diff -Nru libpdfbox2-java-2.0.9/app/pom.xml libpdfbox2-java-2.0.13/app/pom.xml --- libpdfbox2-java-2.0.9/app/pom.xml 2018-03-20 16:19:48.000000000 +0000 +++ libpdfbox2-java-2.0.13/app/pom.xml 2018-11-28 17:18:34.000000000 +0000 @@ -23,7 +23,7 @@ org.apache.pdfbox pdfbox-parent - 2.0.9 + 2.0.13 ../parent/pom.xml @@ -68,7 +68,7 @@ true

*;scope=provided;inline=org/apache/**|org/bouncycastle/**|META-INF/services/**

${project.url} - !junit.framework,!junit.textui,javax.*;resolution:=optional,org.apache.avalon.framework.logger;resolution:=optional,org.apache.log;resolution:=optional,org.apache.log4j;resolution:=optional,* + !junit.framework,!junit.textui,javax.*;resolution:=optional,org.apache.avalon.framework.logger;resolution:=optional,org.apache.log;resolution:=optional,* org.apache.pdfbox.debugger.PDFDebugger diff -Nru libpdfbox2-java-2.0.9/examples/pom.xml libpdfbox2-java-2.0.13/examples/pom.xml --- libpdfbox2-java-2.0.9/examples/pom.xml 2018-03-20 16:19:44.000000000 +0000 +++ libpdfbox2-java-2.0.13/examples/pom.xml 2018-11-28 17:18:40.000000000 +0000 @@ -23,7 +23,7 @@ org.apache.pdfbox pdfbox-parent - 2.0.9 + 2.0.13 ../parent/pom.xml @@ -42,6 +42,26 @@ + + + + [11,) + + + + javax.xml.bind + jaxb-api + provided + + + javax.activation + activation + provided + + + + + org.bouncycastle @@ -77,7 +97,7 @@ org.apache.ant ant - 1.9.6 + 1.10.5 junit @@ -85,9 +105,15 @@ test - org.apache.wink - wink-component-test-support - 1.4 + javax.servlet + javax.servlet-api + 4.0.1 + test + + + org.apache.geronimo.specs + geronimo-jaxrs_1.1_spec + 1.0 test diff -Nru libpdfbox2-java-2.0.9/examples/src/main/appended-resources/META-INF/LICENSE libpdfbox2-java-2.0.13/examples/src/main/appended-resources/META-INF/LICENSE --- libpdfbox2-java-2.0.9/examples/src/main/appended-resources/META-INF/LICENSE 2018-03-20 16:19:44.000000000 +0000 +++ libpdfbox2-java-2.0.13/examples/src/main/appended-resources/META-INF/LICENSE 2018-11-28 17:18:40.000000000 +0000 @@ -169,14 +169,111 @@ copyright holder. The file "sRGB Color Space Profile.icm" is: -Copyright (c) 1998 Hewlett-Packard Company -To anyone who acknowledges that the file "sRGB Color Space Profile.icm" -is provided "AS IS" WITH NO EXPRESS OR IMPLIED WARRANTY: -permission to use, copy and distribute this file for any purpose is hereby -granted without fee, provided that the file is not changed including the HP -copyright notice tag, and that the name of Hewlett-Packard Company not be -used in advertising or publicity pertaining to distribution of the software -without specific, written prior permission. Hewlett-Packard Company makes -no representations about the suitability of this software for any purpose. + Copyright (c) 1998 Hewlett-Packard Company + To anyone who acknowledges that the file "sRGB Color Space Profile.icm" + is provided "AS IS" WITH NO EXPRESS OR IMPLIED WARRANTY: + permission to use, copy and distribute this file for any purpose is hereby + granted without fee, provided that the file is not changed including the HP + copyright notice tag, and that the name of Hewlett-Packard Company not be + used in advertising or publicity pertaining to distribution of the software + without specific, written prior permission. Hewlett-Packard Company makes + no representations about the suitability of this software for any purpose. + +Lohit-Bengali font (https://pagure.io/lohit): + + Copyright 2011-13 Lohit Fonts Project contributors + + + This Font Software is licensed under the SIL Open Font License, Version 1.1. + This license is copied below, and is also available with a FAQ at: + http://scripts.sil.org/OFL + + + ----------------------------------------------------------- + SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007 + ----------------------------------------------------------- + + PREAMBLE + The goals of the Open Font License (OFL) are to stimulate worldwide + development of collaborative font projects, to support the font creation + efforts of academic and linguistic communities, and to provide a free and + open framework in which fonts may be shared and improved in partnership + with others. + + The OFL allows the licensed fonts to be used, studied, modified and + redistributed freely as long as they are not sold by themselves. The + fonts, including any derivative works, can be bundled, embedded, + redistributed and/or sold with any software provided that any reserved + names are not used by derivative works. The fonts and derivatives, + however, cannot be released under any other type of license. The + requirement for fonts to remain under this license does not apply + to any document created using the fonts or their derivatives. + + DEFINITIONS + "Font Software" refers to the set of files released by the Copyright + Holder(s) under this license and clearly marked as such. This may + include source files, build scripts and documentation. + + "Reserved Font Name" refers to any names specified as such after the + copyright statement(s). + + "Original Version" refers to the collection of Font Software components as + distributed by the Copyright Holder(s). + + "Modified Version" refers to any derivative made by adding to, deleting, + or substituting -- in part or in whole -- any of the components of the + Original Version, by changing formats or by porting the Font Software to a + new environment. + + "Author" refers to any designer, engineer, programmer, technical + writer or other person who contributed to the Font Software. + + PERMISSION & CONDITIONS + Permission is hereby granted, free of charge, to any person obtaining + a copy of the Font Software, to use, study, copy, merge, embed, modify, + redistribute, and sell modified and unmodified copies of the Font + Software, subject to the following conditions: + + 1) Neither the Font Software nor any of its individual components, + in Original or Modified Versions, may be sold by itself. + + 2) Original or Modified Versions of the Font Software may be bundled, + redistributed and/or sold with any software, provided that each copy + contains the above copyright notice and this license. These can be + included either as stand-alone text files, human-readable headers or + in the appropriate machine-readable metadata fields within text or + binary files as long as those fields can be easily viewed by the user. + + 3) No Modified Version of the Font Software may use the Reserved Font + Name(s) unless explicit written permission is granted by the corresponding + Copyright Holder. This restriction only applies to the primary font name as + presented to the users. + + 4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font + Software shall not be used to promote, endorse or advertise any + Modified Version, except to acknowledge the contribution(s) of the + Copyright Holder(s) and the Author(s) or with their explicit written + permission. + + 5) The Font Software, modified or unmodified, in part or in whole, + must be distributed entirely under this license, and must not be + distributed under any other license. The requirement for fonts to + remain under this license does not apply to any document created + using the Font Software. + + TERMINATION + This license becomes null and void if any of the above conditions are + not met. + + DISCLAIMER + THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, + EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF + MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT + OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE + COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, + INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL + DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING + FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM + OTHER DEALINGS IN THE FONT SOFTWARE. diff -Nru libpdfbox2-java-2.0.9/examples/src/main/java/org/apache/pdfbox/examples/ant/package.html libpdfbox2-java-2.0.13/examples/src/main/java/org/apache/pdfbox/examples/ant/package.html --- libpdfbox2-java-2.0.9/examples/src/main/java/org/apache/pdfbox/examples/ant/package.html 2018-03-20 16:19:44.000000000 +0000 +++ libpdfbox2-java-2.0.13/examples/src/main/java/org/apache/pdfbox/examples/ant/package.html 2018-11-28 17:18:40.000000000 +0000 @@ -21,14 +21,14 @@ ANT tasks that utilize PDFBox features can be found in this package. -This is an example of using the PDF2Text task:

+This is an example of using the PDF2Text task:

-<taskdef name="pdf2text" classname="org.apache.pdfbox.ant.PDFToTextTask" classpathref="build.classpath" />
+<taskdef name="pdf2text" classname="org.apache.pdfbox.ant.PDFToTextTask" classpathref="build.classpath" />
-<pdf2text>
-   <fileset dir="test">
-     <include name="**/*.pdf" />
-   </fileset>
-</pdf2text>
+<pdf2text>
+   <fileset dir="test">
+     <include name="**/*.pdf" />
+   </fileset>
+</pdf2text>
diff -Nru libpdfbox2-java-2.0.9/examples/src/main/java/org/apache/pdfbox/examples/pdmodel/AddAnnotations.java libpdfbox2-java-2.0.13/examples/src/main/java/org/apache/pdfbox/examples/pdmodel/AddAnnotations.java --- libpdfbox2-java-2.0.9/examples/src/main/java/org/apache/pdfbox/examples/pdmodel/AddAnnotations.java 2018-03-20 16:19:44.000000000 +0000 +++ libpdfbox2-java-2.0.13/examples/src/main/java/org/apache/pdfbox/examples/pdmodel/AddAnnotations.java 2018-11-28 17:18:40.000000000 +0000 @@ -18,6 +18,9 @@ import java.io.IOException; import java.util.List; +import org.apache.pdfbox.cos.COSArray; +import org.apache.pdfbox.cos.COSFloat; +import org.apache.pdfbox.cos.COSName; import org.apache.pdfbox.pdmodel.PDDocument; import org.apache.pdfbox.pdmodel.PDPage; import org.apache.pdfbox.pdmodel.common.PDRectangle; @@ -31,6 +34,7 @@ import org.apache.pdfbox.pdmodel.interactive.annotation.PDAnnotation; import org.apache.pdfbox.pdmodel.interactive.annotation.PDAnnotationLine; import org.apache.pdfbox.pdmodel.interactive.annotation.PDAnnotationLink; +import org.apache.pdfbox.pdmodel.interactive.annotation.PDAnnotationMarkup; import org.apache.pdfbox.pdmodel.interactive.annotation.PDAnnotationSquareCircle; import org.apache.pdfbox.pdmodel.interactive.annotation.PDAnnotationTextMarkup; import org.apache.pdfbox.pdmodel.interactive.annotation.PDBorderStyleDictionary; @@ -70,6 +74,7 @@ // Some basic reusable objects/constants // Annotations themselves can only be used once! PDColor red = new PDColor(new float[] { 1, 0, 0 }, PDDeviceRGB.INSTANCE); + PDColor green = new PDColor(new float[] { 0, 1, 0 }, PDDeviceRGB.INSTANCE); PDColor blue = new PDColor(new float[] { 0, 0, 1 }, PDDeviceRGB.INSTANCE); PDColor black = new PDColor(new float[] { 0, 0, 0 }, PDDeviceRGB.INSTANCE); @@ -235,8 +240,30 @@ dest.setPage(page3); actionGoto.setDestination(dest); pageLink.setAction(actionGoto); - annotations.add(pageLink); - + annotations.add(pageLink); + + // create a polygon annotation. Yes this is clunky, it will be easier in 3.0 + PDAnnotationMarkup polygon = new PDAnnotationMarkup(); + polygon.getCOSObject().setName(COSName.SUBTYPE, PDAnnotationMarkup.SUB_TYPE_POLYGON); + position = new PDRectangle(); + position.setLowerLeftX(pw - INCH); + position.setLowerLeftY(ph - INCH); + position.setUpperRightX(pw - 2 * INCH); + position.setUpperRightY(ph - 2 * INCH); + polygon.setRectangle(position); + polygon.setColor(blue); // border color + polygon.getCOSObject().setItem(COSName.IC, green.toCOSArray()); // interior color + COSArray verticesArray = new COSArray(); + verticesArray.add(new COSFloat(pw - INCH)); + verticesArray.add(new COSFloat(ph - 2 * INCH)); + verticesArray.add(new COSFloat(pw - INCH * 1.5f)); + verticesArray.add(new COSFloat(ph - INCH)); + verticesArray.add(new COSFloat(pw - 2 * INCH)); + verticesArray.add(new COSFloat(ph - 2 * INCH)); + polygon.getCOSObject().setItem(COSName.VERTICES, verticesArray); + polygon.setBorderStyle(borderThick); + polygon.setContents("Polygon annotation"); + annotations.add(polygon); showPageNo(document, page1, "Page 1"); showPageNo(document, page2, "Page 2"); diff -Nru libpdfbox2-java-2.0.9/examples/src/main/java/org/apache/pdfbox/examples/pdmodel/CreateBookmarks.java libpdfbox2-java-2.0.13/examples/src/main/java/org/apache/pdfbox/examples/pdmodel/CreateBookmarks.java --- libpdfbox2-java-2.0.9/examples/src/main/java/org/apache/pdfbox/examples/pdmodel/CreateBookmarks.java 2018-03-20 16:19:44.000000000 +0000 +++ libpdfbox2-java-2.0.13/examples/src/main/java/org/apache/pdfbox/examples/pdmodel/CreateBookmarks.java 2018-11-28 17:18:40.000000000 +0000 @@ -21,6 +21,7 @@ import org.apache.pdfbox.pdmodel.PDDocument; import org.apache.pdfbox.pdmodel.PDPage; +import org.apache.pdfbox.pdmodel.PageMode; import org.apache.pdfbox.pdmodel.interactive.documentnavigation.destination.PDPageDestination; import org.apache.pdfbox.pdmodel.interactive.documentnavigation.destination.PDPageFitWidthDestination; import org.apache.pdfbox.pdmodel.interactive.documentnavigation.outline.PDDocumentOutline; @@ -84,6 +85,9 @@ } pagesOutline.openNode(); outline.openNode(); + + // optional: show the outlines when opening the file + document.getDocumentCatalog().setPageMode(PageMode.USE_OUTLINES); document.save( args[1] ); } diff -Nru libpdfbox2-java-2.0.9/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/CertificateVerificationException.java libpdfbox2-java-2.0.13/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/CertificateVerificationException.java --- libpdfbox2-java-2.0.9/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/CertificateVerificationException.java 1970-01-01 00:00:00.000000000 +0000 +++ libpdfbox2-java-2.0.13/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/CertificateVerificationException.java 2018-11-28 17:18:40.000000000 +0000 @@ -0,0 +1,40 @@ +/** + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +package org.apache.pdfbox.examples.signature.cert; + +/** + * Copied from Apache CXF 2.4.9, initial version: + * https://svn.apache.org/repos/asf/cxf/tags/cxf-2.4.9/distribution/src/main/release/samples/sts_issue_operation/src/main/java/demo/sts/provider/cert/ + * + */ +public class CertificateVerificationException extends Exception +{ + private static final long serialVersionUID = 1L; + + public CertificateVerificationException(String message, Throwable cause) + { + super(message, cause); + } + + public CertificateVerificationException(String message) + { + super(message); + } +} diff -Nru libpdfbox2-java-2.0.9/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/CertificateVerificationResult.java libpdfbox2-java-2.0.13/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/CertificateVerificationResult.java --- libpdfbox2-java-2.0.9/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/CertificateVerificationResult.java 1970-01-01 00:00:00.000000000 +0000 +++ libpdfbox2-java-2.0.13/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/CertificateVerificationResult.java 2018-11-28 17:18:40.000000000 +0000 @@ -0,0 +1,65 @@ +/** + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +package org.apache.pdfbox.examples.signature.cert; + +import java.security.cert.PKIXCertPathBuilderResult; + +/** + * Copied from Apache CXF 2.4.9, initial version: + * https://svn.apache.org/repos/asf/cxf/tags/cxf-2.4.9/distribution/src/main/release/samples/sts_issue_operation/src/main/java/demo/sts/provider/cert/ + * + */ +public class CertificateVerificationResult +{ + private boolean valid; + private PKIXCertPathBuilderResult result; + private Throwable exception; + + /** + * Constructs a certificate verification result for valid certificate by + * given certification path. + */ + public CertificateVerificationResult(PKIXCertPathBuilderResult result) + { + this.valid = true; + this.result = result; + } + + public CertificateVerificationResult(Throwable exception) + { + this.valid = false; + this.exception = exception; + } + + public boolean isValid() + { + return valid; + } + + public PKIXCertPathBuilderResult getResult() + { + return result; + } + + public Throwable getException() + { + return exception; + } +} diff -Nru libpdfbox2-java-2.0.9/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/CertificateVerifier.java libpdfbox2-java-2.0.13/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/CertificateVerifier.java --- libpdfbox2-java-2.0.9/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/CertificateVerifier.java 1970-01-01 00:00:00.000000000 +0000 +++ libpdfbox2-java-2.0.13/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/CertificateVerifier.java 2018-11-28 17:18:40.000000000 +0000 @@ -0,0 +1,401 @@ +/** + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +package org.apache.pdfbox.examples.signature.cert; + +import java.io.IOException; +import java.security.GeneralSecurityException; +import java.security.InvalidKeyException; +import java.security.PublicKey; +import java.security.SignatureException; +import java.security.cert.CertPathBuilder; +import java.security.cert.CertPathBuilderException; +import java.security.cert.CertStore; +import java.security.cert.CertificateException; +import java.security.cert.CollectionCertStoreParameters; +import java.security.cert.PKIXBuilderParameters; +import java.security.cert.PKIXCertPathBuilderResult; +import java.security.cert.TrustAnchor; +import java.security.cert.X509CertSelector; +import java.security.cert.X509Certificate; +import java.util.Calendar; +import java.util.Date; +import java.util.Enumeration; +import java.util.HashSet; +import java.util.Set; +import org.apache.commons.logging.Log; +import org.apache.commons.logging.LogFactory; +import org.apache.pdfbox.pdmodel.encryption.SecurityProvider; +import org.bouncycastle.asn1.ASN1ObjectIdentifier; +import org.bouncycastle.asn1.ASN1Sequence; +import org.bouncycastle.asn1.DEROctetString; +import org.bouncycastle.asn1.DERTaggedObject; +import org.bouncycastle.asn1.ocsp.OCSPObjectIdentifiers; +import org.bouncycastle.asn1.x509.Extension; +import org.bouncycastle.asn1.x509.GeneralName; +import org.bouncycastle.asn1.x509.X509ObjectIdentifiers; +import org.bouncycastle.cert.X509CertificateHolder; +import org.bouncycastle.cert.jcajce.JcaX509CertificateConverter; +import