_round_trips_comments_and_values", "crates/automation/tests/automation.rs::comments_and_form_data_travel_as_xfdf_fdf_and_text", "crates/xfdf/src/tests.rs::xml_exports_preserve_whitespace_in_field_names"] -notes = "XFDF, FDF; XFA forms also export their data as XML or XDP (form.xfa-data); XML/XFDF exports retain tabs and line breaks in field identities through character references." +evidence = ["crates/xfdf/src/tests.rs::fdf_export_counts_emitted_field_values_before_allocating_lists", "crates/xfdf/src/tests.rs::xfdf_round_trips_comments_and_values", "crates/automation/tests/automation.rs::comments_and_form_data_travel_as_xfdf_fdf_and_text", "crates/xfdf/src/tests.rs::xml_exports_preserve_whitespace_in_field_names"] +notes = "XFDF, FDF; FDF counts emitted field values, including every multi-select list entry, before allocating the output list and refuses exports beyond its shared 100,000-value budget. Existing source-field parsing limits remain unchanged. XFA forms also export their data as XML or XDP (form.xfa-data). XML/XFDF exports retain tabs and line breaks in field identities through character references." [[feature]] id = "form.data-xml-csv-txt" From 6fb6b7cf6fd8dc105fdd56a764d207cff6140694 Mon Sep 17 00:00:00 2001 From: Brandon Thomas Date: Mon, 19 Oct 2026 22:21:10 -0400 Subject: [PATCH 3/7] Release 0.10.0 Co-Authored-By: Claude Opus 5.5 --- Cargo.lock | 72 +++++++++++++++++++++++++++--------------------------- Cargo.toml | 68 +++++++++++++++++++++++++-------------------------- 2 files changed, 70 insertions(+), 70 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 68a758c2fb..d56c63a31f 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -3938,7 +3938,7 @@ dependencies = [ [[package]] name = "pdfcraft" -version = "0.9.0" +version = "0.10.0" dependencies = [ "craft-quit", "eframe", @@ -3963,7 +3963,7 @@ dependencies = [ [[package]] name = "pdfcraft-a11y" -version = "0.9.0" +version = "0.10.0" dependencies = [ "pdfcraft-content", "pdfcraft-cos", @@ -3975,7 +3975,7 @@ dependencies = [ [[package]] name = "pdfcraft-annot" -version = "0.9.0" +version = "0.10.0" dependencies = [ "hayro-syntax", "pdfcraft-cos", @@ -3986,7 +3986,7 @@ dependencies = [ [[package]] name = "pdfcraft-audit" -version = "0.9.0" +version = "0.10.0" dependencies = [ "pdfcraft-content", "pdfcraft-cos", @@ -3997,7 +3997,7 @@ dependencies = [ [[package]] name = "pdfcraft-automation" -version = "0.9.0" +version = "0.10.0" dependencies = [ "base64 0.22.1", "flate2", @@ -4018,7 +4018,7 @@ dependencies = [ [[package]] name = "pdfcraft-cli" -version = "0.9.0" +version = "0.10.0" dependencies = [ "base64 0.22.1", "pdfcraft-audit", @@ -4035,18 +4035,18 @@ dependencies = [ [[package]] name = "pdfcraft-compare" -version = "0.9.0" +version = "0.10.0" [[package]] name = "pdfcraft-content" -version = "0.9.0" +version = "0.10.0" dependencies = [ "pdfcraft-cos", ] [[package]] name = "pdfcraft-cos" -version = "0.9.0" +version = "0.10.0" dependencies = [ "hayro-syntax", "pdfcraft-crypt", @@ -4060,7 +4060,7 @@ dependencies = [ [[package]] name = "pdfcraft-create" -version = "0.9.0" +version = "0.10.0" dependencies = [ "encoding_rs", "hayro-syntax", @@ -4076,7 +4076,7 @@ dependencies = [ [[package]] name = "pdfcraft-crypt" -version = "0.9.0" +version = "0.10.0" dependencies = [ "aes", "md-5", @@ -4088,7 +4088,7 @@ dependencies = [ [[package]] name = "pdfcraft-edit" -version = "0.9.0" +version = "0.10.0" dependencies = [ "hayro-syntax", "kurbo 0.13.1", @@ -4103,7 +4103,7 @@ dependencies = [ [[package]] name = "pdfcraft-engine" -version = "0.9.0" +version = "0.10.0" dependencies = [ "chrono", "craft-docpath", @@ -4143,14 +4143,14 @@ dependencies = [ [[package]] name = "pdfcraft-export" -version = "0.9.0" +version = "0.10.0" dependencies = [ "flate2", ] [[package]] name = "pdfcraft-filters" -version = "0.9.0" +version = "0.10.0" dependencies = [ "flate2", "proptest", @@ -4160,7 +4160,7 @@ dependencies = [ [[package]] name = "pdfcraft-fonts" -version = "0.9.0" +version = "0.10.0" dependencies = [ "harfrust", "pdfcraft-cos", @@ -4170,7 +4170,7 @@ dependencies = [ [[package]] name = "pdfcraft-forms" -version = "0.9.0" +version = "0.10.0" dependencies = [ "hayro-syntax", "pdfcraft-content", @@ -4182,18 +4182,18 @@ dependencies = [ [[package]] name = "pdfcraft-geom" -version = "0.9.0" +version = "0.10.0" [[package]] name = "pdfcraft-js" -version = "0.9.0" +version = "0.10.0" dependencies = [ "boa_engine", ] [[package]] name = "pdfcraft-measure" -version = "0.9.0" +version = "0.10.0" dependencies = [ "pdfcraft-annot", "pdfcraft-content", @@ -4206,14 +4206,14 @@ dependencies = [ [[package]] name = "pdfcraft-model" -version = "0.9.0" +version = "0.10.0" dependencies = [ "pdfcraft-cos", ] [[package]] name = "pdfcraft-ocr" -version = "0.9.0" +version = "0.10.0" dependencies = [ "ocrs", "pdfcraft-fonts", @@ -4223,7 +4223,7 @@ dependencies = [ [[package]] name = "pdfcraft-optimize" -version = "0.9.0" +version = "0.10.0" dependencies = [ "image", "pdfcraft-annot", @@ -4236,11 +4236,11 @@ dependencies = [ [[package]] name = "pdfcraft-oracle" -version = "0.9.0" +version = "0.10.0" [[package]] name = "pdfcraft-organize" -version = "0.9.0" +version = "0.10.0" dependencies = [ "hayro-syntax", "pdfcraft-content", @@ -4251,7 +4251,7 @@ dependencies = [ [[package]] name = "pdfcraft-platform" -version = "0.9.0" +version = "0.10.0" dependencies = [ "async-channel", "futures-lite", @@ -4261,7 +4261,7 @@ dependencies = [ [[package]] name = "pdfcraft-preflight" -version = "0.9.0" +version = "0.10.0" dependencies = [ "flate2", "pdfcraft-content", @@ -4272,7 +4272,7 @@ dependencies = [ [[package]] name = "pdfcraft-print" -version = "0.9.0" +version = "0.10.0" dependencies = [ "craft-print", "pdfcraft-content", @@ -4283,7 +4283,7 @@ dependencies = [ [[package]] name = "pdfcraft-redact" -version = "0.9.0" +version = "0.10.0" dependencies = [ "pdfcraft-annot", "pdfcraft-content", @@ -4299,7 +4299,7 @@ dependencies = [ [[package]] name = "pdfcraft-render" -version = "0.9.0" +version = "0.10.0" dependencies = [ "bytemuck", "flate2", @@ -4318,7 +4318,7 @@ dependencies = [ [[package]] name = "pdfcraft-sign" -version = "0.9.0" +version = "0.10.0" dependencies = [ "aes", "aws-lc-rs", @@ -4352,11 +4352,11 @@ dependencies = [ [[package]] name = "pdfcraft-testkit" -version = "0.9.0" +version = "0.10.0" [[package]] name = "pdfcraft-ui-egui" -version = "0.9.0" +version = "0.10.0" dependencies = [ "arboard", "base64 0.22.1", @@ -4400,7 +4400,7 @@ dependencies = [ [[package]] name = "pdfcraft-web" -version = "0.9.0" +version = "0.10.0" dependencies = [ "eframe", "egui", @@ -4412,7 +4412,7 @@ dependencies = [ [[package]] name = "pdfcraft-xfa" -version = "0.9.0" +version = "0.10.0" dependencies = [ "base64 0.22.1", "image", @@ -4426,7 +4426,7 @@ dependencies = [ [[package]] name = "pdfcraft-xfdf" -version = "0.9.0" +version = "0.10.0" dependencies = [ "pdfcraft-annot", "pdfcraft-cos", diff --git a/Cargo.toml b/Cargo.toml index ec89098021..6a3e2aacd2 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -5,7 +5,7 @@ exclude = ["vendor"] default-members = ["crates/*", "apps/pdfcraft", "apps/pdfcraft-cli", "xtask"] [workspace.package] -version = "0.9.0" +version = "0.10.0" edition = "2024" license = "MIT OR Apache-2.0" rust-version = "1.95" @@ -21,39 +21,39 @@ craft-print = { git = "https://github.com/storytold/craft-libs", version = "0.1. # Whether a path stored in a document may be opened (GoToR link targets). craft-docpath = { version = "0.1.0", git = "https://github.com/storytold/craft-libs", rev = "82a24b006eefa036b43c09a67fb9a3fbd17ffe63" } # internal -pdfcraft-geom = { path = "crates/geom", version = "0.9.0" } -pdfcraft-filters = { path = "crates/filters", version = "0.9.0" } -pdfcraft-cos = { path = "crates/cos", version = "0.9.0" } -pdfcraft-crypt = { path = "crates/crypt", version = "0.9.0" } -pdfcraft-organize = { path = "crates/organize", version = "0.9.0" } -pdfcraft-measure = { path = "crates/measure", version = "0.9.0" } -pdfcraft-annot = { path = "crates/annot", version = "0.9.0" } -pdfcraft-audit = { path = "crates/audit", version = "0.9.0" } -pdfcraft-fonts = { path = "crates/fonts", version = "0.9.0" } -pdfcraft-model = { path = "crates/model", version = "0.9.0" } -pdfcraft-content = { path = "crates/content", version = "0.9.0" } -pdfcraft-redact = { path = "crates/redact", version = "0.9.0" } -pdfcraft-print = { path = "crates/print", version = "0.9.0" } -pdfcraft-xfdf = { path = "crates/xfdf", version = "0.9.0" } -pdfcraft-sign = { path = "crates/sign", version = "0.9.0" } -pdfcraft-optimize = { path = "crates/optimize", version = "0.9.0" } -pdfcraft-a11y = { path = "crates/a11y", version = "0.9.0" } -pdfcraft-oracle = { path = "crates/oracle", version = "0.9.0" } -pdfcraft-testkit = { path = "crates/testkit", version = "0.9.0" } -pdfcraft-ocr = { path = "crates/ocr", version = "0.9.0" } -pdfcraft-js = { path = "crates/js", version = "0.9.0" } -pdfcraft-compare = { path = "crates/compare", version = "0.9.0" } -pdfcraft-preflight = { path = "crates/preflight", version = "0.9.0" } -pdfcraft-export = { path = "crates/export", version = "0.9.0" } -pdfcraft-edit = { path = "crates/edit", version = "0.9.0" } -pdfcraft-create = { path = "crates/create", version = "0.9.0" } -pdfcraft-forms = { path = "crates/forms", version = "0.9.0" } -pdfcraft-xfa = { path = "crates/xfa", version = "0.9.0" } -pdfcraft-render = { path = "crates/render", version = "0.9.0" } -pdfcraft-engine = { path = "crates/engine", version = "0.9.0" } -pdfcraft-platform = { path = "crates/platform", version = "0.9.0" } -pdfcraft-ui-egui = { path = "crates/ui-egui", version = "0.9.0" } -pdfcraft-automation = { path = "crates/automation", version = "0.9.0", default-features = false } +pdfcraft-geom = { path = "crates/geom", version = "0.10.0" } +pdfcraft-filters = { path = "crates/filters", version = "0.10.0" } +pdfcraft-cos = { path = "crates/cos", version = "0.10.0" } +pdfcraft-crypt = { path = "crates/crypt", version = "0.10.0" } +pdfcraft-organize = { path = "crates/organize", version = "0.10.0" } +pdfcraft-measure = { path = "crates/measure", version = "0.10.0" } +pdfcraft-annot = { path = "crates/annot", version = "0.10.0" } +pdfcraft-audit = { path = "crates/audit", version = "0.10.0" } +pdfcraft-fonts = { path = "crates/fonts", version = "0.10.0" } +pdfcraft-model = { path = "crates/model", version = "0.10.0" } +pdfcraft-content = { path = "crates/content", version = "0.10.0" } +pdfcraft-redact = { path = "crates/redact", version = "0.10.0" } +pdfcraft-print = { path = "crates/print", version = "0.10.0" } +pdfcraft-xfdf = { path = "crates/xfdf", version = "0.10.0" } +pdfcraft-sign = { path = "crates/sign", version = "0.10.0" } +pdfcraft-optimize = { path = "crates/optimize", version = "0.10.0" } +pdfcraft-a11y = { path = "crates/a11y", version = "0.10.0" } +pdfcraft-oracle = { path = "crates/oracle", version = "0.10.0" } +pdfcraft-testkit = { path = "crates/testkit", version = "0.10.0" } +pdfcraft-ocr = { path = "crates/ocr", version = "0.10.0" } +pdfcraft-js = { path = "crates/js", version = "0.10.0" } +pdfcraft-compare = { path = "crates/compare", version = "0.10.0" } +pdfcraft-preflight = { path = "crates/preflight", version = "0.10.0" } +pdfcraft-export = { path = "crates/export", version = "0.10.0" } +pdfcraft-edit = { path = "crates/edit", version = "0.10.0" } +pdfcraft-create = { path = "crates/create", version = "0.10.0" } +pdfcraft-forms = { path = "crates/forms", version = "0.10.0" } +pdfcraft-xfa = { path = "crates/xfa", version = "0.10.0" } +pdfcraft-render = { path = "crates/render", version = "0.10.0" } +pdfcraft-engine = { path = "crates/engine", version = "0.10.0" } +pdfcraft-platform = { path = "crates/platform", version = "0.10.0" } +pdfcraft-ui-egui = { path = "crates/ui-egui", version = "0.10.0" } +pdfcraft-automation = { path = "crates/automation", version = "0.10.0", default-features = false } # pdf hayro = "0.7.1" From 59a5a83774442ad43ba0dff2069b58d3a2d1d7df Mon Sep 17 00:00:00 2001 From: "Dylan M. Taylor" Date: Tue, 20 Oct 2026 11:29:59 -0400 Subject: [PATCH 4/7] docs: add SonarCloud and CodeRabbit badges to README (#3271) * docs: add SonarCloud and CodeRabbit badges and standardize to flat-square * docs: put SonarCloud and CodeRabbit badges on their own line --- README.md | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index 2a65b66457..af49129eca 100644 --- a/README.md +++ b/README.md @@ -17,10 +17,13 @@

- License: MIT OR Apache-2.0 - Written in Rust - Platforms: macOS, Windows, Linux, FreeBSD, web - No account, no telemetry + License: MIT OR Apache-2.0 + Written in Rust + Platforms: macOS, Windows, Linux, FreeBSD, web + No account, no telemetry +
+ Scanned by SonarCloud + Reviewed by CodeRabbit

From b77d57000c22c760f731206f6cf14486d149de72 Mon Sep 17 00:00:00 2001 From: Brandon Thomas Date: Tue, 20 Oct 2026 11:38:32 -0400 Subject: [PATCH 5/7] Release 0.10.1: rebuild with the shared workflow's exact Linux tarball pick 0.10.0's Arch Linux and Flatpak aarch64 jobs picked up the pdfcraft-cli tarball (storytold/craft-common-actions#35). Co-Authored-By: Claude Opus 5.5 --- Cargo.lock | 72 +++++++++++++++++++++++++++--------------------------- Cargo.toml | 68 +++++++++++++++++++++++++-------------------------- 2 files changed, 70 insertions(+), 70 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index d56c63a31f..2399531ef4 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -3938,7 +3938,7 @@ dependencies = [ [[package]] name = "pdfcraft" -version = "0.10.0" +version = "0.10.1" dependencies = [ "craft-quit", "eframe", @@ -3963,7 +3963,7 @@ dependencies = [ [[package]] name = "pdfcraft-a11y" -version = "0.10.0" +version = "0.10.1" dependencies = [ "pdfcraft-content", "pdfcraft-cos", @@ -3975,7 +3975,7 @@ dependencies = [ [[package]] name = "pdfcraft-annot" -version = "0.10.0" +version = "0.10.1" dependencies = [ "hayro-syntax", "pdfcraft-cos", @@ -3986,7 +3986,7 @@ dependencies = [ [[package]] name = "pdfcraft-audit" -version = "0.10.0" +version = "0.10.1" dependencies = [ "pdfcraft-content", "pdfcraft-cos", @@ -3997,7 +3997,7 @@ dependencies = [ [[package]] name = "pdfcraft-automation" -version = "0.10.0" +version = "0.10.1" dependencies = [ "base64 0.22.1", "flate2", @@ -4018,7 +4018,7 @@ dependencies = [ [[package]] name = "pdfcraft-cli" -version = "0.10.0" +version = "0.10.1" dependencies = [ "base64 0.22.1", "pdfcraft-audit", @@ -4035,18 +4035,18 @@ dependencies = [ [[package]] name = "pdfcraft-compare" -version = "0.10.0" +version = "0.10.1" [[package]] name = "pdfcraft-content" -version = "0.10.0" +version = "0.10.1" dependencies = [ "pdfcraft-cos", ] [[package]] name = "pdfcraft-cos" -version = "0.10.0" +version = "0.10.1" dependencies = [ "hayro-syntax", "pdfcraft-crypt", @@ -4060,7 +4060,7 @@ dependencies = [ [[package]] name = "pdfcraft-create" -version = "0.10.0" +version = "0.10.1" dependencies = [ "encoding_rs", "hayro-syntax", @@ -4076,7 +4076,7 @@ dependencies = [ [[package]] name = "pdfcraft-crypt" -version = "0.10.0" +version = "0.10.1" dependencies = [ "aes", "md-5", @@ -4088,7 +4088,7 @@ dependencies = [ [[package]] name = "pdfcraft-edit" -version = "0.10.0" +version = "0.10.1" dependencies = [ "hayro-syntax", "kurbo 0.13.1", @@ -4103,7 +4103,7 @@ dependencies = [ [[package]] name = "pdfcraft-engine" -version = "0.10.0" +version = "0.10.1" dependencies = [ "chrono", "craft-docpath", @@ -4143,14 +4143,14 @@ dependencies = [ [[package]] name = "pdfcraft-export" -version = "0.10.0" +version = "0.10.1" dependencies = [ "flate2", ] [[package]] name = "pdfcraft-filters" -version = "0.10.0" +version = "0.10.1" dependencies = [ "flate2", "proptest", @@ -4160,7 +4160,7 @@ dependencies = [ [[package]] name = "pdfcraft-fonts" -version = "0.10.0" +version = "0.10.1" dependencies = [ "harfrust", "pdfcraft-cos", @@ -4170,7 +4170,7 @@ dependencies = [ [[package]] name = "pdfcraft-forms" -version = "0.10.0" +version = "0.10.1" dependencies = [ "hayro-syntax", "pdfcraft-content", @@ -4182,18 +4182,18 @@ dependencies = [ [[package]] name = "pdfcraft-geom" -version = "0.10.0" +version = "0.10.1" [[package]] name = "pdfcraft-js" -version = "0.10.0" +version = "0.10.1" dependencies = [ "boa_engine", ] [[package]] name = "pdfcraft-measure" -version = "0.10.0" +version = "0.10.1" dependencies = [ "pdfcraft-annot", "pdfcraft-content", @@ -4206,14 +4206,14 @@ dependencies = [ [[package]] name = "pdfcraft-model" -version = "0.10.0" +version = "0.10.1" dependencies = [ "pdfcraft-cos", ] [[package]] name = "pdfcraft-ocr" -version = "0.10.0" +version = "0.10.1" dependencies = [ "ocrs", "pdfcraft-fonts", @@ -4223,7 +4223,7 @@ dependencies = [ [[package]] name = "pdfcraft-optimize" -version = "0.10.0" +version = "0.10.1" dependencies = [ "image", "pdfcraft-annot", @@ -4236,11 +4236,11 @@ dependencies = [ [[package]] name = "pdfcraft-oracle" -version = "0.10.0" +version = "0.10.1" [[package]] name = "pdfcraft-organize" -version = "0.10.0" +version = "0.10.1" dependencies = [ "hayro-syntax", "pdfcraft-content", @@ -4251,7 +4251,7 @@ dependencies = [ [[package]] name = "pdfcraft-platform" -version = "0.10.0" +version = "0.10.1" dependencies = [ "async-channel", "futures-lite", @@ -4261,7 +4261,7 @@ dependencies = [ [[package]] name = "pdfcraft-preflight" -version = "0.10.0" +version = "0.10.1" dependencies = [ "flate2", "pdfcraft-content", @@ -4272,7 +4272,7 @@ dependencies = [ [[package]] name = "pdfcraft-print" -version = "0.10.0" +version = "0.10.1" dependencies = [ "craft-print", "pdfcraft-content", @@ -4283,7 +4283,7 @@ dependencies = [ [[package]] name = "pdfcraft-redact" -version = "0.10.0" +version = "0.10.1" dependencies = [ "pdfcraft-annot", "pdfcraft-content", @@ -4299,7 +4299,7 @@ dependencies = [ [[package]] name = "pdfcraft-render" -version = "0.10.0" +version = "0.10.1" dependencies = [ "bytemuck", "flate2", @@ -4318,7 +4318,7 @@ dependencies = [ [[package]] name = "pdfcraft-sign" -version = "0.10.0" +version = "0.10.1" dependencies = [ "aes", "aws-lc-rs", @@ -4352,11 +4352,11 @@ dependencies = [ [[package]] name = "pdfcraft-testkit" -version = "0.10.0" +version = "0.10.1" [[package]] name = "pdfcraft-ui-egui" -version = "0.10.0" +version = "0.10.1" dependencies = [ "arboard", "base64 0.22.1", @@ -4400,7 +4400,7 @@ dependencies = [ [[package]] name = "pdfcraft-web" -version = "0.10.0" +version = "0.10.1" dependencies = [ "eframe", "egui", @@ -4412,7 +4412,7 @@ dependencies = [ [[package]] name = "pdfcraft-xfa" -version = "0.10.0" +version = "0.10.1" dependencies = [ "base64 0.22.1", "image", @@ -4426,7 +4426,7 @@ dependencies = [ [[package]] name = "pdfcraft-xfdf" -version = "0.10.0" +version = "0.10.1" dependencies = [ "pdfcraft-annot", "pdfcraft-cos", diff --git a/Cargo.toml b/Cargo.toml index 6a3e2aacd2..b00b726dcb 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -5,7 +5,7 @@ exclude = ["vendor"] default-members = ["crates/*", "apps/pdfcraft", "apps/pdfcraft-cli", "xtask"] [workspace.package] -version = "0.10.0" +version = "0.10.1" edition = "2024" license = "MIT OR Apache-2.0" rust-version = "1.95" @@ -21,39 +21,39 @@ craft-print = { git = "https://github.com/storytold/craft-libs", version = "0.1. # Whether a path stored in a document may be opened (GoToR link targets). craft-docpath = { version = "0.1.0", git = "https://github.com/storytold/craft-libs", rev = "82a24b006eefa036b43c09a67fb9a3fbd17ffe63" } # internal -pdfcraft-geom = { path = "crates/geom", version = "0.10.0" } -pdfcraft-filters = { path = "crates/filters", version = "0.10.0" } -pdfcraft-cos = { path = "crates/cos", version = "0.10.0" } -pdfcraft-crypt = { path = "crates/crypt", version = "0.10.0" } -pdfcraft-organize = { path = "crates/organize", version = "0.10.0" } -pdfcraft-measure = { path = "crates/measure", version = "0.10.0" } -pdfcraft-annot = { path = "crates/annot", version = "0.10.0" } -pdfcraft-audit = { path = "crates/audit", version = "0.10.0" } -pdfcraft-fonts = { path = "crates/fonts", version = "0.10.0" } -pdfcraft-model = { path = "crates/model", version = "0.10.0" } -pdfcraft-content = { path = "crates/content", version = "0.10.0" } -pdfcraft-redact = { path = "crates/redact", version = "0.10.0" } -pdfcraft-print = { path = "crates/print", version = "0.10.0" } -pdfcraft-xfdf = { path = "crates/xfdf", version = "0.10.0" } -pdfcraft-sign = { path = "crates/sign", version = "0.10.0" } -pdfcraft-optimize = { path = "crates/optimize", version = "0.10.0" } -pdfcraft-a11y = { path = "crates/a11y", version = "0.10.0" } -pdfcraft-oracle = { path = "crates/oracle", version = "0.10.0" } -pdfcraft-testkit = { path = "crates/testkit", version = "0.10.0" } -pdfcraft-ocr = { path = "crates/ocr", version = "0.10.0" } -pdfcraft-js = { path = "crates/js", version = "0.10.0" } -pdfcraft-compare = { path = "crates/compare", version = "0.10.0" } -pdfcraft-preflight = { path = "crates/preflight", version = "0.10.0" } -pdfcraft-export = { path = "crates/export", version = "0.10.0" } -pdfcraft-edit = { path = "crates/edit", version = "0.10.0" } -pdfcraft-create = { path = "crates/create", version = "0.10.0" } -pdfcraft-forms = { path = "crates/forms", version = "0.10.0" } -pdfcraft-xfa = { path = "crates/xfa", version = "0.10.0" } -pdfcraft-render = { path = "crates/render", version = "0.10.0" } -pdfcraft-engine = { path = "crates/engine", version = "0.10.0" } -pdfcraft-platform = { path = "crates/platform", version = "0.10.0" } -pdfcraft-ui-egui = { path = "crates/ui-egui", version = "0.10.0" } -pdfcraft-automation = { path = "crates/automation", version = "0.10.0", default-features = false } +pdfcraft-geom = { path = "crates/geom", version = "0.10.1" } +pdfcraft-filters = { path = "crates/filters", version = "0.10.1" } +pdfcraft-cos = { path = "crates/cos", version = "0.10.1" } +pdfcraft-crypt = { path = "crates/crypt", version = "0.10.1" } +pdfcraft-organize = { path = "crates/organize", version = "0.10.1" } +pdfcraft-measure = { path = "crates/measure", version = "0.10.1" } +pdfcraft-annot = { path = "crates/annot", version = "0.10.1" } +pdfcraft-audit = { path = "crates/audit", version = "0.10.1" } +pdfcraft-fonts = { path = "crates/fonts", version = "0.10.1" } +pdfcraft-model = { path = "crates/model", version = "0.10.1" } +pdfcraft-content = { path = "crates/content", version = "0.10.1" } +pdfcraft-redact = { path = "crates/redact", version = "0.10.1" } +pdfcraft-print = { path = "crates/print", version = "0.10.1" } +pdfcraft-xfdf = { path = "crates/xfdf", version = "0.10.1" } +pdfcraft-sign = { path = "crates/sign", version = "0.10.1" } +pdfcraft-optimize = { path = "crates/optimize", version = "0.10.1" } +pdfcraft-a11y = { path = "crates/a11y", version = "0.10.1" } +pdfcraft-oracle = { path = "crates/oracle", version = "0.10.1" } +pdfcraft-testkit = { path = "crates/testkit", version = "0.10.1" } +pdfcraft-ocr = { path = "crates/ocr", version = "0.10.1" } +pdfcraft-js = { path = "crates/js", version = "0.10.1" } +pdfcraft-compare = { path = "crates/compare", version = "0.10.1" } +pdfcraft-preflight = { path = "crates/preflight", version = "0.10.1" } +pdfcraft-export = { path = "crates/export", version = "0.10.1" } +pdfcraft-edit = { path = "crates/edit", version = "0.10.1" } +pdfcraft-create = { path = "crates/create", version = "0.10.1" } +pdfcraft-forms = { path = "crates/forms", version = "0.10.1" } +pdfcraft-xfa = { path = "crates/xfa", version = "0.10.1" } +pdfcraft-render = { path = "crates/render", version = "0.10.1" } +pdfcraft-engine = { path = "crates/engine", version = "0.10.1" } +pdfcraft-platform = { path = "crates/platform", version = "0.10.1" } +pdfcraft-ui-egui = { path = "crates/ui-egui", version = "0.10.1" } +pdfcraft-automation = { path = "crates/automation", version = "0.10.1", default-features = false } # pdf hayro = "0.7.1" From 22bedbf2af25bd4cdc1c188b5eff6ec3d2d089fb Mon Sep 17 00:00:00 2001 From: Brandon Thomas Date: Tue, 20 Oct 2026 11:38:59 -0400 Subject: [PATCH 6/7] Skip CodeRabbit reviews on Dependabot PRs (#3692) Adds .coderabbit.yaml so CodeRabbit no longer reviews or comments on PRs opened by dependabot[bot]. Co-authored-by: Claude Opus 5.5 --- .coderabbit.yaml | 6 ++++++ 1 file changed, 6 insertions(+) create mode 100644 .coderabbit.yaml diff --git a/.coderabbit.yaml b/.coderabbit.yaml new file mode 100644 index 0000000000..2408084cf9 --- /dev/null +++ b/.coderabbit.yaml @@ -0,0 +1,6 @@ +# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json +reviews: + auto_review: + # Dependabot bumps are checked by CI; skip CodeRabbit reviews on them. + ignore_usernames: + - "dependabot[bot]" From d695bc56545944fe9c7181901c61d0bf1c11c887 Mon Sep 17 00:00:00 2001 From: skylar taylor-barrick Date: Tue, 20 Oct 2026 18:17:34 -0600 Subject: [PATCH 7/7] fix(redact): evaluate OCMD visibility during sanitization (#3522) * fix(redact): evaluate OCMD visibility during sanitization Fixes #3499 by evaluating OCMD policies and bounded visibility expressions against the default optional-content configuration before removing hidden groups. Unknown or malformed visibility data is handled conservatively. * fix(redact): preserve OCMD visibility during sanitization * fix(redact): count hidden XObjects during verification * test(redact): cover hidden form depth limit --- crates/redact/src/interp.rs | 251 +++++++++++++++++++-- crates/redact/src/sanitize.rs | 32 ++- crates/redact/src/tests.rs | 414 ++++++++++++++++++++++++++++++++++ 3 files changed, 667 insertions(+), 30 deletions(-) diff --git a/crates/redact/src/interp.rs b/crates/redact/src/interp.rs index 52ca6c276f..415382b232 100644 --- a/crates/redact/src/interp.rs +++ b/crates/redact/src/interp.rs @@ -84,9 +84,19 @@ pub(crate) struct Scope<'a> { pub report: &'a mut Report, /// Sanitize: remove hidden text (invisible render modes, or wholly outside this page box). pub hidden_text: Option<[f64; 4]>, - /// Sanitize: optional content groups (and membership dictionaries) that are off; content - /// marked with them is removed. - pub hidden_layers: Vec, + /// Sanitize: optional content groups that are off; content marked with them is removed. + pub hidden_layers: HashSet, + /// Whether this pass is evaluating optional-content rules. An empty off set is meaningful: + /// policies such as `/AllOff` can still hide content when every group is on. + pub layers_enabled: bool, + /// Off groups referenced by optional content that remains visible and therefore still needs + /// its original default state after sanitization. + pub retained_off_layers: HashSet, + /// Cache membership results so repeated blocks cannot repeatedly walk hostile expressions. + ocmd_cache: HashMap, + /// Direct `/OC` dictionaries on XObjects have no object reference of their own. Cache them + /// by the containing XObject so repeated `Do` calls share the same bounded evaluation. + xobject_oc_cache: HashMap, /// Content removed from hidden layers (blocks and XObjects). pub layer_blocks: usize, fonts: HashMap, Rc>, @@ -101,7 +111,11 @@ impl<'a> Scope<'a> { mode, report, hidden_text: None, - hidden_layers: Vec::new(), + hidden_layers: HashSet::new(), + layers_enabled: false, + retained_off_layers: HashSet::new(), + ocmd_cache: HashMap::new(), + xobject_oc_cache: HashMap::new(), layer_blocks: 0, fonts: HashMap::new(), used_names: Vec::new(), @@ -111,20 +125,26 @@ impl<'a> Scope<'a> { /// Sanitizing visits every form XObject (not only those under a region). fn everywhere(&self) -> bool { - self.hidden_text.is_some() || !self.hidden_layers.is_empty() + self.hidden_text.is_some() || self.layers_enabled } /// Is this optional-content reference (an OCG or OCMD) hidden? - fn layer_hidden(&self, doc: &Document, o: &Object) -> bool { - if self.hidden_layers.is_empty() { + fn layer_hidden(&mut self, doc: &Document, o: &Object) -> bool { + if !self.layers_enabled { return false; } - if let Some(r) = o.as_ref() - && self.hidden_layers.contains(&r) - { - return true; + let reference = o.as_ref(); + if let Some(r) = reference { + if let Some(hidden) = self.ocmd_cache.get(&r) { + return *hidden; + } + if self.hidden_layers.contains(&r) { + self.ocmd_cache.insert(r, true); + return true; + } } - // A membership dictionary (default policy AnyOn): hidden when all its groups are. + // Evaluate the policy against the same default configuration used to select hidden + // groups. A membership dictionary's default policy is AnyOn. let d = doc.resolve(o); let Some(d) = d.as_dict() else { return false }; if d.name(b"Type") != Some(b"OCMD") { @@ -135,7 +155,188 @@ impl<'a> Scope<'a> { Some(_) => d.get(b"OCGs").and_then(Object::as_ref).into_iter().collect(), None => Vec::new(), }; - !groups.is_empty() && groups.iter().all(|g| self.hidden_layers.contains(g)) + let fail_closed = || groups.iter().any(|g| self.hidden_layers.contains(g)); + let hidden = if let Some(expression) = d.get(b"VE") { + let visible = self.visibility_expression(doc, expression, 0, &mut HashSet::new(), &mut 4096); + match visible { + Some(visible) => !visible, + None => fail_closed() || self.expression_mentions_hidden(doc, expression, 0, &mut HashSet::new(), &mut 4096), + } + } else if groups.is_empty() { + false + } else { + let any_on = groups.iter().any(|g| !self.hidden_layers.contains(g)); + let all_on = groups.iter().all(|g| !self.hidden_layers.contains(g)); + let policy = d.get(b"P").map(|p| doc.resolve(p)).and_then(|p| p.as_name().map(|name| name.to_vec())); + match (d.get(b"P"), policy.as_deref()) { + (None, _) | (Some(_), Some(b"AnyOn")) => !any_on, + (Some(_), Some(b"AllOn")) => !all_on, + (Some(_), Some(b"AnyOff")) => all_on, + (Some(_), Some(b"AllOff")) => any_on, + // An invalid policy must not make a candidate hidden block survive sanitization. + _ => fail_closed(), + } + }; + if !hidden { + self.retained_off_layers.extend(groups.iter().filter(|g| self.hidden_layers.contains(g)).copied()); + if let Some(expression) = d.get(b"VE") { + let mut referenced = HashSet::new(); + if Self::collect_hidden_expression_groups(doc, expression, &self.hidden_layers, 0, &mut HashSet::new(), &mut 4096, &mut referenced) { + self.retained_off_layers.extend(referenced); + } else { + // If an expression cannot be fully walked, preserve every off group so that + // the content we kept does not change visibility after configuration cleanup. + self.retained_off_layers.extend(self.hidden_layers.iter().copied()); + } + } + } + if let Some(r) = reference { + self.ocmd_cache.insert(r, hidden); + } + hidden + } + + fn xobject_layer_hidden(&mut self, doc: &Document, xobject: ObjRef, oc: &Object) -> bool { + if oc.as_ref().is_some() { + return self.layer_hidden(doc, oc); + } + if let Some(hidden) = self.xobject_oc_cache.get(&xobject) { + return *hidden; + } + let hidden = self.layer_hidden(doc, oc); + self.xobject_oc_cache.insert(xobject, hidden); + hidden + } + + fn collect_hidden_expression_groups( + doc: &Document, + expression: &Object, + hidden_layers: &HashSet, + depth: usize, + path: &mut HashSet, + budget: &mut usize, + found: &mut HashSet, + ) -> bool { + if depth > 64 || *budget == 0 { + return false; + } + *budget -= 1; + let reference = expression.as_ref(); + if let Some(r) = reference + && !path.insert(r) + { + return false; + } + let resolved = doc.resolve(expression); + let complete = match &*resolved { + Object::Dict(d) if d.name(b"Type") == Some(b"OCG") => { + if let Some(r) = reference + && hidden_layers.contains(&r) + { + found.insert(r); + } + reference.is_some() + } + Object::Array(items) => { + let Some(Object::Name(operator)) = items.first() else { return false }; + let operands = match operator.as_slice() { + b"And" | b"Or" if (2..=4097).contains(&items.len()) => items.get(1..), + b"Not" if items.len() == 2 => items.get(1..), + _ => None, + }; + operands.is_some_and(|operands| { + operands.iter().all(|item| Self::collect_hidden_expression_groups(doc, item, hidden_layers, depth + 1, path, budget, found)) + }) + } + _ => false, + }; + if let Some(r) = reference { + path.remove(&r); + } + complete + } + + /// Evaluate an optional-content visibility expression (`/VE`) against the default config. + /// Malformed, cyclic, or excessive expressions return `None` so the caller can fail closed. + fn visibility_expression( + &self, + doc: &Document, + expression: &Object, + depth: usize, + path: &mut HashSet, + budget: &mut usize, + ) -> Option { + if depth > 64 || *budget == 0 { + return None; + } + *budget -= 1; + let reference = expression.as_ref(); + if let Some(r) = reference + && !path.insert(r) + { + return None; + } + let resolved = doc.resolve(expression); + let result = match &*resolved { + Object::Dict(d) if d.name(b"Type") == Some(b"OCG") => reference.map(|r| !self.hidden_layers.contains(&r)), + Object::Array(items) if (2..=4097).contains(&items.len()) => { + let operator = match items.first() { + Some(Object::Name(n)) => n.as_slice(), + _ => return None, + }; + match operator { + b"And" if items.len() >= 2 => { + let mut visible = true; + for item in items.iter().skip(1) { + visible &= self.visibility_expression(doc, item, depth + 1, path, budget)?; + } + Some(visible) + } + b"Or" if items.len() >= 2 => { + let mut visible = false; + for item in items.iter().skip(1) { + visible |= self.visibility_expression(doc, item, depth + 1, path, budget)?; + } + Some(visible) + } + b"Not" if items.len() == 2 => Some(!self.visibility_expression(doc, &items[1], depth + 1, path, budget)?), + _ => None, + } + } + _ => None, + }; + if let Some(r) = reference { + path.remove(&r); + } + result + } + + /// Conservatively find hidden groups in an expression that could not be evaluated. Unknown + /// syntax, cycles, and exhausted budgets count as a possible hidden reference. + fn expression_mentions_hidden(&self, doc: &Document, expression: &Object, depth: usize, path: &mut HashSet, budget: &mut usize) -> bool { + if depth > 64 || *budget == 0 { + return true; + } + *budget -= 1; + if let Some(r) = expression.as_ref() { + if self.hidden_layers.contains(&r) { + return true; + } + if !path.insert(r) { + return true; + } + } + let resolved = doc.resolve(expression); + let found = match &*resolved { + Object::Array(items) => items.iter().any(|item| self.expression_mentions_hidden(doc, item, depth + 1, path, budget)), + Object::Dict(d) if d.name(b"Type") == Some(b"OCG") => expression.as_ref().is_none_or(|r| self.hidden_layers.contains(&r)), + Object::Dict(_) => true, + _ => false, + }; + if let Some(r) = expression.as_ref() { + path.remove(&r); + } + found } fn hits(&self, b: [f64; 4]) -> bool { @@ -534,7 +735,7 @@ pub(crate) fn process(doc: &mut Document, scope: &mut Scope<'_>, streams: &[Vec< // Layer removal also changes enclosing replacement spans, so remember the operators before // any cleanup, not just the survivors of the layer pass. let original = parsed.ops.clone(); - if !scope.hidden_layers.is_empty() { + if scope.layers_enabled { let props = res_dict(doc, resources, b"Properties"); let (kept, removed) = strip_hidden_layers(doc, scope, parsed.ops, &props); parsed.ops = kept; @@ -928,11 +1129,13 @@ fn xobject( let obj = doc.get(r); let Object::Stream(s) = &*obj else { return None }; match s.dict.name(b"Subtype") { - _ if s.dict.get(b"OC").is_some_and(|oc| scope.layer_hidden(doc, oc)) => { + _ if s.dict.get(b"OC").is_some_and(|oc| scope.xobject_layer_hidden(doc, r, oc)) => { + // Verify mode must count hidden XObjects too: scan uses that count to decide + // whether the HiddenLayers pass is necessary. + scope.layer_blocks += 1; if scope.mode == Mode::Verify { return None; } - scope.layer_blocks += 1; out.replaced.push(name); out.doomed.push(r); Some(None) @@ -983,6 +1186,11 @@ fn xobject( } if scope.depth >= MAX_DEPTH { if scope.mode == Mode::Verify { + // Sanitization removes a Form it cannot enter, so the verification scan + // must count that conservative removal or it may decide to skip the pass. + if scope.everywhere() { + scope.layer_blocks += 1; + } return None; } scope.report.forms_removed += 1; @@ -998,7 +1206,14 @@ fn xobject( out.doomed.push(r); return Some(None); } - Err(_) => return None, + Err(_) => { + // Apply drops an undecodable Form while sanitizing. Count it during Verify + // so a zero-count preflight cannot leave its potentially hidden bytes behind. + if scope.everywhere() { + scope.layer_blocks += 1; + } + return None; + } }; let own = s.dict.get(b"Resources").and_then(|r| doc.resolve(r).as_dict().cloned()); let res = own.clone().unwrap_or_else(|| resources.clone()); @@ -1073,7 +1288,7 @@ fn xobject( /// Remove marked-content blocks of hidden layers (`/OC /name BDC … EMC`, nested blocks /// included). Returns the remaining operators and how many blocks went. -fn strip_hidden_layers(doc: &Document, scope: &Scope<'_>, ops: Vec, props: &Dict) -> (Vec, usize) { +fn strip_hidden_layers(doc: &Document, scope: &mut Scope<'_>, ops: Vec, props: &Dict) -> (Vec, usize) { let mut out = Vec::with_capacity(ops.len()); // For each open marked-content block: does it hide its contents? let mut stack: Vec = Vec::new(); diff --git a/crates/redact/src/sanitize.rs b/crates/redact/src/sanitize.rs index 1940e376a8..bafa769bd3 100644 --- a/crates/redact/src/sanitize.rs +++ b/crates/redact/src/sanitize.rs @@ -138,12 +138,13 @@ fn hidden_layers(doc: &Document) -> Vec { } /// Glyphs of hidden text, or content of hidden layers, on every page (`write` = remove them). -fn content_pass(doc: &mut Document, text: bool, layers: bool, write: bool) -> Result { +fn content_pass(doc: &mut Document, text: bool, layers: bool, write: bool) -> Result<(usize, std::collections::HashSet), RedactError> { let off = if layers { hidden_layers(doc) } else { Vec::new() }; - if !text && off.is_empty() { - return Ok(0); + if !text && !layers { + return Ok((0, std::collections::HashSet::new())); } let mut total = 0; + let mut retained_off_layers = std::collections::HashSet::new(); // The original image and form XObjects the rewrite drops or replaces, on any page. let mut doomed = Vec::new(); let mut retired_properties = Vec::new(); @@ -164,13 +165,18 @@ fn content_pass(doc: &mut Document, text: bool, layers: bool, write: bool) -> Re let c = page.crop(doc); scope.hidden_text = Some([c[0].min(c[2]), c[1].min(c[3]), c[0].max(c[2]), c[1].max(c[3])]); } - scope.hidden_layers = off.clone(); + scope.hidden_layers = off.iter().copied().collect(); + scope.layers_enabled = layers; let out = process(doc, &mut scope, &data, &resources, Matrix::IDENTITY); if let Some(error) = out.error { return Err(error.into()); } let blocks = scope.layer_blocks; - total += out.residue + blocks + report.glyphs; + let glyphs = scope.report.glyphs; + let retained_for_page = std::mem::take(&mut scope.retained_off_layers); + drop(scope); + total += out.residue + blocks + glyphs; + retained_off_layers.extend(retained_for_page); if !write { continue; } @@ -216,7 +222,7 @@ fn content_pass(doc: &mut Document, text: bool, layers: bool, write: bool) -> Re // What a page no longer draws must not stay reachable through an inherited or shared // /Resources either. crate::interp::unlink_doomed(doc, &doomed, &retired_properties)?; - Ok(total) + Ok((total, retained_off_layers)) } /// How many items each category would remove (categories with nothing are included as 0). @@ -239,10 +245,10 @@ pub fn scan(doc: &Document) -> Vec<(Hidden, usize)> { Hidden::Attachments => sub(doc, &names, b"EmbeddedFiles").map_or(0, |t| name_tree_len(doc, &t, 0)) + count_sub(b"FileAttachment"), Hidden::Comments => annots.iter().filter(|a| is_comment(a.name(b"Subtype").unwrap_or(b""))).count(), Hidden::FormFields => pdfcraft_forms::fields(doc).len(), - Hidden::HiddenText => content_pass(&mut doc2, true, false, false).unwrap_or(0), + Hidden::HiddenText => content_pass(&mut doc2, true, false, false).map(|(n, _)| n).unwrap_or(0), Hidden::HiddenLayers => { let off = hidden_layers(doc).len(); - if off == 0 { 0 } else { off + content_pass(&mut doc2, false, true, false).unwrap_or(0) } + off + content_pass(&mut doc2, false, true, false).map(|(n, _)| n).unwrap_or(0) } Hidden::Bookmarks => sub(doc, &cat, b"Outlines").map_or(0, |o| outline_len(doc, o.get(b"First"), 0)), Hidden::LinksActionsScripts => { @@ -274,9 +280,11 @@ pub fn remove_hidden(doc: &mut Document, which: &[Hidden]) -> Result 0) || (layers && count(Hidden::HiddenLayers) > 0) { - content_pass(doc, text, layers, true)?; - } + let retained_off_layers = if (text && count(Hidden::HiddenText) > 0) || (layers && count(Hidden::HiddenLayers) > 0) { + content_pass(doc, text, layers, true)?.1 + } else { + std::collections::HashSet::new() + }; // Every annotation the pages list now: whatever is no longer listed at the end (flattened // widgets included) leaves the structure tree too. let listed = |doc: &Document| -> std::collections::HashSet { @@ -394,7 +402,7 @@ pub fn remove_hidden(doc: &mut Document, which: &[Hidden]) -> Result { // The off layers leave the configuration (their content is gone already). if let Some(mut oc) = sub(doc, &cat, b"OCProperties") { - let keep = |o: &Object| !o.as_ref().is_some_and(|r| off.contains(&r)); + let keep = |o: &Object| !o.as_ref().is_some_and(|r| off.contains(&r) && !retained_off_layers.contains(&r)); if let Some(Object::Array(a)) = oc.get(b"OCGs").map(|g| (*doc.resolve(g)).clone()) { oc.set(b"OCGs".to_vec(), Object::Array(a.into_iter().filter(keep).collect())); } diff --git a/crates/redact/src/tests.rs b/crates/redact/src/tests.rs index da1ecf12ab..8bc5ec1418 100644 --- a/crates/redact/src/tests.rs +++ b/crates/redact/src/tests.rs @@ -492,6 +492,420 @@ fn a_hidden_layers_image_does_not_survive_through_inherited_resources() { assert!(!bytes.windows(16).any(|w| w == b"HIDDENLAYERIMAGE"), "the off layer's image survived the save"); } +#[test] +fn hidden_ocmd_all_on_content_is_removed_before_its_off_group_is_unlinked() { + use crate::sanitize::{Hidden, remove_hidden}; + + let mut doc = one_page( + b"BT /F1 10 Tf 10 200 Td (PUBLIC) Tj ET /OC /M BDC BT /F1 10 Tf 10 100 Td (SECRET) Tj ET EMC", + "/Properties << /M 9 0 R >>", + vec![ + b"<< /Type /OCG /Name (On) >>".to_vec(), + b"<< /Type /OCG /Name (Off) >>".to_vec(), + b"<< /Type /OCMD /OCGs [7 0 R 8 0 R] /P /AllOn >>".to_vec(), + ], + ); + let root = doc.root().unwrap(); + doc.update_dict(root, |d| { + d.set( + b"OCProperties".to_vec(), + Object::Dict(pdfcraft_cos::Dict::from_iter([ + (b"OCGs".to_vec(), Object::Array(vec![Object::Ref(ObjRef::new(7, 0)), Object::Ref(ObjRef::new(8, 0))])), + ( + b"D".to_vec(), + Object::Dict(pdfcraft_cos::Dict::from_iter([ + (b"Order".to_vec(), Object::Array(vec![Object::Ref(ObjRef::new(7, 0)), Object::Ref(ObjRef::new(8, 0))])), + (b"OFF".to_vec(), Object::Array(vec![Object::Ref(ObjRef::new(8, 0))])), + ])), + ), + ])), + ); + }) + .unwrap(); + + let before = pdfcraft_edit::text_lines(&doc, 0).unwrap(); + assert!(before.iter().any(|line| line.text.contains("PUBLIC"))); + assert!(before.iter().any(|line| line.text.contains("SECRET")), "extractor sees source text before sanitization"); + remove_hidden(&mut doc, &[Hidden::HiddenLayers]).unwrap(); + + let saved = Document::open(Arc::new(write_full(&doc, &SaveOptions::default()).unwrap())).unwrap(); + let lines = pdfcraft_edit::text_lines(&saved, 0).unwrap(); + assert!(lines.iter().any(|line| line.text.contains("PUBLIC")), "visible content remains: {lines:?}"); + assert!(!lines.iter().any(|line| line.text.contains("SECRET")), "hidden text is extractable: {lines:?}"); + assert!(!write_full(&saved, &SaveOptions::default()).unwrap().windows(6).any(|w| w == b"SECRET")); +} + +#[test] +fn hidden_ocmd_content_in_a_form_and_nested_marked_blocks_is_removed() { + use crate::sanitize::{Hidden, remove_hidden}; + + let mut doc = one_page( + b"/Fm Do", + "/Properties << /M 9 0 R >> /XObject << /Fm 10 0 R >>", + vec![ + b"<< /Type /OCG /Name (On) >>".to_vec(), + b"<< /Type /OCG /Name (Off) >>".to_vec(), + b"<< /Type /OCMD /OCGs [7 0 R 8 0 R] /P /AllOn >>".to_vec(), + stream( + "/Type /XObject /Subtype /Form /BBox [0 0 300 300] /Resources << /Font << /F1 5 0 R >> /Properties << /M 9 0 R >> >>", + b"/OC /M BDC /OC /M BDC BT /F1 10 Tf 10 100 Td (SECRET) Tj ET EMC EMC", + ), + ], + ); + let root = doc.root().unwrap(); + doc.update_dict(root, |d| { + d.set( + b"OCProperties".to_vec(), + Object::Dict(Dict::from_iter([ + (b"OCGs".to_vec(), Object::Array(vec![Object::Ref(ObjRef::new(7, 0)), Object::Ref(ObjRef::new(8, 0))])), + (b"D".to_vec(), Object::Dict(Dict::from_iter([(b"OFF".to_vec(), Object::Array(vec![Object::Ref(ObjRef::new(8, 0))]))]))), + ])), + ); + }) + .unwrap(); + + remove_hidden(&mut doc, &[Hidden::HiddenLayers]).unwrap(); + let saved = Document::open(Arc::new(write_full(&doc, &SaveOptions::default()).unwrap())).unwrap(); + assert!