3 ms·

Couldn't you just use a whitelist for the features? If the reader can open a PDF/A-1 file and ignore the bad parts, can't it open a PDF file as PDF/A-1 and rem

Couldn't you just use a whitelist for the features? If the reader can open a PDF/A-1 file and ignore the bad parts, can't it open a PDF file as PDF/A-1 and remove the bad parts, before saving it again? Then you could use the "re-rendering" technique to extract images: 1. Create a stripped PDF/A-1 file from the original PDF. 2. In a VM, render the two PDF files to two high-resolution image sets. 3. Use some CV algorithm to find the differences. For example, gaussian blur, subtract, threshold, find islands. 4. Use this to come up with areas which use complicated PDF features and/or images. Say this returns that there is an image on page 9 in the rectangle ((17, 338), (400, 300)). 5. Crop out page 9 in rectangle ((17, 338), (400, 300)) from the original PDF. Use some CV algorithm to detect the DPI and whether it's best to encode as JPEG or PNG. Encode it and add to list of images. 6. Add sanitized images back from list, mark PDF/A-1 file with images as PDF/A-2. Of course, you could do this for links or whatever as well. Spit out a list of rectangles and link targets in the PDF, and then put them back in.

ris 7y ago
There are myriad ways that PDFs could be re-written and re-rendered, but they would all be quite complicated and/or throw away a lot of extremely useful "meta" information (bookmarks, signed sections etc.) and almost certainly make files much bigger. The idea of the "appending" trick would be to mutate the original file as little as possible, but convince the reader to open it in a safer mode.
- jrowley 7y ago
  The small issue with the append trick is that is that it assumes the reader application will now respect the new format and not open insecure parts... which might not be fully implemented in all cases and is reader specific. Fully sanitizing the PDF yields better guarantees of security at the cost of lost functionality.
  - ris 7y ago
    > The small issue with the append trick is that is that it assumes the reader application will now respect the new format and not open insecure parts... which might not be fully implemented in all cases and is reader specific. Yes, note my original emphasised use of the term "supposed to". > Fully sanitizing the PDF yields better guarantees of security at the cost of lost functionality. Indeed it's a tradeoff. But if you're willing to throw away the features which this extreme sanitization would trample across and have any ability to design PDF out of your system, you're probably better off not using PDF at all in favour of some straightforward image format.
- heartbeats 7y ago
  I am not sure whether bookmarks or signed sections are "extremely useful". This has some minor advantages, but it's also a large attack surface. At least in this way, you keep most useful features. As jrowley said, if you trust the reader to sanitize it safely, why not trust it to open normal PDF files safely?
  - ris 7y ago
    > I am not sure whether bookmarks or signed sections are "extremely useful". Well, they are. You try using a thousand page manual that doesn't have a section outline, or try sending around PDFs whose authenticity is legally important (to people who aren't capable of using gpg). This is only scratching the surface - there are many features which are important to people with e.g. accessibility needs which aren't directly visible. > This has some minor advantages, but it's also a large attack surface. These are not a large attack surface. TIFF, JavaScript/PostScript, 3D content and video (yes - PDFs can contain video!) are a "large attack surface". > As jrowley said, if you trust the reader to sanitize it safely, why not trust it to open normal PDF files safely? Well, firstly, I emphasised how "PDF readers are supposed to automatically 'turn off' non-PDF/A features", so I already acknowledge the caveat. And as far as "trusting them" goes, disabling the decoding of certain features involves very few LOC. Completely implementing the whole specification for the more exotic PDF features is an incomparably huge number of LOC, which are proportionately more likely to have flaws.

ris 7y ago

There are myriad ways that PDFs could be re-written and re-rendered, but they would all be quite complicated and/or throw away a lot of extremely useful "meta" information (bookmarks, signed sections etc.) and almost certainly make files much bigger. The idea of the "appending" trick would be to mutate the original file as little as possible, but convince the reader to open it in a safer mode.

jrowley 7y ago
The small issue with the append trick is that is that it assumes the reader application will now respect the new format and not open insecure parts... which might not be fully implemented in all cases and is reader specific. Fully sanitizing the PDF yields better guarantees of security at the cost of lost functionality.
- ris 7y ago
  > The small issue with the append trick is that is that it assumes the reader application will now respect the new format and not open insecure parts... which might not be fully implemented in all cases and is reader specific. Yes, note my original emphasised use of the term "supposed to". > Fully sanitizing the PDF yields better guarantees of security at the cost of lost functionality. Indeed it's a tradeoff. But if you're willing to throw away the features which this extreme sanitization would trample across and have any ability to design PDF out of your system, you're probably better off not using PDF at all in favour of some straightforward image format.
heartbeats 7y ago
I am not sure whether bookmarks or signed sections are "extremely useful". This has some minor advantages, but it's also a large attack surface. At least in this way, you keep most useful features. As jrowley said, if you trust the reader to sanitize it safely, why not trust it to open normal PDF files safely?
- ris 7y ago
  > I am not sure whether bookmarks or signed sections are "extremely useful". Well, they are. You try using a thousand page manual that doesn't have a section outline, or try sending around PDFs whose authenticity is legally important (to people who aren't capable of using gpg). This is only scratching the surface - there are many features which are important to people with e.g. accessibility needs which aren't directly visible. > This has some minor advantages, but it's also a large attack surface. These are not a large attack surface. TIFF, JavaScript/PostScript, 3D content and video (yes - PDFs can contain video!) are a "large attack surface". > As jrowley said, if you trust the reader to sanitize it safely, why not trust it to open normal PDF files safely? Well, firstly, I emphasised how "PDF readers are supposed to automatically 'turn off' non-PDF/A features", so I already acknowledge the caveat. And as far as "trusting them" goes, disabling the decoding of certain features involves very few LOC. Completely implementing the whole specification for the more exotic PDF features is an incomparably huge number of LOC, which are proportionately more likely to have flaws.