org.bouncycastle.cert.jcajce.JcaX509ExtensionUtils; +import org.bouncycastle.cert.ocsp.BasicOCSPResp; +import org.bouncycastle.cert.ocsp.OCSPException; +import org.bouncycastle.cert.ocsp.OCSPResp; + +/** + * Copied from Apache CXF 2.4.9, initial version: + * https://svn.apache.org/repos/asf/cxf/tags/cxf-2.4.9/distribution/src/main/release/samples/sts_issue_operation/src/main/java/demo/sts/provider/cert/ + * + */ +public final class CertificateVerifier +{ + private static final Log LOG = LogFactory.getLog(CertificateVerifier.class); + + private CertificateVerifier() + { + + } + + /** + * Attempts to build a certification chain for given certificate and to + * verify it. Relies on a set of root CA certificates and intermediate + * certificates that will be used for building the certification chain. The + * verification process assumes that all self-signed certificates in the set + * are trusted root CA certificates and all other certificates in the set + * are intermediate certificates. + * + * @param cert - certificate for validation + * @param additionalCerts - set of trusted root CA certificates that will be + * used as "trust anchors" and intermediate CA certificates that will be + * used as part of the certification chain. All self-signed certificates are + * considered to be trusted root CA certificates. All the rest are + * considered to be intermediate CA certificates. + * @param verifySelfSignedCert true if a self-signed certificate is accepted, false if not. + * @param signDate the date when the signing took place + * @return the certification chain (if verification is successful) + * @throws CertificateVerificationException - if the certification is not + * successful (e.g. certification path cannot be built or some certificate + * in the chain is expired or CRL checks are failed) + */ + public static PKIXCertPathBuilderResult verifyCertificate( + X509Certificate cert, Set additionalCerts, + boolean verifySelfSignedCert, Date signDate) + throws CertificateVerificationException + { + try + { + // Check for self-signed certificate + if (!verifySelfSignedCert && isSelfSigned(cert)) + { + throw new CertificateVerificationException("The certificate is self-signed."); + } + + // Prepare a set of trust anchors (set of root CA certificates) + // and a set of intermediate certificates + Set intermediateCerts = new HashSet(); + Set trustAnchors = new HashSet(); + for (X509Certificate additionalCert : additionalCerts) + { + if (isSelfSigned(additionalCert)) + { + trustAnchors.add(new TrustAnchor(additionalCert, null)); + } + else + { + intermediateCerts.add(additionalCert); + } + } + + if (trustAnchors.isEmpty()) + { + throw new CertificateVerificationException("No root certificate in the chain"); + } + + // Attempt to build the certification chain and verify it + PKIXCertPathBuilderResult verifiedCertChain = verifyCertificate( + cert, trustAnchors, intermediateCerts, signDate); + + LOG.info("Certification chain verified successfully"); + + checkRevocations(cert, additionalCerts, signDate); + + return verifiedCertChain; + } + catch (CertPathBuilderException certPathEx) + { + throw new CertificateVerificationException( + "Error building certification path: " + + cert.getSubjectX500Principal(), certPathEx); + } + catch (CertificateVerificationException cvex) + { + throw cvex; + } + catch (Exception ex) + { + throw new CertificateVerificationException( + "Error verifying the certificate: " + + cert.getSubjectX500Principal(), ex); + } + } + + private static void checkRevocations(X509Certificate cert, + Set additionalCerts, + Date signDate) + throws IOException, CertificateVerificationException, OCSPException, + RevokedCertificateException, GeneralSecurityException + { + if (isSelfSigned(cert)) + { + // root, we're done + return; + } + X509Certificate issuerCert = null; + for (X509Certificate additionalCert : additionalCerts) + { + if (cert.getIssuerX500Principal().equals(additionalCert.getSubjectX500Principal())) + { + issuerCert = additionalCert; + break; + } + } + // issuerCert is never null here. If it hadn't been found, then there wouldn't be a + // verifiedCertChain earlier. + + // Try checking the certificate through OCSP (faster than CRL) + String ocspURL = extractOCSPURL(cert); + if (ocspURL != null) + { + OcspHelper ocspHelper = new OcspHelper(cert, signDate, issuerCert, additionalCerts, ocspURL); + try + { + verifyOCSP(ocspHelper, additionalCerts); + } + catch (IOException ex) + { + // happens with 021496.pdf because OCSP responder no longer exists + LOG.warn("IOException trying OCSP, will try CRL", ex); + CRLVerifier.verifyCertificateCRLs(cert, signDate, additionalCerts); + } + } + else + { + LOG.info("OCSP not available, will try CRL"); + + // Check whether the certificate is revoked by the CRL + // given in its CRL distribution point extension + CRLVerifier.verifyCertificateCRLs(cert, signDate, additionalCerts); + } + + // now check the issuer + checkRevocations(issuerCert, additionalCerts, signDate); + } + + /** + * Checks whether given X.509 certificate is self-signed. + * @param cert The X.509 certificate to check. + * @return true if the certificate is self-signed, false if not. + * @throws java.security.GeneralSecurityException + */ + public static boolean isSelfSigned(X509Certificate cert) throws GeneralSecurityException + { + try + { + // Try to verify certificate signature with its own public key + PublicKey key = cert.getPublicKey(); + cert.verify(key, SecurityProvider.getProvider().getName()); + return true; + } + catch (SignatureException ex) + { + // Invalid signature --> not self-signed + LOG.debug("Couldn't get signature information - returning false", ex); + return false; + } + catch (InvalidKeyException ex) + { + // Invalid signature --> not self-signed + LOG.debug("Couldn't get signature information - returning false", ex); + return false; + } + catch (IOException ex) + { + // Invalid signature --> not self-signed + LOG.debug("Couldn't get signature information - returning false", ex); + return false; + } + } + + /** + * Attempts to build a certification chain for given certificate and to + * verify it. Relies on a set of root CA certificates (trust anchors) and a + * set of intermediate certificates (to be used as part of the chain). + * + * @param cert - certificate for validation + * @param trustAnchors - set of trust anchors + * @param intermediateCerts - set of intermediate certificates + * @param signDate the date when the signing took place + * @return the certification chain (if verification is successful) + * @throws GeneralSecurityException - if the verification is not successful + * (e.g. certification path cannot be built or some certificate in the chain + * is expired) + */ + private static PKIXCertPathBuilderResult verifyCertificate( + X509Certificate cert, Set trustAnchors, + Set intermediateCerts, Date signDate) + throws GeneralSecurityException + { + // Create the selector that specifies the starting certificate + X509CertSelector selector = new X509CertSelector(); + selector.setCertificate(cert); + + // Configure the PKIX certificate builder algorithm parameters + PKIXBuilderParameters pkixParams = new PKIXBuilderParameters(trustAnchors, selector); + + // Disable CRL checks (this is done manually as additional step) + pkixParams.setRevocationEnabled(false); + + // not doing this brings + // "SunCertPathBuilderException: unable to find valid certification path to requested target" + // (when using -Djava.security.debug=certpath: "critical policy qualifiers present in certificate") + // for files like 021496.pdf that have the "Adobe CDS Certificate Policy" 1.2.840.113583.1.2.1 + // CDS = "Certified Document Services" + // https://www.adobe.com/misc/pdfs/Adobe_CDS_CP.pdf + pkixParams.setPolicyQualifiersRejected(false); + // However, maybe there is still work to do: + // "If the policyQualifiersRejected flag is set to false, it is up to the application + // to validate all policy qualifiers in this manner in order to be PKIX compliant." + + pkixParams.setDate(signDate); + + // Specify a list of intermediate certificates + CertStore intermediateCertStore = CertStore.getInstance("Collection", + new CollectionCertStoreParameters(intermediateCerts)); + pkixParams.addCertStore(intermediateCertStore); + + // Build and verify the certification chain + // If this doesn't work although it should, it can be debugged + // by starting java with -Djava.security.debug=certpath + // see also + // https://docs.oracle.com/javase/8/docs/technotes/guides/security/troubleshooting-security.html + CertPathBuilder builder = CertPathBuilder.getInstance("PKIX"); + return (PKIXCertPathBuilderResult) builder.build(pkixParams); + } + + /** + * Extract the OCSP URL from an X.509 certificate if available. + * + * @param cert X.509 certificate + * @return the URL of the OCSP validation service + * @throws IOException + */ + private static String extractOCSPURL(X509Certificate cert) throws IOException + { + byte[] authorityExtensionValue = cert.getExtensionValue(Extension.authorityInfoAccess.getId()); + if (authorityExtensionValue != null) + { + // copied from CertInformationHelper.getAuthorityInfoExtensionValue() + // DRY refactor should be done some day + ASN1Sequence asn1Seq = (ASN1Sequence) JcaX509ExtensionUtils.parseExtensionValue(authorityExtensionValue); + Enumeration objects = asn1Seq.getObjects(); + while (objects.hasMoreElements()) + { + // AccessDescription + ASN1Sequence obj = (ASN1Sequence) objects.nextElement(); + ASN1ObjectIdentifier oid = (ASN1ObjectIdentifier) obj.getObjectAt(0); + // accessLocation + DERTaggedObject location = (DERTaggedObject) obj.getObjectAt(1); + if (oid.equals(X509ObjectIdentifiers.id_ad_ocsp) + && location.getTagNo() == GeneralName.uniformResourceIdentifier) + { + DEROctetString url = (DEROctetString) location.getObject(); + String ocspURL = new String(url.getOctets()); + LOG.info("OCSP URL: " + ocspURL); + return ocspURL; + } + } + } + return null; + } + + /** + * Verify whether the certificate has been revoked at signing date, and verify whether the + * certificate of the responder has been revoked now. + * + * @param ocspHelper the OCSP helper. + * @param additionalCerts + * @throws RevokedCertificateException + * @throws IOException + * @throws OCSPException + * @throws CertificateVerificationException + */ + private static void verifyOCSP(OcspHelper ocspHelper, Set additionalCerts) + throws RevokedCertificateException, IOException, OCSPException, CertificateVerificationException + { + Date now = Calendar.getInstance().getTime(); + OCSPResp ocspResponse; + ocspResponse = ocspHelper.getResponseOcsp(); + if (ocspResponse.getStatus() != OCSPResp.SUCCESSFUL) + { + throw new CertificateVerificationException("OCSP check not successful, status: " + + ocspResponse.getStatus()); + } + LOG.info("OCSP check successful"); + + BasicOCSPResp basicResponse = (BasicOCSPResp) ocspResponse.getResponseObject(); + X509Certificate ocspResponderCertificate = ocspHelper.getOcspResponderCertificate(); + if (ocspResponderCertificate.getExtensionValue(OCSPObjectIdentifiers.id_pkix_ocsp_nocheck.getId()) != null) + { + // https://tools.ietf.org/html/rfc6960#section-4.2.2.2.1 + // A CA may specify that an OCSP client can trust a responder for the + // lifetime of the responder's certificate. The CA does so by + // including the extension id-pkix-ocsp-nocheck. + LOG.info("Revocation check of OCSP responder certificate skipped (id-pkix-ocsp-nocheck is set)"); + return; + } + + LOG.info("Revocation check of OCSP responder certificate"); + Set additionalCerts2 = new HashSet(additionalCerts); + JcaX509CertificateConverter certificateConverter = new JcaX509CertificateConverter(); + for (X509CertificateHolder certHolder : basicResponse.getCerts()) + { + try + { + X509Certificate cert = certificateConverter.getCertificate(certHolder); + if (!ocspResponderCertificate.equals(cert)) + { + additionalCerts2.add(cert); + } + } + catch (CertificateException ex) + { + // unlikely to happen because the certificate existed as an object + LOG.error(ex, ex); + } + } + try + { + checkRevocations(ocspResponderCertificate, additionalCerts2, now); + } + catch (GeneralSecurityException ex) + { + throw new CertificateVerificationException(ex.getMessage(), ex); + } + LOG.info("Revocation check of OCSP responder certificate done"); + } +} diff -Nru libpdfbox2-java-2.0.9/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/CRLVerifier.java libpdfbox2-java-2.0.13/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/CRLVerifier.java --- libpdfbox2-java-2.0.9/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/CRLVerifier.java 1970-01-01 00:00:00.000000000 +0000 +++ libpdfbox2-java-2.0.13/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/CRLVerifier.java 2018-11-28 17:18:40.000000000 +0000 @@ -0,0 +1,317 @@ +/** + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +package org.apache.pdfbox.examples.signature.cert; + +import java.io.ByteArrayInputStream; +import java.io.IOException; +import java.io.InputStream; +import java.net.URL; +import java.security.PublicKey; +import java.security.cert.CRLException; +import java.security.cert.CertificateException; +import java.security.cert.CertificateFactory; +import java.security.cert.X509CRL; +import java.security.cert.X509CRLEntry; +import java.security.cert.X509Certificate; +import java.util.ArrayList; +import java.util.Date; +import java.util.Hashtable; +import java.util.List; +import java.util.Set; + +import javax.naming.Context; +import javax.naming.NamingException; +import javax.naming.directory.Attribute; +import javax.naming.directory.Attributes; +import javax.naming.directory.DirContext; +import javax.naming.directory.InitialDirContext; +import org.apache.commons.logging.Log; +import org.apache.commons.logging.LogFactory; +import org.apache.pdfbox.pdmodel.encryption.SecurityProvider; + +import org.bouncycastle.asn1.ASN1InputStream; +import org.bouncycastle.asn1.ASN1Primitive; +import org.bouncycastle.asn1.DERIA5String; +import org.bouncycastle.asn1.DEROctetString; +import org.bouncycastle.asn1.x509.CRLDistPoint; +import org.bouncycastle.asn1.x509.DistributionPoint; +import org.bouncycastle.asn1.x509.DistributionPointName; +import org.bouncycastle.asn1.x509.Extension; +import org.bouncycastle.asn1.x509.GeneralName; +import org.bouncycastle.asn1.x509.GeneralNames; + +/** + * Copied from Apache CXF 2.4.9, initial version: + * https://svn.apache.org/repos/asf/cxf/tags/cxf-2.4.9/distribution/src/main/release/samples/sts_issue_operation/src/main/java/demo/sts/provider/cert/ + * + */ +public final class CRLVerifier +{ + private static final Log LOG = LogFactory.getLog(CRLVerifier.class); + + private CRLVerifier() + { + } + + /** + * Extracts the CRL distribution points from the certificate (if available) + * and checks the certificate revocation status against the CRLs coming from + * the distribution points. Supports HTTP, HTTPS, FTP and LDAP based URLs. + * + * @param cert the certificate to be checked for revocation + * @param signDate the date when the signing took place + * @param additionalCerts set of trusted root CA certificates that will be + * used as "trust anchors" and intermediate CA certificates that will be + * used as part of the certification chain. + * @throws CertificateVerificationException if the certificate could not be verified + * @throws RevokedCertificateException if the certificate is revoked + */ + public static void verifyCertificateCRLs(X509Certificate cert, Date signDate, + Set additionalCerts) + throws CertificateVerificationException, RevokedCertificateException + { + try + { + Exception firstException = null; + List crlDistributionPointsURLs = getCrlDistributionPoints(cert); + for (String crlDistributionPointsURL : crlDistributionPointsURLs) + { + LOG.info("Checking distribution point URL: " + crlDistributionPointsURL); + X509CRL crl; + try + { + crl = downloadCRL(crlDistributionPointsURL); + } + catch (Exception ex) + { + // e.g. LDAP behind corporate proxy + LOG.warn("Caught " + ex.getClass().getSimpleName() + " downloading CRL, will try next distribution point if available"); + if (firstException == null) + { + firstException = ex; + } + continue; + } + + // Verify CRL, see wikipedia: + // "To validate a specific CRL prior to relying on it, + // the certificate of its corresponding CA is needed" + PublicKey issuerKey = null; + for (X509Certificate additionalCert : additionalCerts) + { + if (crl.getIssuerX500Principal().equals( + additionalCert.getSubjectX500Principal())) + { + issuerKey = additionalCert.getPublicKey(); + } + } + if (issuerKey == null) + { + throw new CertificateVerificationException( + "Certificate for " + crl.getIssuerX500Principal() + + "not found in certificate chain, so the CRL at " + + crlDistributionPointsURL + " could not be verified"); + } + crl.verify(issuerKey, SecurityProvider.getProvider().getName()); + + checkRevocation(crl, cert, signDate, crlDistributionPointsURL); + + // https://tools.ietf.org/html/rfc5280#section-4.2.1.13 + // If the DistributionPointName contains multiple values, + // each name describes a different mechanism to obtain the same + // CRL. For example, the same CRL could be available for + // retrieval through both LDAP and HTTP. + // + // => thus no need to check several protocols + return; + } + if (firstException != null) + { + throw firstException; + } + } + catch (CertificateVerificationException ex) + { + throw ex; + } + catch (RevokedCertificateException ex) + { + throw ex; + } + catch (Exception ex) + { + throw new CertificateVerificationException( + "Cannot verify CRL for certificate: " + + cert.getSubjectX500Principal(), ex); + + } + } + + /** + * Check whether the certificate was revoked at signing time. + * + * @param crl certificate revocation list + * @param cert certificate to be checked + * @param signDate date the certificate was used for signing + * @param crlDistributionPointsURL URL for log message or exception text + * @throws RevokedCertificateException if the certificate was revoked