(!pdfcraft_edit::text_lines(&saved, 0).unwrap().iter().any(|line| line.text.contains("SECRET"))); +} + +#[test] +fn hidden_ocmd_alloff_is_sanitized_when_every_group_is_on() { + use crate::sanitize::{Hidden, remove_hidden, scan}; + + let mut doc = one_page( + b"/OC /M BDC BT /F1 10 Tf 10 100 Td (SECRET) Tj ET EMC", + "/Properties << /M 9 0 R >>", + vec![ + b"<< /Type /OCG /Name (On) >>".to_vec(), + b"<< /Type /OCG /Name (Unused) >>".to_vec(), + b"<< /Type /OCMD /OCGs [7 0 R] /P /AllOff >>".to_vec(), + ], + ); + let counts = scan(&doc); + assert!(counts.iter().any(|(h, n)| *h == Hidden::HiddenLayers && *n > 0), "{counts:?}"); + remove_hidden(&mut doc, &[Hidden::HiddenLayers]).unwrap(); + + let saved = Document::open(Arc::new(write_full(&doc, &SaveOptions::default()).unwrap())).unwrap(); + assert!(!pdfcraft_edit::text_lines(&saved, 0).unwrap().iter().any(|line| line.text.contains("SECRET"))); +} + +#[test] +fn hidden_ve_not_is_sanitized_when_its_group_is_on() { + use crate::sanitize::{Hidden, remove_hidden, scan}; + + let mut doc = one_page( + b"/OC /M BDC BT /F1 10 Tf 10 100 Td (SECRET) Tj ET EMC", + "/Properties << /M 9 0 R >>", + vec![b"<< /Type /OCG /Name (On) >>".to_vec(), b"<< /Type /OCG /Name (Unused) >>".to_vec(), b"<< /Type /OCMD /VE [/Not 7 0 R] >>".to_vec()], + ); + let counts = scan(&doc); + assert!(counts.iter().any(|(h, n)| *h == Hidden::HiddenLayers && *n > 0), "{counts:?}"); + remove_hidden(&mut doc, &[Hidden::HiddenLayers]).unwrap(); + + let saved = Document::open(Arc::new(write_full(&doc, &SaveOptions::default()).unwrap())).unwrap(); + assert!(!pdfcraft_edit::text_lines(&saved, 0).unwrap().iter().any(|line| line.text.contains("SECRET"))); +} + +fn all_on_ocmd_xobject(subtype: &str, policy: &str) -> Document { + let membership = match policy { + "AllOff" => "<< /Type /OCMD /OCGs [7 0 R] /P /AllOff >>", + "Not" => "<< /Type /OCMD /VE [/Not 7 0 R] >>", + _ => "<< /Type /OCMD /OCGs [7 0 R] /P /AllOff >>", + }; + let (object_number, oc) = if policy == "DirectAllOff" { (8, membership) } else { (9, "8 0 R") }; + let xobject = match subtype { + "Image" => stream( + &format!("/Type /XObject /Subtype /Image /Width 4 /Height 1 /ColorSpace /DeviceGray /BitsPerComponent 8 /OC {oc}"), + b"PRIVATE_HIDDEN_XOBJECT_IMAGE", + ), + _ => stream( + &format!("/Type /XObject /Subtype /Form /BBox [0 0 300 300] /Resources << /Font << /F1 5 0 R >> >> /OC {oc}"), + b"BT /F1 10 Tf 10 100 Td (PRIVATE_HIDDEN_XOBJECT_FORM) Tj ET", + ), + }; + let mut extras = vec![b"<< /Type /OCG /Name (On) >>".to_vec()]; + if object_number == 9 { + extras.push(membership.as_bytes().to_vec()); + } + extras.push(xobject); + let mut doc = one_page(b"/X Do", &format!("/XObject << /X {object_number} 0 R >>"), extras); + let root = doc.root().unwrap(); + doc.update_dict(root, |d| { + d.set( + b"OCProperties".to_vec(), + Object::Dict(Dict::from_iter([ + (b"OCGs".to_vec(), Object::Array(vec![Object::Ref(ObjRef::new(7, 0))])), + (b"D".to_vec(), Object::Dict(Dict::from_iter([(b"BaseState".to_vec(), Object::name("ON"))]))), + ])), + ); + }) + .unwrap(); + doc +} + +#[test] +fn hidden_all_on_ocmd_image_and_form_xobjects_are_counted_and_removed() { + use crate::sanitize::{Hidden, remove_hidden, scan}; + + let mut failures = Vec::new(); + for subtype in ["Image", "Form"] { + for policy in ["AllOff", "Not"] { + let mut doc = all_on_ocmd_xobject(subtype, policy); + let before = scan(&doc); + let hidden_count = before.iter().find(|(h, _)| *h == Hidden::HiddenLayers).map_or(0, |(_, n)| *n); + if hidden_count == 0 { + failures.push(format!("{subtype} /{policy} was not counted: {before:?}")); + } + + match remove_hidden(&mut doc, &[Hidden::HiddenLayers]) { + Ok(removed) if removed.iter().any(|(h, n)| *h == Hidden::HiddenLayers && *n > 0) => {} + Ok(removed) => failures.push(format!("{subtype} /{policy} remove report is empty: {removed:?}")), + Err(error) => failures.push(format!("{subtype} /{policy} remove failed: {error}")), + } + let bytes = write_full(&doc, &SaveOptions::default()).unwrap(); + if bytes.windows(b"PRIVATE_HIDDEN_XOBJECT_IMAGE".len()).any(|w| w == b"PRIVATE_HIDDEN_XOBJECT_IMAGE") { + failures.push(format!("{subtype} /{policy} image payload remains in full save")); + } + if bytes.windows(b"PRIVATE_HIDDEN_XOBJECT_FORM".len()).any(|w| w == b"PRIVATE_HIDDEN_XOBJECT_FORM") { + failures.push(format!("{subtype} /{policy} Form payload remains in full save")); + } + let saved = Document::open(Arc::new(bytes)).unwrap(); + if pdfcraft_edit::text_lines(&saved, 0).unwrap().iter().any(|line| line.text.contains("PRIVATE_HIDDEN_XOBJECT_FORM")) { + failures.push(format!("{subtype} /{policy} Form text remains extractable")); + } + if !pdfcraft_edit::page_images(&saved, 0).unwrap().is_empty() { + failures.push(format!("{subtype} /{policy} image remains on the page")); + } + } + } + assert!(failures.is_empty(), "{}", failures.join("\n")); +} + +#[test] +fn repeated_image_with_direct_alloff_membership_is_counted_per_draw() { + use crate::sanitize::{Hidden, scan}; + + let mut doc = all_on_ocmd_xobject("Image", "DirectAllOff"); + let page = pdfcraft_model::pages(&doc)[0].obj; + let contents = doc.add(Object::Stream(pdfcraft_cos::Stream::flate(Dict::new(), b"/X Do /X Do /X Do"))); + doc.update_dict(page, |d| d.set(b"Contents".to_vec(), Object::Ref(contents))).unwrap(); + + let original = write_full(&doc, &SaveOptions::default()).unwrap(); + let counts = scan(&doc); + assert_eq!(counts.iter().find(|(h, _)| *h == Hidden::HiddenLayers).map(|(_, n)| *n), Some(3), "{counts:?}"); + assert_eq!(write_full(&doc, &SaveOptions::default()).unwrap(), original, "Verify scan must not mutate the document"); +} + +#[test] +fn undecodable_form_is_counted_and_removed_by_hidden_layer_sanitization() { + use crate::sanitize::{Hidden, remove_hidden, scan}; + + let mut doc = one_page( + b"/Bad Do", + "/XObject << /Bad 7 0 R >>", + vec![stream("/Type /XObject /Subtype /Form /BBox [0 0 300 300] /Filter /UnknownFilter", b"PRIVATE_UNDECODABLE_FORM")], + ); + let counts = scan(&doc); + assert!(counts.iter().any(|(h, n)| *h == Hidden::HiddenLayers && *n > 0), "{counts:?}"); + remove_hidden(&mut doc, &[Hidden::HiddenLayers]).unwrap(); + + let bytes = write_full(&doc, &SaveOptions::default()).unwrap(); + assert!(!bytes.windows(b"PRIVATE_UNDECODABLE_FORM".len()).any(|w| w == b"PRIVATE_UNDECODABLE_FORM")); +} + +#[test] +fn form_chain_at_max_depth_is_counted_and_removed_by_hidden_layer_sanitization() { + use crate::sanitize::{Hidden, remove_hidden, scan}; + + const PRIVATE: &[u8] = b"PRIVATE_FORM_BEYOND_MAX_DEPTH"; + // MAX_DEPTH is 12. The final Form is encountered at that depth and is removed + // conservatively without being entered. Verify must count that removal or sanitize + // can skip the HiddenLayers pass entirely. + let mut forms = Vec::new(); + for depth in 0..=12 { + let content = if depth == 12 { + b"BT /F1 10 Tf 10 100 Td (PRIVATE_FORM_BEYOND_MAX_DEPTH) Tj ET".to_vec() + } else { + format!("/F{} Do", depth + 1).into_bytes() + }; + forms.push(stream("/Type /XObject /Subtype /Form /BBox [0 0 300 300]", &content)); + } + let xobjects = (0..=12).map(|depth| format!("/F{depth} {} 0 R", 7 + depth)).collect::>().join(" "); + let mut doc = one_page(b"/F0 Do", &format!("/XObject << {xobjects} >>"), forms); + assert!( + write_full(&doc, &SaveOptions::default()).unwrap().windows(PRIVATE.len()).any(|w| w == PRIVATE), + "fixture lacked nested payload before sanitization" + ); + + let counts = scan(&doc); + assert!