diff --git a/crates/redact/src/sanitize.rs b/crates/redact/src/sanitize.rs index 8965f82e6c..49b7adaf38 100644 --- a/crates/redact/src/sanitize.rs +++ b/crates/redact/src/sanitize.rs @@ -372,29 +372,43 @@ fn once( } /// `o` without the entries `keep` refuses, through nested arrays (an `/Order` holds sub-lists, and -/// `/RBGroups` holds groups), each array written by reference cleaned [`once`]. -fn filtered(doc: &mut Document, o: &Object, keep: &impl Fn(&Object) -> bool, depth: usize, cleaned: &mut Cleaned) -> Result { +/// `/RBGroups` holds groups), each array written by reference cleaned [`once`]. `None` when `keep` +/// refuses `o` itself, or when `o` is a sub-list (`depth` above 0) that named a layer and names +/// none now: it goes, with the heading that labelled it. +fn filtered( + doc: &mut Document, + o: &Object, + keep: &impl Fn(&Object) -> bool, + depth: usize, + cleaned: &mut Cleaned, +) -> Result, RedactError> { if depth > MAX_DIRECT_DEPTH { return Err(RedactError::TooDeep); } - let out = once(doc, o, cleaned, |doc, o, cleaned| { + if !keep(o) { + return Ok(None); + } + once(doc, o, cleaned, |doc, o, cleaned| { let Object::Array(a) = o else { return Ok(Some(o.clone())) }; let mut out = Vec::new(); - for x in a.iter().filter(|x| keep(x)) { - out.push(filtered(doc, x, keep, depth + 1, cleaned)?); + for x in a { + out.extend(filtered(doc, x, keep, depth + 1, cleaned)?); } - Ok(Some(Object::Array(out))) - })?; - Ok(out.unwrap_or_else(|| Object::Array(Vec::new()))) + // Anything but a text string (a heading) is a layer or a sub-list. + let names = |l: &[Object]| l.iter().any(|x| !matches!(x, Object::String(_))); + let emptied = depth > 0 && names(a.as_slice()) && !names(out.as_slice()); + Ok((!emptied).then_some(Object::Array(out))) + }) } /// An optional-content configuration without the layers `keep` refuses, in every list that names -/// them: on, off, order, locked, radio-button groups and usage rules (a rule left with no layer -/// goes). A removed layer still named in any of them would stay in the file, its name included. +/// them: on, off, order, locked, radio-button groups and usage rules (a rule, group or sub-list left +/// with no layer goes). A removed layer still named in any of them would stay in the file, its name +/// included. fn config_without(doc: &mut Document, mut d: Dict, keep: &impl Fn(&Object) -> bool, cleaned: &mut Cleaned) -> Result { for k in [&b"ON"[..], b"OFF", b"Order", b"Locked", b"RBGroups"] { if let Some(v) = d.get(k).cloned() { - let v = filtered(doc, &v, keep, 0, cleaned)?; + let v = filtered(doc, &v, keep, 0, cleaned)?.unwrap_or_else(|| Object::Array(Vec::new())); d.set(k.to_vec(), v); } } @@ -406,7 +420,7 @@ fn config_without(doc: &mut Document, mut d: Dict, keep: &impl Fn(&Object) -> bo kept.extend(once(doc, rule, cleaned, |doc, rule, cleaned| { let Some(mut rule) = rule.as_dict().cloned() else { return Ok(None) }; if let Some(layers) = rule.get(b"OCGs").cloned() { - let layers = filtered(doc, &layers, keep, 0, cleaned)?; + let Some(layers) = filtered(doc, &layers, keep, 0, cleaned)? else { return Ok(None) }; if doc.resolve(&layers).as_array().is_some_and(Vec::is_empty) { return Ok(None); } diff --git a/crates/redact/src/tests.rs b/crates/redact/src/tests.rs index 6c5d8ae800..f28fdeb353 100644 --- a/crates/redact/src/tests.rs +++ b/crates/redact/src/tests.rs @@ -4235,13 +4235,14 @@ fn a_shared_layer_list_is_cleaned_once() { } /// A removed off layer leaves every list that names it, or its dictionary, name included, stays in -/// the file: a sub-list of the default `/Order`, a radio-button group, a usage rule, and the -/// alternate configurations in `/Configs`. +/// the file: a sub-list of the default `/Order` (its heading too, once it names no layer), a +/// radio-button group (a group left empty goes), a usage rule (one that names it directly too), and +/// the alternate configurations in `/Configs`. #[test] fn a_removed_layer_leaves_every_configuration() { use crate::sanitize::{Hidden, remove_hidden}; let mut doc = pdf(vec![ - b"<< /Type /Catalog /Pages 2 0 R /OCProperties << /OCGs [6 0 R 7 0 R] /D << /OFF [6 0 R] /Order [7 0 R [(Group) 6 0 R]] /RBGroups [[6 0 R 7 0 R]] /AS [<< /Event /Print /OCGs [6 0 R] /Category [/Print] >>] >> /Configs [8 0 R] >> >>".to_vec(), + b"<< /Type /Catalog /Pages 2 0 R /OCProperties << /OCGs [6 0 R 7 0 R] /D << /OFF [6 0 R] /Order [7 0 R [(Group) 6 0 R]] /RBGroups [[6 0 R 7 0 R] [6 0 R]] /AS [<< /Event /Print /OCGs [6 0 R] /Category [/Print] >> << /Event /View /OCGs 6 0 R /Category [/View] >>] >> /Configs [8 0 R] >> >>".to_vec(), b"<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_vec(), b"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 300 300] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> /Properties << /L1 6 0 R >> >> >>".to_vec(), stream("", b"/OC /L1 BDC BT /F1 10 Tf 10 50 Td (Gone) Tj ET EMC BT /F1 10 Tf 10 100 Td (Kept) Tj ET"), @@ -4256,4 +4257,9 @@ fn a_removed_layer_leaves_every_configuration() { let has = |needle: &[u8]| bytes.windows(needle.len()).any(|w| w == needle); assert!(has(b"(Shown layer)") && has(b"(Other view)"), "the layer that stays and the configuration stay"); assert!(!has(b"SECRETLAYERNAME"), "the removed layer survived the save"); + assert!(!has(b"(Group)"), "the heading of a sub-list left with no layer stayed"); + let catalog = doc.get(doc.root().unwrap()); + let config = catalog.as_dict().and_then(|c| c.get(b"OCProperties")).and_then(Object::as_dict).and_then(|p| p.get(b"D")).and_then(Object::as_dict); + let group = Object::Array(vec![Object::Ref(ObjRef::new(7, 0))]); + assert_eq!(config.and_then(|d| d.get(b"RBGroups")), Some(&Object::Array(vec![group])), "a radio-button group left empty stayed"); }