at signing time + */ + public static void checkRevocation( + X509CRL crl, X509Certificate cert, Date signDate, String crlDistributionPointsURL) + throws RevokedCertificateException + { + X509CRLEntry revokedCRLEntry = crl.getRevokedCertificate(cert); + if (revokedCRLEntry != null && + revokedCRLEntry.getRevocationDate().compareTo(signDate) <= 0) + { + throw new RevokedCertificateException( + "The certificate was revoked by CRL " + + crlDistributionPointsURL + " on " + revokedCRLEntry.getRevocationDate(), + revokedCRLEntry.getRevocationDate()); + } + else if (revokedCRLEntry != null) + { + LOG.info("The certificate was revoked after signing by CRL " + + crlDistributionPointsURL + " on " + revokedCRLEntry.getRevocationDate()); + } + else + { + LOG.info("The certificate was not revoked by CRL " + crlDistributionPointsURL); + } + } + + /** + * Downloads CRL from given URL. Supports http, https, ftp and ldap based URLs. + */ + private static X509CRL downloadCRL(String crlURL) throws IOException, + CertificateException, CRLException, + CertificateVerificationException, NamingException + { + if (crlURL.startsWith("http://") || crlURL.startsWith("https://") + || crlURL.startsWith("ftp://")) + { + return downloadCRLFromWeb(crlURL); + } + else if (crlURL.startsWith("ldap://")) + { + return downloadCRLFromLDAP(crlURL); + } + else + { + throw new CertificateVerificationException( + "Can not download CRL from certificate " + + "distribution point: " + crlURL); + } + } + + /** + * Downloads a CRL from given LDAP url, e.g. + * ldap://ldap.infonotary.com/dc=identity-ca,dc=infonotary,dc=com + */ + private static X509CRL downloadCRLFromLDAP(String ldapURL) throws CertificateException, + NamingException, CRLException, + CertificateVerificationException + { + Hashtable env = new Hashtable(); + env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory"); + env.put(Context.PROVIDER_URL, ldapURL); + + // https://docs.oracle.com/javase/jndi/tutorial/ldap/connect/create.html + // don't wait forever behind corporate proxy + env.put("com.sun.jndi.ldap.connect.timeout", "1000"); + + DirContext ctx = new InitialDirContext(env); + Attributes avals = ctx.getAttributes(""); + Attribute aval = avals.get("certificateRevocationList;binary"); + byte[] val = (byte[]) aval.get(); + if (val == null || val.length == 0) + { + throw new CertificateVerificationException("Can not download CRL from: " + ldapURL); + } + else + { + InputStream inStream = new ByteArrayInputStream(val); + CertificateFactory cf = CertificateFactory.getInstance("X.509"); + return (X509CRL) cf.generateCRL(inStream); + } + } + + /** + * Downloads a CRL from given HTTP/HTTPS/FTP URL, e.g. + * http://crl.infonotary.com/crl/identity-ca.crl + */ + public static X509CRL downloadCRLFromWeb(String crlURL) + throws IOException, CertificateException, CRLException + { + InputStream crlStream = new URL(crlURL).openStream(); + try + { + return (X509CRL) CertificateFactory.getInstance("X.509").generateCRL(crlStream); + } + finally + { + crlStream.close(); + } + } + + /** + * Extracts all CRL distribution point URLs from the "CRL Distribution + * Point" extension in a X.509 certificate. If CRL distribution point + * extension is unavailable, returns an empty list. + * @param cert + * @return List of CRL distribution point URLs. + * @throws java.io.IOException + */ + public static List getCrlDistributionPoints(X509Certificate cert) + throws IOException + { + byte[] crldpExt = cert.getExtensionValue(Extension.cRLDistributionPoints.getId()); + if (crldpExt == null) + { + return new ArrayList(); + } + ASN1InputStream oAsnInStream = new ASN1InputStream(new ByteArrayInputStream(crldpExt)); + ASN1Primitive derObjCrlDP = oAsnInStream.readObject(); + DEROctetString dosCrlDP = (DEROctetString) derObjCrlDP; + byte[] crldpExtOctets = dosCrlDP.getOctets(); + ASN1InputStream oAsnInStream2 = new ASN1InputStream(new ByteArrayInputStream(crldpExtOctets)); + ASN1Primitive derObj2 = oAsnInStream2.readObject(); + CRLDistPoint distPoint = CRLDistPoint.getInstance(derObj2); + List crlUrls = new ArrayList(); + for (DistributionPoint dp : distPoint.getDistributionPoints()) + { + DistributionPointName dpn = dp.getDistributionPoint(); + // Look for URIs in fullName + if (dpn != null && dpn.getType() == DistributionPointName.FULL_NAME) + { + // Look for an URI + for (GeneralName genName : GeneralNames.getInstance(dpn.getName()).getNames()) + { + if (genName.getTagNo() == GeneralName.uniformResourceIdentifier) + { + String url = DERIA5String.getInstance(genName.getName()).getString(); + crlUrls.add(url); + } + } + } + } + return crlUrls; + } +} diff -Nru libpdfbox2-java-2.0.9/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/OcspHelper.java libpdfbox2-java-2.0.13/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/OcspHelper.java --- libpdfbox2-java-2.0.9/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/OcspHelper.java 1970-01-01 00:00:00.000000000 +0000 +++ libpdfbox2-java-2.0.13/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/OcspHelper.java 2018-11-28 17:18:40.000000000 +0000 @@ -0,0 +1,552 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. + * The ASF licenses this file to You under the Apache License, Version 2.0 + * (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.apache.pdfbox.examples.signature.cert; + +import java.io.ByteArrayOutputStream; +import java.io.IOException; +import java.io.InputStream; +import java.io.OutputStream; +import java.net.HttpURLConnection; +import java.net.URL; +import java.security.MessageDigest; +import java.security.NoSuchAlgorithmException; +import java.security.Security; +import java.security.cert.CertificateEncodingException; +import java.security.cert.CertificateException; +import java.security.cert.CertificateParsingException; +import java.security.cert.X509Certificate; +import java.util.Calendar; +import java.util.Date; +import java.util.Random; +import java.util.Set; + +import org.apache.commons.logging.Log; +import org.apache.commons.logging.LogFactory; +import org.apache.pdfbox.examples.signature.SigUtils; +import org.apache.pdfbox.io.IOUtils; +import org.apache.pdfbox.pdmodel.encryption.SecurityProvider; +import org.bouncycastle.asn1.DEROctetString; +import org.bouncycastle.asn1.DLSequence; +import org.bouncycastle.asn1.ocsp.OCSPObjectIdentifiers; +import org.bouncycastle.asn1.ocsp.OCSPResponseStatus; +import org.bouncycastle.asn1.ocsp.ResponderID; +import org.bouncycastle.asn1.oiw.OIWObjectIdentifiers; +import org.bouncycastle.asn1.x500.X500Name; +import org.bouncycastle.asn1.x509.AlgorithmIdentifier; +import org.bouncycastle.asn1.x509.Extension; +import org.bouncycastle.asn1.x509.Extensions; +import org.bouncycastle.cert.X509CertificateHolder; +import org.bouncycastle.cert.jcajce.JcaX509CertificateConverter; +import org.bouncycastle.cert.jcajce.JcaX509CertificateHolder; +import org.bouncycastle.cert.ocsp.BasicOCSPResp; +import org.bouncycastle.cert.ocsp.CertificateID; +import org.bouncycastle.cert.ocsp.CertificateStatus; +import org.bouncycastle.cert.ocsp.OCSPException; +import org.bouncycastle.cert.ocsp.OCSPReq; +import org.bouncycastle.cert.ocsp.OCSPReqBuilder; +import org.bouncycastle.cert.ocsp.OCSPResp; +import org.bouncycastle.cert.ocsp.RevokedStatus; +import org.bouncycastle.cert.ocsp.SingleResp; +import org.bouncycastle.operator.ContentVerifierProvider; +import org.bouncycastle.operator.DigestCalculator; +import org.bouncycastle.operator.OperatorCreationException; +import org.bouncycastle.operator.jcajce.JcaContentVerifierProviderBuilder; + +/** + * Helper Class for OCSP-Operations with bouncy castle. + * + * @author Alexis Suter + */ +public class OcspHelper +{ + private static final Log LOG = LogFactory.getLog(OcspHelper.class); + + private final X509Certificate issuerCertificate; + private final Date signDate; + private final X509Certificate certificateToCheck; + private final Set additionalCerts; + private final String ocspUrl; + private DEROctetString encodedNonce; + private X509Certificate ocspResponderCertificate; + private final JcaX509CertificateConverter certificateConverter = new JcaX509CertificateConverter(); + + /** + * @param checkCertificate Certificate to be OCSP-checked + * @param signDate the date when the signing took place + * @param issuerCertificate Certificate of the issuer + * @param additionalCerts Set of trusted root CA certificates that will be used as "trust + * anchors" and intermediate CA certificates that will be used as part of the certification + * chain. All self-signed certificates are considered to be trusted root CA certificates. All + * the rest are considered to be intermediate CA certificates. + * @param ocspUrl where to fetch for OCSP + */ + public OcspHelper(X509Certificate checkCertificate, Date signDate, X509Certificate issuerCertificate, + Set additionalCerts, String ocspUrl) + { + this.certificateToCheck = checkCertificate; + this.signDate = signDate; + this.issuerCertificate = issuerCertificate; + this.additionalCerts = additionalCerts; + this.ocspUrl = ocspUrl; + } + + /** + * Performs and verifies the OCSP-Request + * + * @return the OCSPResp, when the request was successful, else a corresponding exception will be + * thrown. Never returns null. + * + * @throws IOException + * @throws OCSPException + * @throws RevokedCertificateException + */ + public OCSPResp getResponseOcsp() throws IOException, OCSPException, RevokedCertificateException + { + OCSPResp ocspResponse = performRequest(); + verifyOcspResponse(ocspResponse); + return ocspResponse; + } + + /** + * Get responder certificate. This is available after {@link #getResponseOcsp()} has been called. + * + * @return The certificate of the responder. + */ + public X509Certificate getOcspResponderCertificate() + { + return ocspResponderCertificate; + } + + /** + * Verifies the status and the response itself (including nonce), but not the signature. + * + * @param ocspResponse to be verified + * @throws OCSPException + * @throws RevokedCertificateException + * @throws IOException if the default security provider can't be instantiated + */ + private void verifyOcspResponse(OCSPResp ocspResponse) + throws OCSPException, RevokedCertificateException, IOException + { + verifyRespStatus(ocspResponse); + + BasicOCSPResp basicResponse = (BasicOCSPResp) ocspResponse.getResponseObject(); + if (basicResponse != null) + { + ResponderID responderID = basicResponse.getResponderId().toASN1Primitive(); + // https://tools.ietf.org/html/rfc6960#section-4.2.2.3 + // The basic response type contains: + // (...) + // either the name of the responder or a hash of the responder's + // public key as the ResponderID + // (...) + // The responder MAY include certificates in the certs field of + // BasicOCSPResponse that help the OCSP client verify the responder's + // signature. + X500Name name = responderID.getName(); + if (name != null) + { + findResponderCertificateByName(basicResponse, name); + } + else + { + byte[] keyHash = responderID.getKeyHash(); + //TODO + // KeyHash ::= OCTET STRING -- SHA-1 hash of responder's public key + // -- (i.e., the SHA-1 hash of the value of the + // -- BIT STRING subjectPublicKey [excluding + // -- the tag, length, and number of unused + // -- bits] in the responder's certificate) + throw new UnsupportedOperationException("search by key hash is not implemented yet"); + + // how BC calculates the HeyHash: + // see CertificateID.createCertID() + // digCalc is a SHA1DigestCalculator + // SubjectPublicKeyInfo info = issuerCert.getSubjectPublicKeyInfo(); + // dgOut = digCalc.getOutputStream(); + // dgOut.write(info.getPublicKeyData().getBytes()); + // dgOut.close(); + // ASN1OctetString issuerKeyHash = new DEROctetString(digCalc.getDigest()); + } + + if (ocspResponderCertificate == null) + { + throw new OCSPException("OCSP: certificate for responder " + name + " not found"); + } + + try + { + SigUtils.checkResponderCertificateUsage(ocspResponderCertificate); + } + catch (CertificateParsingException ex) + { + // unlikely to happen because the certificate existed as an object + LOG.error(ex, ex); + } + checkOcspSignature(ocspResponderCertificate, basicResponse); + + boolean nonceChecked = checkNonce(basicResponse); + + SingleResp[] responses = basicResponse.getResponses(); + if (responses.length == 1) + { + SingleResp resp = responses[0]; + Object status = resp.getCertStatus(); + + if (!nonceChecked) + { + // https://tools.ietf.org/html/rfc5019 + // fall back to validating the OCSPResponse based on time + checkOcspResponseFresh(resp); + } + + if (status instanceof RevokedStatus) + { + RevokedStatus revokedStatus = (RevokedStatus) status; + if (revokedStatus.getRevocationTime().compareTo(signDate) <= 0) + { + throw new RevokedCertificateException( + "OCSP: Certificate is revoked since " + + revokedStatus.getRevocationTime(), + revokedStatus.getRevocationTime()); + } + LOG.info("The certificate was revoked after signing by OCSP " + ocspUrl + + " on " + revokedStatus.getRevocationTime()); + } + else if (status != CertificateStatus.GOOD) + { + throw new OCSPException("OCSP: Status of Cert is unknown"); + } + } + else + { + throw new OCSPException( + "OCSP: Received " + responses.length + " responses instead of 1!"); + } + } + } + + private void findResponderCertificateByName(BasicOCSPResp basicResponse, X500Name name) + { + X509CertificateHolder[] certHolders = basicResponse.getCerts(); + for (X509CertificateHolder certHolder : certHolders) + { + if (name.equals(certHolder.getSubject())) + { + try + { + ocspResponderCertificate = certificateConverter.getCertificate(certHolder); + } + catch (CertificateException ex) + { + // unlikely to happen because the certificate existed as an object + LOG.error(ex, ex); + } + break; + } + } + if (ocspResponderCertificate == null) + { + // DO NOT use the certificate found in additionalCerts first. One file had a + // responder certificate in the PDF itself with SHA1withRSA algorithm, but + // the responder delivered a different (newer, more secure) certificate + // with SHA256withRSA (tried with QV_RCA1_RCA3_CPCPS_V4_11.pdf) + // https://www.quovadisglobal.com/~/media/Files/Repository/QV_RCA1_RCA3_CPCPS_V4_11.ashx + for (X509Certificate cert : additionalCerts) + { + X500Name certSubjectName = new X500Name(cert.getSubjectX500Principal().getName()); + if (certSubjectName.equals(name)) + { + ocspResponderCertificate = cert; + break; + } + } + } + } + + private void checkOcspResponseFresh(SingleResp resp) throws OCSPException + { + // https://tools.ietf.org/html/rfc5019 + // Clients MUST check for the existence of the nextUpdate field and MUST + // ensure the current time, expressed in GMT time as described in + // Section 2.2.4, falls between the thisUpdate and nextUpdate times. If + // the nextUpdate field is absent, the client MUST reject the response. + + Date curDate = Calendar.getInstance().getTime(); + + Date thisUpdate = resp.getThisUpdate(); + if (thisUpdate == null) + { + throw new OCSPException("OCSP: thisUpdate field is missing in response (RFC 5019 2.2.4.)"); + } + Date nextUpdate = resp.getNextUpdate(); + if (nextUpdate == null) + { + throw new OCSPException("OCSP: nextUpdate field is missing in response (RFC 5019 2.2.4.)"); + } + if (curDate.compareTo(thisUpdate) < 0) + { + LOG.error(curDate + " < " + thisUpdate); + throw new OCSPException("OCSP: current date < thisUpdate field (RFC 5019 2.2.4.)"); + } + if (curDate.compareTo(nextUpdate) > 0) + { + LOG.error(curDate + " > " + nextUpdate); + throw new OCSPException("OCSP: current date > nextUpdate field (RFC 5019 2.2.4.)"); + } + LOG.info("OCSP response is fresh"); + } + + /** + * Checks whether the OCSP response is signed by the given certificate. + * + * @param certificate the certificate to check the signature + * @param basicResponse OCSP response containing the signature + * @throws OCSPException when the signature is invalid or could not be checked + * @throws IOException if the default security provider can't be instantiated + */ + private void checkOcspSignature(X509Certificate certificate, BasicOCSPResp basicResponse) + throws OCSPException, IOException + { + try + { + ContentVerifierProvider verifier = new JcaContentVerifierProviderBuilder() + .setProvider(SecurityProvider.getProvider()).build(certificate); + + if (!basicResponse.isSignatureValid(verifier)) + { + throw new OCSPException("OCSP-Signature is not valid!"); + } + } + catch (OperatorCreationException e) + { + throw new OCSPException("Error checking Ocsp-Signature", e); + } + } + + /** + * Checks if the nonce in the response matches. + * + * @param basicResponse Response to be checked + * @return true if the nonce is present and matches, false if nonce is missing. + * @throws OCSPException if the nonce is different + */ + private boolean checkNonce(BasicOCSPResp basicResponse) throws OCSPException + { + Extension nonceExt = basicResponse.getExtension(OCSPObjectIdentifiers.id_pkix_ocsp_nonce); + if (nonceExt != null) + { + DEROctetString responseNonceString = (DEROctetString) nonceExt.getExtnValue(); + if (!responseNonceString.equals(encodedNonce)) + { + throw new OCSPException("Different nonce found in response!"); + } + else + { + LOG.info("Nonce is good"); + return true; + } + } + // https://tools.ietf.org/html/rfc5019 + // Clients that opt to include a nonce in the + // request SHOULD NOT reject a corresponding OCSPResponse solely on the + // basis of the nonexistent expected nonce, but MUST fall back to + // validating the OCSPResponse based on time. + return false; + } + + /** + * Performs the OCSP-Request, with given data. + * + * @return the OCSPResp, that has been fetched from the ocspUrl + * @throws IOException + * @throws OCSPException + */ + private OCSPResp performRequest() throws IOException, OCSPException + { + OCSPReq request = generateOCSPRequest(); + URL url = new URL(ocspUrl); + HttpURLConnection httpConnection = (HttpURLConnection) url.openConnection(); + try + { + httpConnection.setRequestProperty("Content-Type", "application/ocsp-request"); + httpConnection.setRequestProperty("Accept", "application/ocsp-response"); + httpConnection.setDoOutput(true); + OutputStream