(counts.iter().any(|(hidden, count)| *hidden == Hidden::HiddenLayers && *count > 0), "depth-limited Form was not counted: {counts:?}"); + let removed = remove_hidden(&mut doc, &[Hidden::HiddenLayers]).unwrap(); + assert!( + removed.iter().any(|(hidden, count)| *hidden == Hidden::HiddenLayers && *count > 0), + "depth-limited Form was not reported removed: {removed:?}" + ); + let bytes = write_full(&doc, &SaveOptions::default()).unwrap(); + assert!(!bytes.windows(PRIVATE.len()).any(|w| w == PRIVATE), "depth-limited Form payload remains in full save"); +} + +#[test] +fn hidden_ocmd_resolves_an_indirect_policy_name() { + use crate::sanitize::{Hidden, remove_hidden}; + + let mut doc = one_page( + b"/OC /M BDC BT /F1 10 Tf 10 100 Td (VISIBLE) Tj ET EMC", + "/Properties << /M 9 0 R >>", + vec![ + b"<< /Type /OCG /Name (On) >>".to_vec(), + b"<< /Type /OCG /Name (Off) >>".to_vec(), + b"<< /Type /OCMD /OCGs [7 0 R 8 0 R] /P 12 0 R >>".to_vec(), + ], + ); + doc.set(ObjRef::new(12, 0), Object::name("AnyOn")); + let root = doc.root().unwrap(); + doc.update_dict(root, |d| { + d.set( + b"OCProperties".to_vec(), + Object::Dict(Dict::from_iter([ + (b"OCGs".to_vec(), Object::Array(vec![Object::Ref(ObjRef::new(7, 0)), Object::Ref(ObjRef::new(8, 0))])), + (b"D".to_vec(), Object::Dict(Dict::from_iter([(b"OFF".to_vec(), Object::Array(vec![Object::Ref(ObjRef::new(8, 0))]))]))), + ])), + ); + }) + .unwrap(); + + remove_hidden(&mut doc, &[Hidden::HiddenLayers]).unwrap(); + let saved = Document::open(Arc::new(write_full(&doc, &SaveOptions::default()).unwrap())).unwrap(); + assert!(pdfcraft_edit::text_lines(&saved, 0).unwrap().iter().any(|line| line.text.contains("VISIBLE"))); +} + +#[test] +fn surviving_anyoff_and_not_content_keeps_its_off_group_state() { + use crate::sanitize::{Hidden, remove_hidden}; + + for use_not in [false, true] { + let mut doc = one_page( + b"/OC /M BDC BT /F1 10 Tf 10 100 Td (VISIBLE) Tj ET EMC", + "/Properties << /M 9 0 R >>", + vec![ + b"<< /Type /OCG /Name (On) >>".to_vec(), + b"<< /Type /OCG /Name (Off) >>".to_vec(), + if use_not { b"<< /Type /OCMD /VE [/Not 8 0 R] >>".to_vec() } else { b"<< /Type /OCMD /OCGs [8 0 R] /P /AnyOff >>".to_vec() }, + ], + ); + let root = doc.root().unwrap(); + doc.update_dict(root, |d| { + d.set( + b"OCProperties".to_vec(), + Object::Dict(Dict::from_iter([ + (b"OCGs".to_vec(), Object::Array(vec![Object::Ref(ObjRef::new(7, 0)), Object::Ref(ObjRef::new(8, 0))])), + (b"D".to_vec(), Object::Dict(Dict::from_iter([(b"OFF".to_vec(), Object::Array(vec![Object::Ref(ObjRef::new(8, 0))]))]))), + ])), + ); + }) + .unwrap(); + + remove_hidden(&mut doc, &[Hidden::HiddenLayers]).unwrap(); + let root = doc.root().unwrap(); + let catalog = doc.get(root); + let oc = catalog.as_dict().and_then(|d| d.get(b"OCProperties")).map(|o| doc.resolve(o)); + let default = oc.as_deref().and_then(|o| o.as_dict()).and_then(|d| d.get(b"D")).map(|o| doc.resolve(o)); + let off = default.as_deref().and_then(|o| o.as_dict()).and_then(|d| d.get(b"OFF")).map(|o| doc.resolve(o)); + assert!( + off.as_deref().and_then(Object::as_array).is_some_and(|a| a.iter().any(|o| o.as_ref() == Some(ObjRef::new(8, 0)))), + "off group lost for /VE Not={use_not}" + ); + let saved = Document::open(Arc::new(write_full(&doc, &SaveOptions::default()).unwrap())).unwrap(); + assert!(pdfcraft_edit::text_lines(&saved, 0).unwrap().iter().any(|line| line.text.contains("VISIBLE"))); + } +} + +#[test] +fn hidden_ocmd_policy_matches_the_default_configuration() { + use crate::sanitize::{Hidden, remove_hidden}; + + let cases = [ + (None, false, None, false), + (Some("AnyOn"), false, None, false), + (Some("AllOn"), false, None, true), + (Some("AnyOff"), false, None, false), + (Some("AllOff"), false, None, true), + (Some("UnknownPolicy"), false, None, true), + (None, true, None, true), + (None, false, Some("and"), true), + (None, false, Some("and_single_not"), true), + (None, false, Some("and_single_off"), true), + (None, false, Some("or_single_on"), false), + (None, false, Some("or_single_off"), true), + (Some("AllOn"), false, Some("not_off"), false), + (None, false, Some("malformed_not"), true), + (None, false, Some("malformed_without_ocgs"), true), + ]; + for (policy, malformed_policy, visibility, should_remove) in cases { + let mut doc = one_page( + b"/OC /M BDC BT /F1 10 Tf 10 100 Td (SECRET) Tj ET EMC", + "/Properties << /M 9 0 R >>", + vec![ + b"<< /Type /OCG /Name (On) >>".to_vec(), + b"<< /Type /OCG /Name (Off) >>".to_vec(), + b"<< /Type /OCMD /OCGs [7 0 R 8 0 R] /P /AllOn >>".to_vec(), + ], + ); + let mut membership = Dict::new(); + membership.set(b"Type".to_vec(), Object::name("OCMD")); + if visibility != Some("malformed_without_ocgs") { + membership.set(b"OCGs".to_vec(), Object::Array(vec![Object::Ref(ObjRef::new(7, 0)), Object::Ref(ObjRef::new(8, 0))])); + } + if let Some(policy) = policy { + membership.set(b"P".to_vec(), Object::name(policy)); + } else if malformed_policy { + membership.set(b"P".to_vec(), Object::Int(17)); + } + match visibility { + Some("and") => membership + .set(b"VE".to_vec(), Object::Array(vec![Object::name("And"), Object::Ref(ObjRef::new(7, 0)), Object::Ref(ObjRef::new(8, 0))])), + Some("and_single_not") => membership.set( + b"VE".to_vec(), + Object::Array(vec![Object::name("Not"), Object::Array(vec![Object::name("And"), Object::Ref(ObjRef::new(7, 0))])]), + ), + Some("and_single_off") => membership.set(b"VE".to_vec(), Object::Array(vec![Object::name("And"), Object::Ref(ObjRef::new(8, 0))])), + Some("or_single_on") => membership.set(b"VE".to_vec(), Object::Array(vec![Object::name("Or"), Object::Ref(ObjRef::new(7, 0))])), + Some("or_single_off") => membership.set(b"VE".to_vec(), Object::Array(vec![Object::name("Or"), Object::Ref(ObjRef::new(8, 0))])), + Some("not_off") => membership.set(b"VE".to_vec(), Object::Array(vec![Object::name("Not"), Object::Ref(ObjRef::new(8, 0))])), + Some("malformed_not") => membership + .set(b"VE".to_vec(), Object::Array(vec![Object::name("Not"), Object::Ref(ObjRef::new(7, 0)), Object::Ref(ObjRef::new(8, 0))])), + Some("malformed_without_ocgs") => { + membership.set(b"VE".to_vec(), Object::Array(vec![Object::name("UnknownOperator"), Object::Ref(ObjRef::new(8, 0))])) + } + _ => {} + } + doc.set(ObjRef::new(9, 0), Object::Dict(membership)); + let root = doc.root().unwrap(); + doc.update_dict(root, |d| { + d.set( + b"OCProperties".to_vec(), + Object::Dict(Dict::from_iter([ + (b"OCGs".to_vec(), Object::Array(vec![Object::Ref(ObjRef::new(7, 0)), Object::Ref(ObjRef::new(8, 0))])), + ( + b"D".to_vec(), + Object::Dict(Dict::from_iter([ + (b"Order".to_vec(), Object::Array(vec![Object::Ref(ObjRef::new(7, 0)), Object::Ref(ObjRef::new(8, 0))])), + (b"OFF".to_vec(), Object::Array(vec![Object::Ref(ObjRef::new(8, 0))])), + ])), + ), + ])), + ); + }) + .unwrap(); + + remove_hidden(&mut doc, &[Hidden::HiddenLayers]).unwrap(); + let saved = Document::open(Arc::new(write_full(&doc, &SaveOptions::default()).unwrap())).unwrap(); + let has_secret = pdfcraft_edit::text_lines(&saved, 0).unwrap().iter().any(|line| line.text.contains("SECRET")); + assert_eq!(has_secret, !should_remove, "policy {policy:?}, malformed={malformed_policy}, VE={visibility:?}"); + } +} + #[test] fn redacting_an_xfa_field_drops_the_xfa_packet_so_its_value_cannot_survive() { // A static AcroForm+XFA form whose field value lives both in the widget /V and in the XFA