out = httpConnection.getOutputStream(); + try + { + out.write(request.getEncoded()); + } + finally + { + IOUtils.closeQuietly(out); + } + + if (httpConnection.getResponseCode() != 200) + { + throw new IOException("OCSP: Could not access url, ResponseCode: " + + httpConnection.getResponseCode()); + } + // Get response + InputStream in = (InputStream) httpConnection.getContent(); + try + { + return new OCSPResp(in); + } + finally + { + IOUtils.closeQuietly(in); + } + } + finally + { + httpConnection.disconnect(); + } + } + + /** + * Helper method to verify response status. + * + * @param resp OCSP response + * @throws OCSPException if the response status is not ok + */ + public void verifyRespStatus(OCSPResp resp) throws OCSPException + { + String statusInfo = ""; + if (resp != null) + { + int status = resp.getStatus(); + switch (status) + { + case OCSPResponseStatus.INTERNAL_ERROR: + statusInfo = "INTERNAL_ERROR"; + LOG.error("An internal error occurred in the OCSP Server!"); + break; + case OCSPResponseStatus.MALFORMED_REQUEST: + // This happened when the "critical" flag was used for extensions + // on a responder known by the committer of this comment. + statusInfo = "MALFORMED_REQUEST"; + LOG.error("Your request did not fit the RFC 2560 syntax!"); + break; + case OCSPResponseStatus.SIG_REQUIRED: + statusInfo = "SIG_REQUIRED"; + LOG.error("Your request was not signed!"); + break; + case OCSPResponseStatus.TRY_LATER: + statusInfo = "TRY_LATER"; + LOG.error("The server was too busy to answer you!"); + break; + case OCSPResponseStatus.UNAUTHORIZED: + statusInfo = "UNAUTHORIZED"; + LOG.error("The server could not authenticate you!"); + break; + case OCSPResponseStatus.SUCCESSFUL: + break; + default: + statusInfo = "UNKNOWN"; + LOG.error("Unknown OCSPResponse status code! " + status); + } + } + if (resp == null || resp.getStatus() != OCSPResponseStatus.SUCCESSFUL) + { + throw new OCSPException("OCSP response unsuccessful, status: " + statusInfo); + } + } + + /** + * Generates an OCSP request and generates the CertificateID. + * + * @return OCSP request, ready to fetch data + * @throws OCSPException + * @throws IOException + */ + private OCSPReq generateOCSPRequest() throws OCSPException, IOException + { + Security.addProvider(SecurityProvider.getProvider()); + + // Generate the ID for the certificate we are looking for + CertificateID certId; + try + { + certId = new CertificateID(new SHA1DigestCalculator(), + new JcaX509CertificateHolder(issuerCertificate), + certificateToCheck.getSerialNumber()); + } + catch (CertificateEncodingException e) + { + throw new IOException("Error creating CertificateID with the Certificate encoding", e); + } + + // https://tools.ietf.org/html/rfc2560#section-4.1.2 + // Support for any specific extension is OPTIONAL. The critical flag + // SHOULD NOT be set for any of them. + + Extension responseExtension = new Extension(OCSPObjectIdentifiers.id_pkix_ocsp_response, + false, new DLSequence(OCSPObjectIdentifiers.id_pkix_ocsp_basic).getEncoded()); + + Random rand = new Random(); + byte[] nonce = new byte[16]; + rand.nextBytes(nonce); + encodedNonce = new DEROctetString(new DEROctetString(nonce)); + Extension nonceExtension = new Extension(OCSPObjectIdentifiers.id_pkix_ocsp_nonce, false, + encodedNonce); + + OCSPReqBuilder builder = new OCSPReqBuilder(); + builder.setRequestExtensions( + new Extensions(new Extension[] { responseExtension, nonceExtension })); + builder.addRequest(certId); + return builder.build(); + } + + /** + * Class to create SHA-1 Digest, used for creation of CertificateID. + */ + private static class SHA1DigestCalculator implements DigestCalculator + { + private final ByteArrayOutputStream bOut = new ByteArrayOutputStream(); + + @Override + public AlgorithmIdentifier getAlgorithmIdentifier() + { + return new AlgorithmIdentifier(OIWObjectIdentifiers.idSHA1); + } + + @Override + public OutputStream getOutputStream() + { + return bOut; + } + + @Override + public byte[] getDigest() + { + byte[] bytes = bOut.toByteArray(); + bOut.reset(); + + try + { + MessageDigest md = MessageDigest.getInstance("SHA-1"); + return md.digest(bytes); + } + catch (NoSuchAlgorithmException e) + { + LOG.error("SHA-1 Algorithm not found", e); + return null; + } + } + } +} diff -Nru libpdfbox2-java-2.0.9/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/RevokedCertificateException.java libpdfbox2-java-2.0.13/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/RevokedCertificateException.java --- libpdfbox2-java-2.0.9/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/RevokedCertificateException.java 1970-01-01 00:00:00.000000000 +0000 +++ libpdfbox2-java-2.0.13/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/RevokedCertificateException.java 2018-11-28 17:18:40.000000000 +0000 @@ -0,0 +1,48 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. + * The ASF licenses this file to You under the Apache License, Version 2.0 + * (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.apache.pdfbox.examples.signature.cert; + +import java.util.Date; + +/** + * Exception to handle a revoked Certificate explicitly + * + * @author Alexis Suter + */ +public class RevokedCertificateException extends Exception +{ + private static final long serialVersionUID = 3543946618794126654L; + + private final Date revocationTime; + + public RevokedCertificateException(String message) + { + super(message); + this.revocationTime = null; + } + + public RevokedCertificateException(String message, Date revocationTime) + { + super(message); + this.revocationTime = revocationTime; + } + + public Date getRevocationTime() + { + return revocationTime; + } +} diff -Nru libpdfbox2-java-2.0.9/examples/src/main/java/org/apache/pdfbox/examples/signature/CreateSignatureBase.java libpdfbox2-java-2.0.13/examples/src/main/java/org/apache/pdfbox/examples/signature/CreateSignatureBase.java --- libpdfbox2-java-2.0.9/examples/src/main/java/org/apache/pdfbox/examples/signature/CreateSignatureBase.java 2018-03-20 16:19:44.000000000 +0000 +++ libpdfbox2-java-2.0.13/examples/src/main/java/org/apache/pdfbox/examples/signature/CreateSignatureBase.java 2018-11-28 17:18:40.000000000 +0000 @@ -27,12 +27,9 @@ import java.security.cert.Certificate; import java.security.cert.CertificateException; import java.security.cert.X509Certificate; -import java.util.ArrayList; import java.util.Arrays; import java.util.Enumeration; -import java.util.List; import org.apache.pdfbox.pdmodel.interactive.digitalsignature.SignatureInterface; -import org.bouncycastle.cert.X509CertificateHolder; import org.bouncycastle.cert.jcajce.JcaCertStore; import org.bouncycastle.cms.CMSException; import org.bouncycastle.cms.CMSSignedData; @@ -42,7 +39,6 @@ import org.bouncycastle.operator.OperatorCreationException; import org.bouncycastle.operator.jcajce.JcaContentSignerBuilder; import org.bouncycastle.operator.jcajce.JcaDigestCalculatorProviderBuilder; -import org.bouncycastle.util.Store; public abstract class CreateSignatureBase implements SignatureInterface { @@ -87,6 +83,8 @@ { // avoid expired certificate ((X509Certificate) cert).checkValidity(); + + SigUtils.checkCertificateUsage((X509Certificate) cert); } break; } @@ -130,14 +128,11 @@ // cannot be done private (interface) try { - List certList = new ArrayList(); - certList.addAll(Arrays.asList(certificateChain)); - Store certs = new JcaCertStore(certList); CMSSignedDataGenerator gen = new CMSSignedDataGenerator(); - org.bouncycastle.asn1.x509.Certificate cert = org.bouncycastle.asn1.x509.Certificate.getInstance(certificateChain[0].getEncoded()); + X509Certificate cert = (X509Certificate) certificateChain[0]; ContentSigner sha1Signer = new JcaContentSignerBuilder("SHA256WithRSA").build(privateKey); - gen.addSignerInfoGenerator(new JcaSignerInfoGeneratorBuilder(new JcaDigestCalculatorProviderBuilder().build()).build(sha1Signer, new X509CertificateHolder(cert))); - gen.addCertificates(certs); + gen.addSignerInfoGenerator(new JcaSignerInfoGeneratorBuilder(new JcaDigestCalculatorProviderBuilder().build()).build(sha1Signer, cert)); + gen.addCertificates(new JcaCertStore(Arrays.asList(certificateChain))); CMSProcessableInputStream msg = new CMSProcessableInputStream(content); CMSSignedData signedData = gen.generate(msg, false); if (tsaUrl != null && tsaUrl.length() > 0) diff -Nru libpdfbox2-java-2.0.9/examples/src/main/java/org/apache/pdfbox/examples/signature/CreateVisibleSignature2.java libpdfbox2-java-2.0.13/examples/src/main/java/org/apache/pdfbox/examples/signature/CreateVisibleSignature2.java --- libpdfbox2-java-2.0.9/examples/src/main/java/org/apache/pdfbox/examples/signature/CreateVisibleSignature2.java 2018-03-20 16:19:44.000000000 +0000 +++ libpdfbox2-java-2.0.13/examples/src/main/java/org/apache/pdfbox/examples/signature/CreateVisibleSignature2.java 2018-11-28 17:18:40.000000000 +0000 @@ -259,7 +259,7 @@ // PDDocument object anymore, with classic java file random access methods. // If you can't remember the offset value from ByteRange because your context has changed, // then open the file with PDFBox, find the field with findExistingSignature() or - // PODDocument.getLastSignatureDictionary() and get the ByteRange from there. + // PDDocument.getLastSignatureDictionary() and get the ByteRange from there. // Close the file and then write the signature as explained earlier in this comment. if (isLateExternalSigning()) { diff -Nru libpdfbox2-java-2.0.9/examples/src/main/java/org/apache/pdfbox/examples/signature/CreateVisibleSignature.java libpdfbox2-java-2.0.13/examples/src/main/java/org/apache/pdfbox/examples/signature/CreateVisibleSignature.java --- libpdfbox2-java-2.0.9/examples/src/main/java/org/apache/pdfbox/examples/signature/CreateVisibleSignature.java 2018-03-20 16:19:44.000000000 +0000 +++ libpdfbox2-java-2.0.13/examples/src/main/java/org/apache/pdfbox/examples/signature/CreateVisibleSignature.java 2018-11-28 17:18:40.000000000 +0000 @@ -291,7 +291,7 @@ // PDDocument object anymore, with classic java file random access methods. // If you can't remember the offset value from ByteRange because your context has changed, // then open the file with PDFBox, find the field with findExistingSignature() or - // PODDocument.getLastSignatureDictionary() and get the ByteRange from there. + // PDDocument.getLastSignatureDictionary() and get the ByteRange from there. // Close the file and then write the signature as explained earlier in this comment. if (isLateExternalSigning()) { diff -Nru libpdfbox2-java-2.0.9/examples/src/main/java/org/apache/pdfbox/examples/signature/ShowSignature.java libpdfbox2-java-2.0.13/examples/src/main/java/org/apache/pdfbox/examples/signature/ShowSignature.java --- libpdfbox2-java-2.0.9/examples/src/main/java/org/apache/pdfbox/examples/signature/ShowSignature.java 2018-03-20 16:19:44.000000000 +0000 +++ libpdfbox2-java-2.0.13/examples/src/main/java/org/apache/pdfbox/examples/signature/ShowSignature.java 2018-11-28 17:18:40.000000000 +0000 @@ -20,55 +20,71 @@ import java.io.File; import java.io.FileInputStream; import java.io.IOException; -import java.security.InvalidKeyException; +import java.security.GeneralSecurityException; import java.security.MessageDigest; import java.security.NoSuchAlgorithmException; -import java.security.NoSuchProviderException; -import java.security.PublicKey; -import java.security.SignatureException; +import java.security.Security; import java.security.cert.Certificate; import java.security.cert.CertificateException; +import java.security.cert.CertificateExpiredException; import java.security.cert.CertificateFactory; +import java.security.cert.CertificateNotYetValidException; import java.security.cert.X509Certificate; import java.text.SimpleDateFormat; +import java.util.Arrays; import java.util.Collection; +import java.util.Date; +import java.util.HashSet; +import java.util.Set; import org.apache.pdfbox.cos.COSArray; import org.apache.pdfbox.cos.COSBase; - import org.apache.pdfbox.cos.COSDictionary; import org.apache.pdfbox.cos.COSInputStream; import org.apache.pdfbox.cos.COSName; import org.apache.pdfbox.cos.COSObject; import org.apache.pdfbox.cos.COSStream; import org.apache.pdfbox.cos.COSString; +import org.apache.pdfbox.examples.signature.cert.CertificateVerificationException; +import org.apache.pdfbox.examples.signature.cert.CertificateVerifier; import org.apache.pdfbox.io.IOUtils; import org.apache.pdfbox.pdmodel.PDDocument; import org.apache.pdfbox.pdmodel.PDDocumentCatalog; +import org.apache.pdfbox.pdmodel.encryption.SecurityProvider; import org.apache.pdfbox.pdmodel.interactive.digitalsignature.PDSignature; import org.apache.pdfbox.util.Hex; +import org.bouncycastle.asn1.ASN1Object; +import org.bouncycastle.asn1.cms.Attribute; +import org.bouncycastle.asn1.cms.AttributeTable; +import org.bouncycastle.asn1.cms.CMSAttributes; +import org.bouncycastle.asn1.pkcs.PKCSObjectIdentifiers; +import org.bouncycastle.asn1.x509.Time; import org.bouncycastle.cert.X509CertificateHolder; +import org.bouncycastle.cert.jcajce.JcaCertStore; import org.bouncycastle.cert.jcajce.JcaX509CertificateConverter; import org.bouncycastle.cms.CMSException; import org.bouncycastle.cms.CMSProcessable; import org.bouncycastle.cms.CMSProcessableByteArray; import org.bouncycastle.cms.CMSSignedData; import org.bouncycastle.cms.SignerInformation; +import org.bouncycastle.cms.SignerInformationVerifier; import org.bouncycastle.cms.jcajce.JcaSimpleSignerInfoVerifierBuilder; import org.bouncycastle.operator.OperatorCreationException; import org.bouncycastle.tsp.TSPException; import org.bouncycastle.tsp.TimeStampToken; +import org.bouncycastle.util.Selector; import org.bouncycastle.util.Store; -import org.bouncycastle.util.StoreException; /** - * This will read a document from the filesystem, decrypt it and do something with the signature. + * This will get the signature(s) from the document, do some verifications and + * show the signature(s) and the certificates. This is a complex topic - the + * code here is an example and not a production-ready solution. * * @author Ben Litchfield */ public final class ShowSignature { private final SimpleDateFormat sdf = new SimpleDateFormat("dd.MM.yyyy HH:mm:ss"); - + private ShowSignature() { } @@ -79,24 +95,22 @@ * @param args The command-line arguments. * * @throws IOException If there is an error reading the file. - * @throws CertificateException - * @throws java.security.NoSuchAlgorithmException - * @throws java.security.NoSuchProviderException * @throws org.bouncycastle.tsp.TSPException + * @throws java.security.GeneralSecurityException + * @throws org.apache.pdfbox.examples.signature.cert.CertificateVerificationException */ - public static void main(String[] args) throws IOException, CertificateException, - NoSuchAlgorithmException, - NoSuchProviderException, - TSPException + public static void main(String[] args) throws IOException, TSPException, GeneralSecurityException, + CertificateVerificationException { + // register BouncyCastle provider, needed for "exotic" algorithms + Security.addProvider(SecurityProvider.getProvider()); + ShowSignature show = new ShowSignature(); show.showSignature( args ); } - private void showSignature(String[] args) throws IOException, CertificateException, - NoSuchAlgorithmException, - NoSuchProviderException, - TSPException + private void showSignature(String[] args) throws IOException, TSPException, GeneralSecurityException, + CertificateVerificationException { if( args.length != 2 ) { @@ -168,8 +182,6 @@ subFilter.equals("ETSI.CAdES.detached")) { verifyPKCS7(buf, contents, sig); - - //TODO check certificate chain, revocation lists, timestamp... } else if (subFilter.equals("adbe.pkcs7.sha1")) { @@ -182,13 +194,12 @@ byte[] hash = MessageDigest.getInstance("SHA1").digest(buf); verifyPKCS7(hash, contents, sig); - - //TODO check certificate chain, revocation lists, timestamp... } else if (subFilter.equals("adbe.x509.rsa_sha1")) { // example: PDFBOX-2693.pdf COSString certString = (COSString) sigDict.getDictionaryObject(COSName.CERT); + //TODO this could also be an array. if (certString == null) { System.err.println("The /Cert certificate string is missing in the signature dictionary"); @@ -199,21 +210,52 @@ ByteArrayInputStream certStream = new ByteArrayInputStream(certData); Collection certs = factory.generateCertificates(certStream); System.out.println("certs=" + certs); - - //TODO verify signature + + X509Certificate cert = (X509Certificate) certs.iterator().next(); + + // to verify signature, see code at + // https://stackoverflow.com/questions/43383859/ + + try + { + if (sig.getSignDate() != null) + { + cert.checkValidity(sig.getSignDate().getTime()); + System.out.println("Certificate valid at signing time"); + } + else + { + System.err.println("Certificate cannot be verified without signing time"); + } + } + catch (CertificateExpiredException ex) + { + System.err.println("Certificate expired at signing time"); + } + catch (CertificateNotYetValidException ex) + { + System.err.println("Certificate not yet valid at signing time"); + } + if (CertificateVerifier.isSelfSigned(cert)) + { + System.err.println("Certificate is self-signed, LOL!"); + } + else + { + System.out.println("Certificate is not self-signed"); + + if (sig.getSignDate() != null) + { + verifyCertificateChain(new JcaCertStore(certs), + cert, + sig.getSignDate().getTime()); + } + } } else if (subFilter.equals("ETSI.RFC3161")) { - TimeStampToken timeStampToken = new TimeStampToken(new CMSSignedData(contents.getBytes())); - System.out.println("Time stamp gen time: " + timeStampToken.getTimeStampInfo().getGenTime()); - System.out.println("Time stamp tsa name: " + timeStampToken.getTimeStampInfo().getTsa().getName()); - - CertificateFactory factory = CertificateFactory.getInstance("X.509"); - ByteArrayInputStream certStream = new ByteArrayInputStream(contents.getBytes()); - Collection certs = factory.generateCertificates(certStream); - System.out.println("certs=" + certs); - - //TODO verify signature + // e.g. PDFBOX-1848, file_timestamped.pdf + verifyETSIdotRFC3161(buf, contents); } else { @@ -246,46 +288,140 @@ } } + private void verifyETSIdotRFC3161(byte[] buf, COSString contents) + throws CertificateException, CMSException, IOException, OperatorCreationException, + TSPException, NoSuchAlgorithmException, CertificateVerificationException + { + TimeStampToken timeStampToken = new TimeStampToken(new CMSSignedData(contents.getBytes())); + System.out.println("Time stamp gen time: " + timeStampToken.getTimeStampInfo().getGenTime()); + System.out.println("Time stamp tsa name: " + timeStampToken.getTimeStampInfo().getTsa().getName()); + + CertificateFactory factory = CertificateFactory.getInstance("X.509"); + ByteArrayInputStream certStream = new ByteArrayInputStream(contents.getBytes()); + Collection certs = factory.generateCertificates(certStream); + System.out.println("certs=" + certs); + + String hashAlgorithm = timeStampToken.getTimeStampInfo().getMessageImprintAlgOID().getId(); + // compare the hash of the signed content with the hash in + // the timestamp + if (Arrays.equals(MessageDigest.getInstance(hashAlgorithm).digest(buf), + timeStampToken.getTimeStampInfo().getMessageImprintDigest())) + { + System.out.println("ETSI.RFC3161 timestamp signature verified"); + } + else + { + System.err.println("ETSI.RFC3161 timestamp signature verification failed"); + } + + X509Certificate certFromTimeStamp = (X509Certificate) certs.iterator().next(); + SigUtils.checkTimeStampCertificateUsage(certFromTimeStamp); + validateTimestampToken(timeStampToken); + verifyCertificateChain(timeStampToken.getCertificates(), + certFromTimeStamp, + timeStampToken.getTimeStampInfo().getGenTime()); + } + /** * Verify a PKCS7 signature. * * @param byteArray the byte sequence that has been signed * @param contents the /Contents field as a COSString * @param sig the PDF signature (the /V dictionary) - * @throws CertificateException * @throws CMSException - * @throws StoreException * @throws OperatorCreationException + * @throws IOException + * @throws GeneralSecurityException + * @throws TSPException */ private void verifyPKCS7(byte[] byteArray, COSString contents, PDSignature sig) - throws CMSException, CertificateException, StoreException, OperatorCreationException, - NoSuchAlgorithmException, NoSuchProviderException + throws CMSException, OperatorCreationException, + IOException, GeneralSecurityException, TSPException, CertificateVerificationException { // inspiration: // http://stackoverflow.com/a/26702631/535646 // http://stackoverflow.com/a/9261365/535646 CMSProcessable signedContent = new CMSProcessableByteArray(byteArray); CMSSignedData signedData = new CMSSignedData(signedContent, contents.getBytes()); + @SuppressWarnings("unchecked") Store certificatesStore = signedData.getCertificates(); Collection signers = signedData.getSignerInfos().getSigners(); SignerInformation signerInformation = signers.iterator().next(); - Collection matches = certificatesStore.getMatches(signerInformation.getSID()); + @SuppressWarnings("unchecked") + Collection matches = + certificatesStore.getMatches((Selector) signerInformation.getSID()); X509CertificateHolder certificateHolder = matches.iterator().next(); X509Certificate certFromSignedData = new JcaX509CertificateConverter().getCertificate(certificateHolder); System.out.println("certFromSignedData: " + certFromSignedData); - certFromSignedData.checkValidity(sig.getSignDate().getTime()); - if (isSelfSigned(certFromSignedData)) + SigUtils.checkCertificateUsage(certFromSignedData); + + // Embedded timestamp + TimeStampToken timeStampToken = extractTimeStampTokenFromSignerInformation(signerInformation); + if (timeStampToken != null) + { + // tested with QV_RCA1_RCA3_CPCPS_V4_11.pdf + // https://www.quovadisglobal.com/~/media/Files/Repository/QV_RCA1_RCA3_CPCPS_V4_11.ashx + // timeStampToken.getCertificates() only contained the local certificate and not + // the whole chain, so use the store of the main signature. + // (If this assumption is incorrect, then the code must be changed to merge + // both stores, or to pass a collection) + validateTimestampToken(timeStampToken); + X509CertificateHolder tstCertHolder = (X509CertificateHolder) timeStampToken.getCertificates().getMatches(null).iterator().next(); + X509Certificate certFromTimeStamp = new JcaX509CertificateConverter().getCertificate(tstCertHolder); + verifyCertificateChain(certificatesStore, + certFromTimeStamp, + timeStampToken.getTimeStampInfo().getGenTime()); + SigUtils.checkTimeStampCertificateUsage(certFromTimeStamp); + } + + try { - System.err.println("Certificate is self-signed, LOL!"); + if (sig.getSignDate() != null) + { + certFromSignedData.checkValidity(sig.getSignDate().getTime()); + System.out.println("Certificate valid at signing time"); + } + else + { + System.err.println("Certificate cannot be verified without signing time"); + } } - else + catch (CertificateExpiredException ex) { - System.out.println("Certificate is not self-signed"); - // todo rest of chain + System.err.println("Certificate expired at signing time"); + } + catch (CertificateNotYetValidException ex) + { + System.err.println("Certificate not yet valid at signing time"); } - if (signerInformation.verify(new JcaSimpleSignerInfoVerifierBuilder().build(certFromSignedData))) + // usually not available + if (signerInformation.getSignedAttributes() != null) + { + // From SignedMailValidator.getSignatureTime() + Attribute signingTime = signerInformation.getSignedAttributes().get(CMSAttributes.signingTime); + if (signingTime != null) + { + Time timeInstance = Time.getInstance(signingTime.getAttrValues().getObjectAt(0)); + try + { + certFromSignedData.checkValidity(timeInstance.getDate()); + System.out.println("Certificate valid at signing time: " + timeInstance.getDate()); + } + catch (CertificateExpiredException ex) + { + System.err.println("Certificate expired at signing time"); + } + catch (CertificateNotYetValidException ex) + { + System.err.println("Certificate not yet valid at signing time"); + } + } + } + + if (signerInformation.verify(new JcaSimpleSignerInfoVerifierBuilder(). + setProvider(SecurityProvider.getProvider()).build(certFromSignedData))) { System.out.println("Signature verified"); } @@ -293,6 +429,75 @@ { System.out.println("Signature verification failed"); } + + if (CertificateVerifier.isSelfSigned(certFromSignedData)) + { + System.err.println("Certificate is self-signed, LOL!"); + } + else + { + System.out.println("Certificate is not self-signed"); + + if (sig.getSignDate() != null) + { + verifyCertificateChain(certificatesStore, certFromSignedData, sig.getSignDate().getTime()); + } + else + { + System.err.println("Certificate cannot be verified without signing time"); + } + } + } + + private TimeStampToken extractTimeStampTokenFromSignerInformation(SignerInformation signerInformation) + throws CMSException, IOException, TSPException + { + if (signerInformation.getUnsignedAttributes() == null) + { + return null; + } + AttributeTable unsignedAttributes = signerInformation.getUnsignedAttributes(); + // https://stackoverflow.com/questions/1647759/how-to-validate-if-a-signed-jar-contains-a-timestamp + Attribute attribute = unsignedAttributes.get( + PKCSObjectIdentifiers.id_aa_signatureTimeStampToken); + ASN1Object obj = (ASN1Object) attribute.getAttrValues().getObjectAt(0); + CMSSignedData signedTSTData = new CMSSignedData(obj.getEncoded()); + return new TimeStampToken(signedTSTData); + } + + private void verifyCertificateChain(Store certificatesStore, + X509Certificate certFromSignedData, Date signDate) + throws CertificateVerificationException, CertificateException + { + // Verify certificate chain (new since 11/2018) + // Please post bad PDF files that succeed and + // good PDF files that fail in + // https://issues.apache.org/jira/browse/PDFBOX-3017 + Collection certificateHolders = certificatesStore.getMatches(null); + Set additionalCerts = new HashSet(); + JcaX509CertificateConverter certificateConverter = new JcaX509CertificateConverter(); + for (X509CertificateHolder certHolder : certificateHolders) + { + X509Certificate certificate = certificateConverter.getCertificate(certHolder); + if (!certificate.equals(certFromSignedData)) + { + additionalCerts.add(certificate); + } + } + CertificateVerifier.verifyCertificate(certFromSignedData, additionalCerts, true, signDate); + } + + private void validateTimestampToken(TimeStampToken timeStampToken) + throws IOException, CertificateException, TSPException, OperatorCreationException + { + // https://stackoverflow.com/questions/42114742/ + Collection tstMatches = + timeStampToken.getCertificates().getMatches(timeStampToken.getSID()); + X509CertificateHolder holder = tstMatches.iterator().next(); + X509Certificate tstCert = new JcaX509CertificateConverter().getCertificate(holder); + SignerInformationVerifier siv = new JcaSimpleSignerInfoVerifierBuilder().setProvider(SecurityProvider.getProvider()).build(tstCert); + timeStampToken.validate(siv); + System.out.println("TimeStampToken validated"); } /** @@ -354,31 +559,6 @@ } } - // https://svn.apache.org/repos/asf/cxf/tags/cxf-2.4.1/distribution/src/main/release/samples/sts_issue_operation/src/main/java/demo/sts/provider/cert/CertificateVerifier.java - - /** - * Checks whether given X.509 certificate is self-signed. - */ - private boolean isSelfSigned(X509Certificate cert) - throws CertificateException, NoSuchAlgorithmException, NoSuchProviderException - { - try - { - // Try to verify certificate signature with its own public key - PublicKey key = cert.getPublicKey(); - cert.verify(key); - return true; - } - catch (SignatureException sigEx) - { - return false; - } - catch (InvalidKeyException keyEx) - { - return false; - } - } - /** * This will print a usage message. */ diff -Nru libpdfbox2-java-2.0.9/examples/src/main/java/org/apache/pdfbox/examples/signature/SigUtils.java libpdfbox2-java-2.0.13/examples/src/main/java/org/apache/pdfbox/examples/signature/SigUtils.java --- libpdfbox2-java-2.0.9/examples/src/main/java/org/apache/pdfbox/examples/signature/SigUtils.java 2018-03-20 16:19:44.000000000 +0000 +++ libpdfbox2-java-2.0.13/examples/src/main/java/org/apache/pdfbox/examples/signature/SigUtils.java 2018-11-28 17:18:40.000000000 +0000 @@ -16,12 +16,21 @@ package org.apache.pdfbox.examples.signature; +import java.io.IOException; +import java.security.cert.CertificateParsingException; +import java.security.cert.X509Certificate; +import java.util.List; +import java.util.SortedMap; +import java.util.TreeMap; +import org.apache.commons.logging.Log; +import org.apache.commons.logging.LogFactory; import org.apache.pdfbox.cos.COSArray; import org.apache.pdfbox.cos.COSBase; import org.apache.pdfbox.cos.COSDictionary; import org.apache.pdfbox.cos.COSName; import org.apache.pdfbox.pdmodel.PDDocument; import org.apache.pdfbox.pdmodel.interactive.digitalsignature.PDSignature; +import org.bouncycastle.asn1.x509.KeyPurposeId; /** * Utility class for the signature / timestamp examples. @@ -30,6 +39,8 @@ */ public class SigUtils { + private static final Log LOG = LogFactory.getLog(SigUtils.class); + private SigUtils() { } @@ -126,4 +137,103 @@ catalogDict.setNeedToBeUpdated(true); permsDict.setNeedToBeUpdated(true); } + + /** + * Log if the certificate is not valid for signature usage. Doing this + * anyway results in Adobe Reader failing to validate the PDF. + * + * @param x509Certificate + * @throws java.security.cert.CertificateParsingException + */ + public static void checkCertificateUsage(X509Certificate x509Certificate) + throws CertificateParsingException + { + // Check whether signer certificate is "valid for usage" + // https://stackoverflow.com/a/52765021/535646 + // https://www.adobe.com/devnet-docs/acrobatetk/tools/DigSig/changes.html#id1 + boolean[] keyUsage = x509Certificate.getKeyUsage(); + if (keyUsage != null && !keyUsage[0] && !keyUsage[1]) + { + // (unclear what "signTransaction" is) + // https://tools.ietf.org/html/rfc5280#section-4.2.1.3 + LOG.error("Certificate key usage does not include " + + "digitalSignature nor nonRepudiation"); + } + List extendedKeyUsage = x509Certificate.getExtendedKeyUsage(); + if (extendedKeyUsage != null && + !extendedKeyUsage.contains(KeyPurposeId.id_kp_emailProtection.toString()) && + !extendedKeyUsage.contains(KeyPurposeId.id_kp_codeSigning.toString()) && + !extendedKeyUsage.contains(KeyPurposeId.anyExtendedKeyUsage.toString()) && + !extendedKeyUsage.contains("1.2.840.113583.1.1.5") && + // not mentioned in Adobe document, but tolerated in practice + !extendedKeyUsage.contains("1.3.6.1.4.1.311.10.3.12")) + { + LOG.error("Certificate extended key usage does not include " + + "emailProtection, nor codeSigning, nor anyExtendedKeyUsage, " + + "nor 'Adobe Authentic Documents Trust'"); + } + } + + /** + * Log if the certificate is not valid for timestamping. + * + * @param x509Certificate + * @throws java.security.cert.CertificateParsingException + */ + public static void checkTimeStampCertificateUsage(X509Certificate x509Certificate) + throws CertificateParsingException + { + List extendedKeyUsage = x509Certificate.getExtendedKeyUsage(); + // https://tools.ietf.org/html/rfc5280#section-4.2.1.12 + if (extendedKeyUsage != null && + !extendedKeyUsage.contains(KeyPurposeId.id_kp_timeStamping.toString())) + { + LOG.error("Certificate extended key usage does not include timeStamping"); + } + } + + /** + * Log if the certificate is not valid for responding. + * + * @param x509Certificate + * @throws java.security.cert.CertificateParsingException + */ + public static void checkResponderCertificateUsage(X509Certificate x509Certificate) + throws CertificateParsingException + { + List extendedKeyUsage = x509Certificate.getExtendedKeyUsage(); + // https://tools.ietf.org/html/rfc5280#section-4.2.1.12 + if (extendedKeyUsage != null && + !extendedKeyUsage.contains(KeyPurposeId.id_kp_OCSPSigning.toString())) + { + LOG.error("Certificate extended key usage does not include OCSP responding"); + } + } + + /** + * Gets the last relevant signature in the document, i.e. the one with the highest offset. + * + * @param document to get its last signature + * @return last signature or null when none found + * @throws IOException + */ + public static PDSignature getLastRelevantSignature(PDDocument document) throws IOException + { + SortedMap sortedMap = new TreeMap(); + for (PDSignature signature : document.getSignatureDictionaries()) + { + int sigOffset = signature.getByteRange()[1]; + sortedMap.put(sigOffset, signature); + } + if (sortedMap.size() > 0) + { + PDSignature lastSignature = sortedMap.get(sortedMap.lastKey()); + COSBase type = lastSignature.getCOSObject().getItem(COSName.TYPE); + if (type.equals(COSName.SIG) || type.equals(COSName.DOC_TIME_STAMP)) + { + return lastSignature; + } + } + return null; + } } diff -Nru libpdfbox2-java-2.0.9/examples/src/main/java/org/apache/pdfbox/examples/signature/validation/AddValidationInformation.java libpdfbox2-java-2.0.13/examples/src/main/java/org/apache/pdfbox/examples/signature/validation/AddValidationInformation.java --- libpdfbox2-java-2.0.9/examples/src/main/java/org/apache/pdfbox/examples/signature/validation/AddValidationInformation.java 2018-03-20 16:19:44.000000000 +0000 +++ libpdfbox2-java-2.0.13/examples/src/main/java/org/apache/pdfbox/examples/signature/validation/AddValidationInformation.java 2018-11-28 17:18:40.000000000 +0000 @@ -24,9 +24,11 @@ import java.io.OutputStream; import java.math.BigInteger; import java.security.GeneralSecurityException; -import java.security.cert.CRLException; +import java.security.Security; import java.security.cert.CertificateEncodingException; +import java.security.cert.X509CRL; import java.security.cert.X509Certificate; +import java.util.Calendar; import java.util.HashSet; import java.util.Set; @@ -35,13 +37,20 @@ import org.apache.pdfbox.cos.COSArray; import org.apache.pdfbox.cos.COSBase; import org.apache.pdfbox.cos.COSDictionary; -import org.apache.pdfbox.cos.COSInteger; import org.apache.pdfbox.cos.COSName; import org.apache.pdfbox.cos.COSStream; import org.apache.pdfbox.cos.COSUpdateInfo; +import org.apache.pdfbox.examples.signature.SigUtils; +import org.apache.pdfbox.examples.signature.cert.CRLVerifier; +import org.apache.pdfbox.examples.signature.cert.CertificateVerificationException; +import org.apache.pdfbox.examples.signature.cert.OcspHelper; +import org.apache.pdfbox.examples.signature.cert.RevokedCertificateException; import org.apache.pdfbox.examples.signature.validation.CertInformationCollector.CertSignatureInformation; +import org.apache.pdfbox.io.IOUtils; import org.apache.pdfbox.pdmodel.PDDocument; import org.apache.pdfbox.pdmodel.PDDocumentCatalog; +import org.apache.pdfbox.pdmodel.encryption.SecurityProvider; +import org.apache.pdfbox.pdmodel.interactive.digitalsignature.PDSignature; import org.bouncycastle.cert.ocsp.BasicOCSPResp; import org.bouncycastle.cert.ocsp.OCSPException; import org.bouncycastle.cert.ocsp.OCSPResp; @@ -67,6 +76,7 @@ private COSArray certs; private PDDocument document; private final Set foundRevocationInformation = new HashSet(); + private Calendar signDate; /** * Signs the given PDF file. @@ -91,9 +101,9 @@ } /** - * Fetches certificate information from the last signature of the document and appends a DSS with the validation - * information to the document. - * + * Fetches certificate information from the last signature of the document and appends a DSS + * with the validation information to the document. + * * @param document containing the Signature * @param filename in file to extract signature * @param output where to write the changed document @@ -102,10 +112,15 @@ private void doValidation(String filename, OutputStream output) throws IOException { certInformationHelper = new CertInformationCollector(); - CertSignatureInformation certInfo; + CertSignatureInformation certInfo = null; try { - certInfo = certInformationHelper.getLastCertInfo(document, filename); + PDSignature signature = SigUtils.getLastRelevantSignature(document); + if (signature != null) + { + certInfo = certInformationHelper.getLastCertInfo(signature, filename); + signDate = signature.getSignDate(); + } } catch (CertificateProccessingException e) { @@ -190,14 +205,15 @@ /** * Fetches and adds revocation information based on the certInfo to the DSS. - * - * @param certInfo Certificate information from CertInformationHelper containing certificate chains. + * + * @param certInfo Certificate information from CertInformationHelper containing certificate + * chains. * @throws IOException */ private void addRevocationData(CertSignatureInformation certInfo) throws IOException { COSDictionary vri = new COSDictionary(); - vriBase.setItem(COSName.getPDFName(certInfo.getSignatureHash()), vri); + vriBase.setItem(certInfo.getSignatureHash(), vri); correspondingOCSPs = new COSArray(); correspondingCRLs = new COSArray(); @@ -206,11 +222,11 @@ if (correspondingOCSPs.size() > 0) { - vri.setItem(COSName.getPDFName("OCSP"), correspondingOCSPs); + vri.setItem("OCSP", correspondingOCSPs); } if (correspondingCRLs.size() > 0) { - vri.setItem(COSName.getPDFName("CRL"), correspondingCRLs); + vri.setItem("CRL", correspondingCRLs); } if (certInfo.getTsaCerts() != null) @@ -224,8 +240,9 @@ /** * Tries to get Revocation Data (first OCSP, else CRL) from the given Certificate Chain. - * - * @param certInfo from which to fetch revocation data. Will work recursively through its chains. + * + * @param certInfo from which to fetch revocation data. Will work recursively through its + * chains. * @throws IOException when failed to fetch an revocation data. */ private void addRevocationDataRecursive(CertSignatureInformation certInfo) throws IOException @@ -249,10 +266,14 @@ isRevocationInfoFound = true; } - if (!isRevocationInfoFound) + if (certInfo.getOcspUrl() == null && certInfo.getCrlUrl() == null) + { + LOG.info("No revocation information for cert " + certInfo.getCertificate().getSubjectX500Principal()); + } + else if (!isRevocationInfoFound) { throw new IOException("Could not fetch Revocation Info for Cert: " - + certInfo.getCertificate().getSubjectDN()); + + certInfo.getCertificate().getSubjectX500Principal()); } } @@ -269,7 +290,7 @@ /** * Tries to fetch and add OCSP Data to its containers. - * + * * @param certInfo the certificate info, for it to check OCSP data. * @return true when the OCSP data has successfully been fetched and added * @throws IOException when Certificate is revoked. @@ -304,9 +325,10 @@ /** * Tries to fetch and add CRL Data to its containers. - * + * * @param certInfo the certificate info, for it to check CRL data. - * @throws IOException when failed to fetch, because no validation data could be fetched for data. + * @throws IOException when failed to fetch, because no validation data could be fetched for + * data. */ private void fetchCrlData(CertSignatureInformation certInfo) throws IOException { @@ -314,7 +336,7 @@ { addCrlRevocationInfo(certInfo); } - catch (CRLException e) + catch (GeneralSecurityException e) { LOG.warn("Failed fetching CRL", e); throw new IOException(e); @@ -329,6 +351,11 @@ LOG.warn("Failed fetching CRL", e); throw new IOException(e); } + catch (CertificateVerificationException e) + { + LOG.warn("Failed fetching CRL", e); + throw new IOException(e); + } } /** @@ -343,12 +370,19 @@ private void addOcspData(CertSignatureInformation certInfo) throws IOException, OCSPException, CertificateProccessingException, RevokedCertificateException { - OcspHelper ocspHelper = new OcspHelper(certInfo.getCertificate(), - certInfo.getIssuerCertificate(), certInfo.getOcspUrl()); + OcspHelper ocspHelper = new OcspHelper( + certInfo.getCertificate(), + signDate.getTime(), + certInfo.getIssuerCertificate(), + new HashSet(certInformationHelper.getCertificatesMap().values()), + certInfo.getOcspUrl()); OCSPResp ocspResp = ocspHelper.getResponseOcsp(); BasicOCSPResp basicResponse = (BasicOCSPResp) ocspResp.getResponseObject(); certInformationHelper.addAllCertsFromHolders(basicResponse.getCerts()); + + //TODO check revocation of responder + include in separate VRI (usually not needed). + // See comment by mkl in PDFBOX-3017 on 21.11.2018 byte[] ocspData = ocspResp.getEncoded(); @@ -365,16 +399,19 @@ * Fetches and adds CRL data to storage for the given Certificate. * * @param certInfo the certificate info, for it to check CRL data. - * @throws CRLException * @throws IOException * @throws RevokedCertificateException + * @throws GeneralSecurityException + * @throws CertificateVerificationException */ private void addCrlRevocationInfo(CertSignatureInformation certInfo) - throws CRLException, IOException, RevokedCertificateException + throws IOException, RevokedCertificateException, GeneralSecurityException, + CertificateVerificationException { - byte[] crlData = CrlHelper.performCrlRequestAndCheck(certInfo.getCrlUrl(), - certInfo.getCertificate()); - COSStream crlStream = writeDataToStream(crlData); + X509CRL crl = CRLVerifier.downloadCRLFromWeb(certInfo.getCrlUrl()); + crl.verify(certInfo.getIssuerCertificate().getPublicKey(), SecurityProvider.getProvider().getName()); + CRLVerifier.checkRevocation(crl, certInfo.getCertificate(), signDate.getTime(), certInfo.getCrlUrl()); + COSStream crlStream = writeDataToStream(crl.getEncoded()); crls.add(crlStream); if (correspondingCRLs != null) { @@ -384,16 +421,16 @@ } /** - * Adds all certs to the certs-array. Make sure, all certificates are inside the certificateStore of - * certInformationHelper - * + * Adds all certs to the certs-array. Make sure, all certificates are inside the + * certificateStore of certInformationHelper + * * @throws IOException */ private void addAllCertsToCertArray() throws IOException { try { - for (X509Certificate cert : certInformationHelper.getCertificateStore().values()) + for (X509Certificate cert : certInformationHelper.getCertificatesMap().values()) { COSStream stream = writeDataToStream(cert.getEncoded()); certs.add(stream); @@ -406,45 +443,48 @@ } /** - * Creates a FlateDecoded COSStream element with the given data. + * Creates a Flate encoded COSStream object with the given data. * - * @param data to write into the element - * @return COSStream Element, that can be added to the document + * @param data to write into the COSStream + * @return COSStream a COSStream object that can be added to the document * @throws IOException */ private COSStream writeDataToStream(byte[] data) throws IOException { COSStream stream = document.getDocument().createCOSStream(); - COSArray filters = new COSArray(); - filters.add(COSName.FLATE_DECODE); - - OutputStream os = stream.createOutputStream(filters); - os.write(data); - os.close(); - + OutputStream os = null; + try + { + os = stream.createOutputStream(COSName.FLATE_DECODE); + os.write(data); + } + finally + { + IOUtils.closeQuietly(os); + } return stream; } /** - * Adds Extensions to the document catalog. So that the use of DSS is identified. Described in PAdES Part 4, Chapter - * 4.4. - * + * Adds Extensions to the document catalog. So that the use of DSS is identified. Described in + * PAdES Part 4, Chapter 4.4. + * * @param catalog to add Extensions into */ private void addExtensions(PDDocumentCatalog catalog) { COSDictionary dssExtensions = new COSDictionary(); dssExtensions.setDirect(true); - catalog.getCOSObject().setItem(COSName.getPDFName("Extensions"), dssExtensions); + catalog.getCOSObject().setItem("Extensions", dssExtensions); COSDictionary adbeExtension = new COSDictionary(); adbeExtension.setDirect(true); - dssExtensions.setItem(COSName.getPDFName("ADBE"), adbeExtension); + dssExtensions.setItem("ADBE", adbeExtension); - adbeExtension.setItem(COSName.getPDFName("BaseVersion"), COSName.getPDFName("1.7")); - adbeExtension.setItem(COSName.getPDFName("ExtensionLevel"), COSInteger.get(5)); + adbeExtension.setName("BaseVersion", "1.7"); + adbeExtension.setInt("ExtensionLevel", 5); - catalog.getCOSObject().setItem(COSName.getPDFName("Version"), COSName.getPDFName("1.7")); + catalog.setVersion("1.7"); } public static void main(String[] args) throws IOException, GeneralSecurityException @@ -455,6 +495,9 @@ System.exit(1); } + // register BouncyCastle provider, needed for "exotic" algorithms + Security.addProvider(SecurityProvider.getProvider()); + // add ocspInformation AddValidationInformation addOcspInformation = new AddValidationInformation(); diff -Nru libpdfbox2-java-2.0.9/examples/src/main/java/org/apache/pdfbox/examples/signature/validation/CertInformationCollector.java libpdfbox2-java-2.0.13/examples/src/main/java/org/apache/pdfbox/examples/signature/validation/CertInformationCollector.java --- libpdfbox2-java-2.0.9/examples/src/main/java/org/apache/pdfbox/examples/signature/validation/CertInformationCollector.java 2018-03-20 16:19:44.000000000 +0000 +++ libpdfbox2-java-2.0.13/examples/src/main/java/org/apache/pdfbox/examples/signature/validation/CertInformationCollector.java 2018-11-28 17:18:40.000000000 +0000 @@ -22,27 +22,31 @@ import java.io.InputStream; import java.math.BigInteger; import java.net.URL; +import java.security.GeneralSecurityException; +import java.security.InvalidKeyException; +import java.security.NoSuchAlgorithmException; +import java.security.NoSuchProviderException; +import java.security.SignatureException; import java.security.cert.CertificateException; import java.security.cert.CertificateFactory; import java.security.cert.X509Certificate; +import java.util.Arrays; import java.util.Collection; import java.util.HashMap; import java.util.Map; -import java.util.SortedMap; -import java.util.TreeMap; import org.apache.commons.logging.Log; import org.apache.commons.logging.LogFactory; -import org.apache.pdfbox.cos.COSBase; -import org.apache.pdfbox.cos.COSName; +import org.apache.pdfbox.examples.signature.cert.CertificateVerifier; import org.apache.pdfbox.io.IOUtils; -import org.apache.pdfbox.pdmodel.PDDocument; +import org.apache.pdfbox.pdmodel.encryption.SecurityProvider; import org.apache.pdfbox.pdmodel.interactive.digitalsignature.PDSignature; import org.bouncycastle.asn1.DERSequence; import org.bouncycastle.asn1.DERSet; import org.bouncycastle.asn1.cms.Attribute; import org.bouncycastle.asn1.cms.AttributeTable; import org.bouncycastle.asn1.pkcs.PKCSObjectIdentifiers; +import org.bouncycastle.asn1.x509.Extension; import org.bouncycastle.cert.X509CertificateHolder; import org.bouncycastle.cert.jcajce.JcaX509CertificateConverter; import org.bouncycastle.cms.CMSException; @@ -50,6 +54,7 @@ import org.bouncycastle.cms.SignerInformation; import org.bouncycastle.tsp.TSPException; import org.bouncycastle.tsp.TimeStampToken; +import org.bouncycastle.util.Selector; import org.bouncycastle.util.Store; /** @@ -64,78 +69,37 @@ { private static final Log LOG = LogFactory.getLog(CertInformationCollector.class); - // As described in https://tools.ietf.org/html/rfc3280.html#section-4.2.2.1 - private static final String ID_PE_AUTHORITYINFOACCESS = "1.3.6.1.5.5.7.1.1"; - - // As described in https://tools.ietf.org/html/rfc3280.html#section-4.2.1.14 - // Disable false Sonar warning for "Hardcoded IP Address ..." - @SuppressWarnings("squid:S1313") - private static final String ID_CE_CRLDISTRIBUTIONPOINTS = "2.5.29.31"; - private static final int MAX_CERTIFICATE_CHAIN_DEPTH = 5; - private final Map certificateStore = new HashMap(); + private final Map certificatesMap = new HashMap(); private final JcaX509CertificateConverter certConverter = new JcaX509CertificateConverter(); private CertSignatureInformation rootCertInfo; /** - * Gets the Certificate Information of the last Signature. + * Gets the certificate information of a signature. * - * @param document to get the Signature from + * @param signature the signature of the document. * @param fileName of the document. * @return the CertSignatureInformation containing all certificate information * @throws CertificateProccessingException when there is an error processing the certificates * @throws IOException on a data processing error */ - public CertSignatureInformation getLastCertInfo(PDDocument document, String fileName) + public CertSignatureInformation getLastCertInfo(PDSignature signature, String fileName) throws CertificateProccessingException, IOException { - PDSignature signature = getLastRelevantSignature(document); - if (signature != null) + FileInputStream documentInput = null; + try { - FileInputStream documentInput = null; - try - { - documentInput = new FileInputStream(fileName); - byte[] docBytes = IOUtils.toByteArray(documentInput); - byte[] signatureContent = signature.getContents(docBytes); - return getCertInfo(signatureContent); - } - finally - { - IOUtils.closeQuietly(document); - } + documentInput = new FileInputStream(fileName); + byte[] signatureContent = signature.getContents(documentInput); + return getCertInfo(signatureContent); } - return null; - } - - /** - * Gets the last relevant signature in the document - * - * @param document to get its last Signature - * @return last signature or null when none found - * @throws IOException - */ - private PDSignature getLastRelevantSignature(PDDocument document) throws IOException - { - SortedMap sortedMap = new TreeMap(); - for (PDSignature signature : document.getSignatureDictionaries()) + finally { - int sigOffset = signature.getByteRange()[1]; - sortedMap.put(sigOffset, signature); + IOUtils.closeQuietly(documentInput); } - if (sortedMap.size() > 0) - { - PDSignature lastSignature = sortedMap.get(sortedMap.lastKey()); - COSBase type = lastSignature.getCOSObject().getItem(COSName.TYPE); - if (type.equals(COSName.SIG) || type.equals(COSName.DOC_TIME_STAMP)) - { - return lastSignature; - } - } - return null; } /** @@ -225,10 +189,10 @@ * not yet practicable. * * @param certificatesStore To get the certificate information from. Certificates will be saved - * in the certificateStore. - * @param signedData to get SignerInformation off + * in certificatesMap. + * @param signedData data from which to get the SignerInformation * @param certInfo where to add certificate information - * @return Signer Information of the processed certificate Store for further usage. + * @return Signer Information of the processed certificatesStore for further usage. * @throws IOException on data-processing error * @throws CertificateProccessingException on a specific error with a certificate */ @@ -239,8 +203,9 @@ Collection signers = signedData.getSignerInfos().getSigners(); SignerInformation signerInformation = signers.iterator().next(); + @SuppressWarnings("unchecked") Collection matches = certificatesStore - .getMatches(signerInformation.getSID()); + .getMatches((Selector) signerInformation.getSID()); X509Certificate certificate = getCertFromHolder(matches.iterator().next()); @@ -266,7 +231,8 @@ certInfo.certificate = certificate; // Certificate Authority Information Access - byte[] authorityExtensionValue = certificate.getExtensionValue(ID_PE_AUTHORITYINFOACCESS); + // As described in https://tools.ietf.org/html/rfc3280.html#section-4.2.2.1 + byte[] authorityExtensionValue = certificate.getExtensionValue(Extension.authorityInfoAccess.getId()); if (authorityExtensionValue != null) { CertInformationHelper.getAuthorityInfoExtensionValue(authorityExtensionValue, certInfo); @@ -277,37 +243,66 @@ getAlternativeIssuerCertificate(certInfo, maxDepth); } - byte[] crlExtensionValue = certificate.getExtensionValue(ID_CE_CRLDISTRIBUTIONPOINTS); + // As described in https://tools.ietf.org/html/rfc3280.html#section-4.2.1.14 + byte[] crlExtensionValue = certificate.getExtensionValue(Extension.cRLDistributionPoints.getId()); if (crlExtensionValue != null) { certInfo.crlUrl = CertInformationHelper.getCrlUrlFromExtensionValue(crlExtensionValue); } - if (CertInformationHelper.isSelfSigned(certificate)) + try { - certInfo.isSelfSigned = true; + certInfo.isSelfSigned = CertificateVerifier.isSelfSigned(certificate); + } + catch (GeneralSecurityException ex) + { + throw new CertificateProccessingException(ex); } if (maxDepth <= 0 || certInfo.isSelfSigned) { return; } - for (X509Certificate issuer : certificateStore.values()) + for (X509Certificate issuer : certificatesMap.values()) { - if (CertInformationHelper.verify(certificate, issuer.getPublicKey())) + if (certificate.getIssuerX500Principal().equals(issuer.getSubjectX500Principal())) { - LOG.info("Found the right Issuer Cert! for Cert: " + certificate.getSubjectDN() - + "\n" + issuer.getSubjectDN()); + try + { + certificate.verify(issuer.getPublicKey(), SecurityProvider.getProvider().getName()); + } + catch (CertificateException ex) + { + throw new CertificateProccessingException(ex); + } + catch (NoSuchAlgorithmException ex) + { + throw new CertificateProccessingException(ex); + } + catch (InvalidKeyException ex) + { + throw new CertificateProccessingException(ex); + } + catch (SignatureException ex) + { + throw new CertificateProccessingException(ex); + } + catch (NoSuchProviderException ex) + { + throw new CertificateProccessingException(ex); + } + LOG.info("Found the right Issuer Cert! for Cert: " + certificate.getSubjectX500Principal() + + "\n" + issuer.getSubjectX500Principal()); certInfo.issuerCertificate = issuer; certInfo.certChain = new CertSignatureInformation(); - traverseChain(issuer, certInfo.certChain, --maxDepth); + traverseChain(issuer, certInfo.certChain, maxDepth - 1); break; } } if (certInfo.issuerCertificate == null) { throw new IOException( - "No Issuer Certificate found for Cert: " + certificate.getSubjectDN()); + "No Issuer Certificate found for Cert: " + certificate.getSubjectX500Principal()); } } @@ -324,7 +319,7 @@ private void getAlternativeIssuerCertificate(CertSignatureInformation certInfo, int maxDepth) throws CertificateProccessingException { - System.out.println("Get Certificate from: " + certInfo.issuerUrl); + LOG.info("Get alternative issuer certificate from: " + certInfo.issuerUrl); try { URL certUrl = new URL(certInfo.issuerUrl); @@ -332,7 +327,7 @@ InputStream in = certUrl.openStream(); X509Certificate altIssuerCert = (X509Certificate) certFactory.generateCertificate(in); - addCertToCertStore(altIssuerCert); + addCertToCertificatesMap(altIssuerCert); certInfo.alternativeCertChain = new CertSignatureInformation(); traverseChain(altIssuerCert, certInfo.alternativeCertChain, maxDepth - 1); @@ -340,30 +335,30 @@ } catch (IOException e) { - LOG.error("Error getting additional Certificate from " + certInfo.issuerUrl, e); + LOG.error("Error getting alternative issuer certificate from " + certInfo.issuerUrl, e); } catch (CertificateException e) { - LOG.error("Error getting additional Certificate from " + certInfo.issuerUrl, e); + LOG.error("Error getting alternative issuer certificate from " + certInfo.issuerUrl, e); } } /** - * Adds the given Certificate to the certificateStore, if not yet containing. + * Adds the given Certificate to the certificatesMap, if not yet containing. * - * @param certificate to add to the certificateStore + * @param certificate to add to the certificatesMap */ - private void addCertToCertStore(X509Certificate certificate) + private void addCertToCertificatesMap(X509Certificate certificate) { - if (!certificateStore.containsKey(certificate.getSerialNumber())) + if (!certificatesMap.containsKey(certificate.getSerialNumber())) { - certificateStore.put(certificate.getSerialNumber(), certificate); + certificatesMap.put(certificate.getSerialNumber(), certificate); } } /** - * Gets the X509Certificate out of the X509CertificateHolder - * + * Gets the X509Certificate out of the X509CertificateHolder and add it to certificatesMap. + * * @param certificateHolder to get the certificate from * @return a X509Certificate or null when there was an Error with the Certificate * @throws CertificateProccessingException on failed conversion from X509CertificateHolder to X509Certificate @@ -371,12 +366,13 @@ private X509Certificate getCertFromHolder(X509CertificateHolder certificateHolder) throws CertificateProccessingException { - if (!certificateStore.containsKey(certificateHolder.getSerialNumber())) + //TODO getCertFromHolder violates "do one thing" rule (adds to the map and returns a certificate) + if (!certificatesMap.containsKey(certificateHolder.getSerialNumber())) { try { X509Certificate certificate = certConverter.getCertificate(certificateHolder); - certificateStore.put(certificate.getSerialNumber(), certificate); + certificatesMap.put(certificate.getSerialNumber(), certificate); return certificate; } catch (CertificateException e) @@ -387,13 +383,12 @@ } else { - return certificateStore.get(certificateHolder.getSerialNumber()); + return certificatesMap.get(certificateHolder.getSerialNumber()); } } /** - * Adds multiple Certificates out of a Collection of X509CertificateHolder into the - * Certificate-Store. + * Adds multiple Certificates out of a Collection of X509CertificateHolder into certificatesMap. * * @param certHolders Collection of X509CertificateHolder */ @@ -414,7 +409,7 @@ /** * Gets a list of X509Certificate out of an array of X509CertificateHolder. The certificates - * will be added to the certificateStore. + * will be added to certificatesMap. * * @param certHolders Array of X509CertificateHolder * @throws CertificateProccessingException when one of the Certificates could not be parsed. @@ -422,20 +417,42 @@ public void addAllCertsFromHolders(X509CertificateHolder[] certHolders) throws CertificateProccessingException { - for (X509CertificateHolder certHolder : certHolders) + addAllCerts(Arrays.asList(certHolders)); + } + + /** + * Traverse the OCSP certificate. + * + * @param certHolder + * @return + * @throws CertificateProccessingException + */ + CertSignatureInformation getOCSPCertInfo(X509CertificateHolder certHolder) throws CertificateProccessingException + { + try + { + CertSignatureInformation certSignatureInformation = new CertSignatureInformation(); + traverseChain(certConverter.getCertificate(certHolder), certSignatureInformation, MAX_CERTIFICATE_CHAIN_DEPTH); + return certSignatureInformation; + } + catch (CertificateException ex) + { + throw new CertificateProccessingException(ex); + } + catch (IOException ex) { - getCertFromHolder(certHolder); + throw new CertificateProccessingException(ex); } } /** - * Get the certificate store of all processed certificates until now. + * Get the map of all processed certificates until now. * * @return a map of serial numbers to certificates. */ - public Map getCertificateStore() + public Map getCertificatesMap() { - return certificateStore; + return certificatesMap; } /** diff -Nru libpdfbox2-java-2.0.9/examples/src/main/java/org/apache/pdfbox/examples/signature/validation/CertInformationHelper.java libpdfbox2-java-2.0.13/examples/src/main/java/org/apache/pdfbox/examples/signature/validation/CertInformationHelper.java --- libpdfbox2-java-2.0.9/examples/src/main/java/org/apache/pdfbox/examples/signature/validation/CertInformationHelper.java 2018-03-20 16:19:44.000000000 +0000 +++ libpdfbox2-java-2.0.13/examples/src/main/java/org/apache/pdfbox/examples/signature/validation/CertInformationHelper.java 2018-11-28 17:18:40.000000000 +0000 @@ -17,14 +17,8 @@ package org.apache.pdfbox.examples.signature.validation; import java.io.IOException; -import java.security.InvalidKeyException; import java.security.MessageDigest; import java.security.NoSuchAlgorithmException; -import java.security.NoSuchProviderException; -import java.security.PublicKey; -import java.security.SignatureException; -import java.security.cert.CertificateException; -import java.security.cert.X509Certificate; import java.util.Enumeration; import org.apache.commons.logging.Log; @@ -38,7 +32,7 @@ import org.bouncycastle.asn1.DLSequence; import org.bouncycastle.asn1.x509.GeneralName; import org.bouncycastle.asn1.x509.X509ObjectIdentifiers; -import org.bouncycastle.x509.extension.X509ExtensionUtil; +import org.bouncycastle.cert.jcajce.JcaX509ExtensionUtils; public class CertInformationHelper { @@ -69,73 +63,6 @@ } /** - * Checks whether the given certificate is self-signed (root). - * - * @param cert to be checked - * @return true when it is a self-signed certificate - * @throws CertificateProccessingException containing the cause, on multiple exception with the given data - */ - public static boolean isSelfSigned(X509Certificate cert) throws CertificateProccessingException - { - return verify(cert, cert.getPublicKey()); - } - - /** - * Verifies whether the certificate is signed by the given public key. Can be done to check - * signature chain. Idea and code are from Julius Musseau at: - * https://stackoverflow.com/a/10822177/2497581 - * - * @param cert Child certificate to check - * @param key Fathers public key to check - * @return true when the certificate is signed by the public key - * @throws CertificateProccessingException containing the cause, on multiple exception with the - * given data - */ - public static boolean verify(X509Certificate cert, PublicKey key) - throws CertificateProccessingException - { - try - { - String sigAlg = cert.getSigAlgName(); - String keyAlg = key.getAlgorithm(); - sigAlg = sigAlg != null ? sigAlg.trim().toUpperCase() : ""; - keyAlg = keyAlg != null ? keyAlg.trim().toUpperCase() : ""; - if (keyAlg.length() >= 2 && sigAlg.endsWith(keyAlg)) - { - try - { - cert.verify(key); - return true; - } - catch (SignatureException se) - { - return false; - } - } - else - { - return false; - } - } - catch (InvalidKeyException e) - { - throw new CertificateProccessingException(e); - } - catch (CertificateException e) - { - throw new CertificateProccessingException(e); - } - catch (NoSuchAlgorithmException e) - { - throw new CertificateProccessingException(e); - } - catch (NoSuchProviderException e) - { - throw new CertificateProccessingException(e); - } - } - - /** * Extracts authority information access extension values from the given data. The Data * structure has to be implemented as described in RFC 2459, 4.2.2.1. * @@ -146,7 +73,7 @@ protected static void getAuthorityInfoExtensionValue(byte[] extensionValue, CertSignatureInformation certInfo) throws IOException { - ASN1Sequence asn1Seq = (ASN1Sequence) X509ExtensionUtil.fromExtensionValue(extensionValue); + ASN1Sequence asn1Seq = (ASN1Sequence) JcaX509ExtensionUtils.parseExtensionValue(extensionValue); Enumeration objects = asn1Seq.getObjects(); while (objects.hasMoreElements()) { @@ -171,8 +98,8 @@ } /** - * Gets the first CRL Url from given extension value. Structure has to be build as in 4.2.1.14 - * CRL Distribution Points of RFC 2459. + * Gets the first CRL URL from given extension value. Structure has to be + * built as in 4.2.1.14 CRL Distribution Points of RFC 2459. * * @param extensionValue to get the extension value from * @return first CRL- URL or null @@ -180,7 +107,7 @@ */ protected static String getCrlUrlFromExtensionValue(byte[] extensionValue) throws IOException { - ASN1Sequence asn1Seq = (ASN1Sequence) X509ExtensionUtil.fromExtensionValue(extensionValue); + ASN1Sequence asn1Seq = (ASN1Sequence) JcaX509ExtensionUtils.parseExtensionValue(extensionValue); Enumeration objects = asn1Seq.getObjects(); while (objects.hasMoreElements()) diff -Nru libpdfbox2-java-2.0.9/examples/src/main/java/org/apache/pdfbox/examples/signature/validation/CrlHelper.java libpdfbox2-java-2.0.13/examples/src/main/java/org/apache/pdfbox/examples/signature/validation/CrlHelper.java --- libpdfbox2-java-2.0.9/examples/src/main/java/org/apache/pdfbox/examples/signature/validation/CrlHelper.java 2018-03-20 16:19:44.000000000 +0000 +++ libpdfbox2-java-2.0.13/examples/src/main/java/org/apache/pdfbox/examples/signature/validation/CrlHelper.java 1970-01-01 00:00:00.000000000 +0000 @@ -1,77 +0,0 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one or more - * contributor license agreements. See the NOTICE file distributed with - * this work for additional information regarding copyright ownership. - * The ASF licenses this file to You under the Apache License, Version 2.0 - * (the "License"); you may not use this file except in compliance with - * the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ -package org.apache.pdfbox.examples.signature.validation; - -import java.io.IOException; -import java.net.HttpURLConnection; -import java.net.URL; -import java.security.cert.CRLException; -import java.security.cert.X509CRL; -import java.security.cert.X509Certificate; - -import org.bouncycastle.jcajce.provider.asymmetric.x509.CertificateFactory; - -/** - * Helper class to get CRL (Certificate revocation list) from given crlUrl and check if Certificate - * has been revoked. - * - * @author Alexis Suter - */ -public final class CrlHelper -{ - private CrlHelper() - { - } - - /** - * Performs the CRL-Request and checks if the given certificate has been revoked. - * - * @param crlUrl to get the CRL from - * @param cert to be checked if it is inside the CRL - * @return CRL-Response; might be very big depending on the issuer. - * @throws CRLException if an Error occurred getting the CRL, or parsing it. - * @throws RevokedCertificateException - */ - public static byte[] performCrlRequestAndCheck(String crlUrl, X509Certificate cert) - throws CRLException, RevokedCertificateException - { - try - { - URL url = new URL(crlUrl); - - HttpURLConnection con = (HttpURLConnection) url.openConnection(); - if (con.getResponseCode() != 200) - { - throw new IOException("Unsuccessful CRL request. Status: " + con.getResponseCode() - + " Url: " + crlUrl); - } - - CertificateFactory certFac = new CertificateFactory(); - X509CRL crl = (X509CRL) certFac.engineGenerateCRL(con.getInputStream()); - if (crl.isRevoked(cert)) - { - throw new RevokedCertificateException("The Certificate was found on the CRL and is revoked!"); - } - return crl.getEncoded(); - } - catch (IOException e) - { - throw new CRLException(e); - } - } - -} diff -Nru libpdfbox2-java-2.0.9/examples/src/main/java/org/apache/pdfbox/examples/signature/validation/OcspHelper.java libpdfbox2-java-2.0.13/examples/src/main/java/org/apache/pdfbox/examples/signature/validation/OcspHelper.java --- libpdfbox2-java-2.0.9/examples/src/main/java/org/apache/pdfbox/examples/signature/validation/OcspHelper.java 2018-03-20 16:19:44.000000000 +0000 +++ libpdfbox2-java-2.0.13/examples/src/main/java/org/apache/pdfbox/examples/signature/validation/OcspHelper.java 1970-01-01 00:00:00.000000000 +0000 @@ -1,353 +0,0 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one or more - * contributor license agreements. See the NOTICE file distributed with - * this work for additional information regarding copyright ownership. - * The ASF licenses this file to You under the Apache License, Version 2.0 - * (the "License"); you may not use this file except in compliance with - * the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ -package org.apache.pdfbox.examples.signature.validation; - -import java.io.ByteArrayOutputStream; -import java.io.IOException; -import java.io.InputStream; -import java.io.OutputStream; -import java.net.HttpURLConnection; -import java.net.URL; -import java.security.MessageDigest; -import java.security.NoSuchAlgorithmException; -import java.security.Security; -import java.security.cert.CertificateEncodingException; -import java.security.cert.X509Certificate; -import java.util.Random; - -import org.apache.commons.logging.Log; -import org.apache.commons.logging.LogFactory; -import org.apache.pdfbox.util.Hex; -import org.bouncycastle.asn1.DEROctetString; -import org.bouncycastle.asn1.DLSequence; -import org.bouncycastle.asn1.ocsp.OCSPObjectIdentifiers; -import org.bouncycastle.asn1.ocsp.OCSPResponseStatus; -import org.bouncycastle.asn1.oiw.OIWObjectIdentifiers; -import org.bouncycastle.asn1.x509.AlgorithmIdentifier; -import org.bouncycastle.asn1.x509.Extension; -import org.bouncycastle.asn1.x509.Extensions; -import org.bouncycastle.cert.X509CertificateHolder; -import org.bouncycastle.cert.jcajce.JcaX509CertificateHolder; -import org.bouncycastle.cert.jcajce.JcaX509ContentVerifierProviderBuilder; -import org.bouncycastle.cert.ocsp.BasicOCSPResp; -import org.bouncycastle.cert.ocsp.CertificateID; -import org.bouncycastle.cert.ocsp.CertificateStatus; -import org.bouncycastle.cert.ocsp.OCSPException; -import org.bouncycastle.cert.ocsp.OCSPReq; -import org.bouncycastle.cert.ocsp.OCSPReqBuilder; -import org.bouncycastle.cert.ocsp.OCSPResp; -import org.bouncycastle.cert.ocsp.RevokedStatus; -import org.bouncycastle.cert.ocsp.SingleResp; -import org.bouncycastle.jce.provider.BouncyCastleProvider; -import org.bouncycastle.operator.ContentVerifierProvider; -import org.bouncycastle.operator.DigestCalculator; -import org.bouncycastle.operator.OperatorCreationException; - -/** - * Helper Class for OCSP-Operations with bouncy castle. - * - * @author Alexis Suter - */ -public class OcspHelper -{ - private static final Log LOG = LogFactory.getLog(OcspHelper.class); - - private final X509Certificate issuerCertificate; - private final X509Certificate certificateToCheck; - private final String ocspUrl; - private DEROctetString encodedNonce; - - /** - * @param checkCertificate Certificate to be OCSP-Checked - * @param issuerCertificate Certificate of the issuer - * @param ocspUrl where to fetch for OCSP - */ - public OcspHelper(X509Certificate checkCertificate, X509Certificate issuerCertificate, - String ocspUrl) - { - this.certificateToCheck = checkCertificate; - this.issuerCertificate = issuerCertificate; - this.ocspUrl = ocspUrl; - } - - /** - * Performs and verifies the OCSP-Request - * - * @return the OCSPResp, when the request was successful, else a corresponding exception will be - * thrown. - * @throws IOException - * @throws OCSPException - * @throws RevokedCertificateException - */ - public OCSPResp getResponseOcsp() throws IOException, OCSPException, RevokedCertificateException - { - OCSPResp ocspResponse = performRequest(); - verifyOcspResponse(ocspResponse); - return ocspResponse; - } - - /** - * Verifies the status and the response itself (including nonce), but not the signature. - * - * @param ocspResponse to be verified - * @throws OCSPException - * @throws RevokedCertificateException - */ - private void verifyOcspResponse(OCSPResp ocspResponse) - throws OCSPException, RevokedCertificateException - { - verifyRespStatus(ocspResponse); - - BasicOCSPResp basicResponse = (BasicOCSPResp) ocspResponse.getResponseObject(); - if (basicResponse != null) - { - checkOcspSignature(basicResponse.getCerts()[0], basicResponse); - - checkNonce(basicResponse); - - SingleResp[] responses = basicResponse.getResponses(); - if (responses.length == 1) - { - SingleResp resp = responses[0]; - Object status = resp.getCertStatus(); - - if (status instanceof RevokedStatus) - { - throw new RevokedCertificateException("OCSP: Certificate is revoked."); - } - else if (status != CertificateStatus.GOOD) - { - throw new OCSPException("OCSP: Status of Cert is unknown"); - } - } - else - { - throw new OCSPException( - "OCSP: Recieved " + responses.length + " responses instead of 1!"); - } - } - } - - /** - * Checks whether the OCSP response is signed by the given certificate. - * - * @param certificate the certificate to check the signature - * @param basicResponse OCSP response containing the signature - * @throws OCSPException when the signature is invalid or could not be checked - */ - private void checkOcspSignature(X509CertificateHolder certificate, BasicOCSPResp basicResponse) - throws OCSPException - { - try - { - ContentVerifierProvider verifier = new JcaX509ContentVerifierProviderBuilder() - .setProvider(BouncyCastleProvider.PROVIDER_NAME).build(certificate); - - if (!basicResponse.isSignatureValid(verifier)) - { - throw new OCSPException("OCSP-Signature is not valid!"); - } - } - catch (OperatorCreationException e) - { - throw new OCSPException("Error checking Ocsp-Signature", e); - } - } - - /** - * Checks if the nonce in the response is correct - * - * @param basicResponse Response to be checked - * @throws OCSPException if nonce is wrong or inexistent - */ - private void checkNonce(BasicOCSPResp basicResponse) throws OCSPException - { - Extension nonceExt = basicResponse.getExtension(OCSPObjectIdentifiers.id_pkix_ocsp_nonce); - if (nonceExt != null) - { - DEROctetString responseNonceString = (DEROctetString) nonceExt.getExtnValue(); - if (!responseNonceString.equals(encodedNonce)) - { - throw new OCSPException("Invalid Nonce found in response!"); - } - } - else if (encodedNonce != null) - { - throw new OCSPException("Nonce not found in response!"); - } - } - - /** - * Performs the OCSP-Request, with given data. - * - * @return the OCSPResp, that has been fetched from the ocspUrl - * @throws IOException - * @throws OCSPException - */ - private OCSPResp performRequest() throws IOException, OCSPException - { - OCSPReq request = generateOCSPRequest(); - URL url = new URL(ocspUrl); - HttpURLConnection httpConnection = (HttpURLConnection) url.openConnection(); - httpConnection.setRequestProperty("Content-Type", "application/ocsp-request"); - httpConnection.setRequestProperty("Accept", "application/ocsp-response"); - httpConnection.setDoOutput(true); - OutputStream out = httpConnection.getOutputStream(); - out.write(request.getEncoded()); - out.close(); - - if (httpConnection.getResponseCode() != 200) - { - throw new IOException("OCSP: Could not access url, ResponseCode: " - + httpConnection.getResponseCode()); - } - // Get Response - InputStream in = (InputStream) httpConnection.getContent(); - return new OCSPResp(in); - } - - /** - * Helper method to verify response status. - * - * @param resp OCSP response - * @throws OCSPException if the response status is not ok - */ - public void verifyRespStatus(OCSPResp resp) throws OCSPException - { - String statusInfo = ""; - if (resp != null) - { - int status = resp.getStatus(); - switch (status) - { - case OCSPResponseStatus.INTERNAL_ERROR: - statusInfo = "INTERNAL_ERROR"; - System.err.println("An internal error occurred in the OCSP Server!"); - break; - case OCSPResponseStatus.MALFORMED_REQUEST: - statusInfo = "MALFORMED_REQUEST"; - System.err.println("Your request did not fit the RFC 2560 syntax!"); - break; - case OCSPResponseStatus.SIG_REQUIRED: - statusInfo = "SIG_REQUIRED"; - System.err.println("Your request was not signed!"); - break; - case OCSPResponseStatus.TRY_LATER: - statusInfo = "TRY_LATER"; - System.err.println("The server was too busy to answer you!"); - break; - case OCSPResponseStatus.UNAUTHORIZED: - statusInfo = "UNAUTHORIZED"; - System.err.println("The server could not authenticate you!"); - break; - case OCSPResponseStatus.SUCCESSFUL: - break; - default: - statusInfo = "UNKNOWN"; - System.err.println("Unknown OCSPResponse status code! " + status); - } - } - if (resp == null || resp.getStatus() != OCSPResponseStatus.SUCCESSFUL) - { - throw new OCSPException(statusInfo + "OCSP response unsuccessful! "); - } - } - - /** - * Generates an OCSP request and generates the CertificateID. - * - * @return OCSP request, ready to fetch data - * @throws OCSPException - * @throws IOException - */ - private OCSPReq generateOCSPRequest() throws OCSPException, IOException - { - Security.addProvider(new BouncyCastleProvider()); - - // Generate the ID for the certificate we are looking for - CertificateID certId; - try - { - certId = new CertificateID(new SHA1DigestCalculator(), - new JcaX509CertificateHolder(issuerCertificate), - certificateToCheck.getSerialNumber()); - } - catch (CertificateEncodingException e) - { - throw new IOException("Error creating CertificateID with the Certificate encoding", e); - } - - OCSPReqBuilder builder = new OCSPReqBuilder(); - - Extension responseExtension = new Extension(OCSPObjectIdentifiers.id_pkix_ocsp_response, - true, new DLSequence(OCSPObjectIdentifiers.id_pkix_ocsp_basic).getEncoded()); - - Random rand = new Random(); - byte[] nonce = new byte[16]; - rand.nextBytes(nonce); - encodedNonce = new DEROctetString(new DEROctetString(nonce)); - Extension nonceExtension = new Extension(OCSPObjectIdentifiers.id_pkix_ocsp_nonce, true, - encodedNonce); - - builder.setRequestExtensions( - new Extensions(new Extension[] { responseExtension, nonceExtension })); - - builder.addRequest(certId); - - System.out.println("Nonce: " + Hex.getString(nonceExtension.getExtnValue().getEncoded())); - - return builder.build(); - } - - /** - * Class to create SHA-1 Digest, used for creation of CertificateID. - */ - private static class SHA1DigestCalculator implements DigestCalculator - { - private final ByteArrayOutputStream bOut = new ByteArrayOutputStream(); - - @Override - public AlgorithmIdentifier getAlgorithmIdentifier() - { - return new AlgorithmIdentifier(OIWObjectIdentifiers.idSHA1); - } - - @Override - public OutputStream getOutputStream() - { - return bOut; - } - - @Override - public byte[] getDigest() - { - byte[] bytes = bOut.toByteArray(); - bOut.reset(); - - try - { - MessageDigest md = MessageDigest.getInstance("SHA-1"); - return md.digest(bytes); - } - catch (NoSuchAlgorithmException e) - { - LOG.error("SHA-1 Algorithm not found", e); - return null; - } - } - } -} diff -Nru libpdfbox2-java-2.0.9/examples/src/main/java/org/apache/pdfbox/examples/signature/validation/RevokedCertificateException.java libpdfbox2-java-2.0.13/examples/src/main/java/org/apache/pdfbox/examples/signature/validation/RevokedCertificateException.java --- libpdfbox2-java-2.0.9/examples/src/main/java/org/apache/pdfbox/examples/signature/validation/RevokedCertificateException.java 2018-03-20 16:19:44.000000000 +0000 +++ libpdfbox2-java-2.0.13/examples/src/main/java/org/apache/pdfbox/examples/signature/validation/RevokedCertificateException.java 1970-01-01 00:00:00.000000000 +0000 @@ -1,32 +0,0 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one or more - * contributor license agreements. See the NOTICE file distributed with - * this work for additional information regarding copyright ownership. - * The ASF licenses this file to You under the Apache License, Version 2.0 - * (the "License"); you may not use this file except in compliance with - * the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ -package org.apache.pdfbox.examples.signature.validation; - -/** - * Exception to handle a revoked Certificate explicitly - * - * @author Alexis Suter - */ -public class RevokedCertificateException extends Exception -{ - private static final long serialVersionUID = 3543946618794126654L; - - public RevokedCertificateException(String message) - { - super(message); - } -} diff -Nru libpdfbox2-java-2.0.9/examples/src/main/java/org/apache/pdfbox/examples/util/ExtractTextSimple.java libpdfbox2-java-2.0.13/examples/src/main/java/org/apache/pdfbox/examples/util/ExtractTextSimple.java --- libpdfbox2-java-2.0.9/examples/src/main/java/org/apache/pdfbox/examples/util/ExtractTextSimple.java 1970-01-01 00:00:00.000000000 +0000 +++ libpdfbox2-java-2.0.13/examples/src/main/java/org/apache/pdfbox/examples/util/ExtractTextSimple.java 2018-11-28 17:18:40.000000000 +0000 @@ -0,0 +1,103 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. + * The ASF licenses this file to You under the Apache License, Version 2.0 + * (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.apache.pdfbox.examples.util; + +import java.io.File; +import java.io.IOException; +import org.apache.pdfbox.pdmodel.PDDocument; +import org.apache.pdfbox.pdmodel.encryption.AccessPermission; +import org.apache.pdfbox.text.PDFTextStripper; + +/** + * This is a simple text extraction example to get started. For more advance usage, see the + * ExtractTextByArea and the DrawPrintTextLocations examples in this subproject, as well as the + * ExtractText tool in the tools subproject. + * + * @author Tilman Hausherr + */ +public class ExtractTextSimple +{ + private ExtractTextSimple() + { + // example class should not be instantiated + } + + /** + * This will print the documents text page by page. + * + * @param args The command line arguments. + * + * @throws IOException If there is an error parsing or extracting the document. + */ + public static void main(String[] args) throws IOException + { + if (args.length != 1) + { + usage(); + } + + PDDocument document = PDDocument.load(new File(args[0])); + AccessPermission ap = document.getCurrentAccessPermission(); + if (!ap.canExtractContent()) + { + throw new IOException("You do not have permission to extract text"); + } + + PDFTextStripper stripper = new PDFTextStripper(); + + // This example uses sorting, but in some cases it is more useful to switch it off, + // e.g. in some files with columns where the PDF content stream respects the + // column order. + stripper.setSortByPosition(true); + + for (int p = 1; p <= document.getNumberOfPages(); ++p) + { + // Set the page interval to extract. If you don't, then all pages would be extracted. + stripper.setStartPage(p); + stripper.setEndPage(p); + + // let the magic happen + String text = stripper.getText(document); + + // do some nice output with a header + String pageStr = String.format("page %d:", p); + System.out.println(pageStr); + for (int i = 0; i < pageStr.length(); ++i) + { + System.out.print("-"); + } + System.out.println(); + System.out.println(text.trim()); + System.out.println(); + + // If the extracted text is empty or gibberish, please try extracting text + // with Adobe Reader first before asking for help. Also read the FAQ + // on the website: + // https://pdfbox.apache.org/2.0/faq.html#text-extraction + } + document.close(); + } + + /** + * This will print the usage for this document. + */ + private static void usage() + { + System.err.println("Usage: java " + ExtractTextSimple.class.getName() + " "); + System.exit(-1); + } +} diff -Nru libpdfbox2-java-2.0.9/examples/src/main/java/org/apache/pdfbox/examples/util/PDFHighlighter.java libpdfbox2-java-2.0.13/examples/src/main/java/org/apache/pdfbox/examples/util/PDFHighlighter.java --- libpdfbox2-java-2.0.9/examples/src/main/java/org/apache/pdfbox/examples/util/PDFHighlighter.java 2018-03-20 16:19:44.000000000 +0000 +++ libpdfbox2-java-2.0.13/examples/src/main/java/org/apache/pdfbox/examples/util/PDFHighlighter.java 2018-11-28 17:18:40.000000000 +0000 @@ -54,7 +54,6 @@ */ public PDFHighlighter() throws IOException { - super(); super.setLineSeparator( "" ); super.setWordSeparator( "" ); super.setShouldSeparateByBeads( false ); diff -Nru libpdfbox2-java-2.0.9/examples/src/main/java/org/apache/pdfbox/examples/util/RemoveAllText.java libpdfbox2-java-2.0.13/examples/src/main/java/org/apache/pdfbox/examples/util/RemoveAllText.java --- libpdfbox2-java-2.0.9/examples/src/main/java/org/apache/pdfbox/examples/util/RemoveAllText.java 2018-03-20 16:19:44.000000000 +0000 +++ libpdfbox2-java-2.0.13/examples/src/main/java/org/apache/pdfbox/examples/util/RemoveAllText.java 2018-11-28 17:18:40.000000000 +0000 @@ -130,12 +130,23 @@ if (token instanceof Operator) { Operator op = (Operator) token; - if ("TJ".equals(op.getName()) || "Tj".equals(op.getName()) || - "'".equals(op.getName()) || "\"".equals(op.getName())) + if ("TJ".equals(op.getName()) || + "Tj".equals(op.getName()) || + "'".equals(op.getName())) { - // remove the one argument to this operator + // remove the argument to this operator newTokens.remove(newTokens.size() - 1); - + + token = parser.parseNextToken(); + continue; + } + else if ("\"".equals(op.getName())) + { + // remove the 3 arguments to this operator + newTokens.remove(newTokens.size() - 1); + newTokens.remove(newTokens.size() - 1); + newTokens.remove(newTokens.size() - 1); + token = parser.parseNextToken(); continue; } Binary files /tmp/tmpAhqVVB/umSeuAuTn3/libpdfbox2-java-2.0.9/examples/src/main/resources/org/apache/pdfbox/resources/ttf/Lohit-Bengali.ttf and /tmp/tmpAhqVVB/Y0XihoDyIA/libpdfbox2-java-2.0.13/examples/src/main/resources/org/apache/pdfbox/resources/ttf/Lohit-Bengali.ttf differ diff -Nru libpdfbox2-java-2.0.9/examples/src/test/java/org/apache/pdfbox/examples/pdmodel/TestCreateSignature.java libpdfbox2-java-2.0.13/examples/src/test/java/org/apache/pdfbox/examples/pdmodel/TestCreateSignature.java --- libpdfbox2-java-2.0.9/examples/src/test/java/org/apache/pdfbox/examples/pdmodel/TestCreateSignature.java 2018-03-20 16:19:44.000000000 +0000 +++ libpdfbox2-java-2.0.13/examples/src/test/java/org/apache/pdfbox/examples/pdmodel/TestCreateSignature.java 2018-11-28 17:18:40.000000000 +0000 @@ -34,7 +34,6 @@ import java.util.Arrays; import java.util.Collection; import java.util.List; -import javax.xml.bind.DatatypeConverter; import org.apache.pdfbox.cos.COSName; import org.apache.pdfbox.cos.COSString; @@ -46,6 +45,7 @@ import org.apache.pdfbox.pdmodel.PDPage; import org.apache.pdfbox.pdmodel.PDPageContentStream; import org.apache.pdfbox.pdmodel.interactive.digitalsignature.PDSignature; +import org.apache.pdfbox.util.Hex; import org.apache.wink.client.MockHttpServer; import org.bouncycastle.cert.X509CertificateHolder; import org.bouncycastle.cert.jcajce.JcaX509CertificateConverter; @@ -56,6 +56,7 @@ import org.bouncycastle.cms.jcajce.JcaSimpleSignerInfoVerifierBuilder; import org.bouncycastle.operator.OperatorCreationException; import org.bouncycastle.tsp.TSPValidationException; +import org.bouncycastle.util.Selector; import org.bouncycastle.util.Store; import org.junit.Assert; import org.junit.BeforeClass; @@ -123,7 +124,7 @@ final String fileName = getOutputFileName("signed{0}.pdf"); signing.signDetached(new File(inDir + "sign_me.pdf"), new File(outDir + fileName)); - checkSignature(new File(outDir + fileName)); + checkSignature(new File(inDir, "sign_me.pdf"), new File(outDir, fileName)); } /** @@ -209,7 +210,7 @@ signing.signPDF(new File(inPath), destFile, null); fis.close(); - checkSignature(destFile); + checkSignature(new File(inPath), destFile); } /** @@ -251,7 +252,7 @@ signing1.setExternalSigning(false); signing1.signDetached(new File(filename), new File(filenameSigned1)); - checkSignature(new File(filenameSigned1)); + checkSignature(new File(filename), new File(filenameSigned1)); PDDocument doc1 = PDDocument.load(new File(filenameSigned1)); List signatureDictionaries = doc1.getSignatureDictionaries(); @@ -267,7 +268,7 @@ signing2.signPDF(new File(filenameSigned1), new File(filenameSigned2), null, "Signature1"); fis.close(); - checkSignature(new File(filenameSigned2)); + checkSignature(new File(filenameSigned1), new File(filenameSigned2)); PDDocument doc2 = PDDocument.load(new File(filenameSigned2)); signatureDictionaries = doc2.getSignatureDictionaries(); @@ -281,10 +282,18 @@ } // This check fails with a file created with the code before PDFBOX-3011 was solved. - private void checkSignature(File file) + private void checkSignature(File origFile, File signedFile) throws IOException, CMSException, OperatorCreationException, GeneralSecurityException { - PDDocument document = PDDocument.load(file); + PDDocument document = PDDocument.load(origFile); + // get string representation of pages COSObject + String origPageKey = document.getDocumentCatalog().getCOSObject().getItem(COSName.PAGES).toString(); + document.close(); + + document = PDDocument.load(signedFile); + // PDFBOX-4261: check that object number stays the same + Assert.assertEquals(origPageKey, document.getDocumentCatalog().getCOSObject().getItem(COSName.PAGES).toString()); + List signatureDictionaries = document.getSignatureDictionaries(); if (signatureDictionaries.isEmpty()) { @@ -294,7 +303,7 @@ { COSString contents = (COSString) sig.getCOSObject().getDictionaryObject(COSName.CONTENTS); - FileInputStream fis = new FileInputStream(file); + FileInputStream fis = new FileInputStream(signedFile); byte[] buf = sig.getSignedContent(fis); fis.close(); @@ -305,7 +314,7 @@ Store certificatesStore = signedData.getCertificates(); Collection signers = signedData.getSignerInfos().getSigners(); SignerInformation signerInformation = signers.iterator().next(); - Collection matches = certificatesStore.getMatches(signerInformation.getSID()); + Collection matches = certificatesStore.getMatches((Selector) signerInformation.getSID()); X509CertificateHolder certificateHolder = (X509CertificateHolder) matches.iterator().next(); X509Certificate certFromSignedData = new JcaX509CertificateConverter().getCertificate(certificateHolder); @@ -324,7 +333,7 @@ private String calculateDigestString(InputStream inputStream) throws NoSuchAlgorithmException, IOException { MessageDigest md = MessageDigest.getInstance("SHA-256"); - return DatatypeConverter.printHexBinary(md.digest(IOUtils.toByteArray(inputStream))); + return Hex.getString(md.digest(IOUtils.toByteArray(inputStream))); } /** diff -Nru libpdfbox2-java-2.0.9/examples/src/test/java/org/apache/wink/client/MockHttpServer.java libpdfbox2-java-2.0.13/examples/src/test/java/org/apache/wink/client/MockHttpServer.java --- libpdfbox2-java-2.0.9/examples/src/test/java/org/apache/wink/client/MockHttpServer.java 1970-01-01 00:00:00.000000000 +0000 +++ libpdfbox2-java-2.0.13/examples/src/test/java/org/apache/wink/client/MockHttpServer.java 2018-11-28 17:18:40.000000000 +0000 @@ -0,0 +1,548 @@ +/******************************************************************************* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + * + *******************************************************************************/ + +package org.apache.wink.client; + +import java.io.BufferedInputStream; +import java.io.BufferedOutputStream; +import java.io.ByteArrayOutputStream; +import java.io.IOException; +import java.io.InputStream; +import java.io.OutputStream; +import java.net.BindException; +import java.net.ServerSocket; +import java.net.Socket; +import java.net.SocketException; +import java.util.ArrayList; +import java.util.Arrays; +import java.util.HashMap; +import java.util.List; +import java.util.Map; + +import javax.net.ServerSocketFactory; +import javax.net.ssl.SSLServerSocketFactory; +import javax.ws.rs.core.Response; +import javax.ws.rs.core.Response.Status; + +/** + * Copied from + * http://svn.apache.org/repos/asf/wink/trunk/wink-component-test-support/src/main/java/org/apache/wink/client/MockHttpServer.java + * on 28.7.2018. + */ +public class MockHttpServer extends Thread { + + public static class MockHttpServerResponse { + + // mock response data + private int mockResponseCode = 200; + private final Map mockResponseHeaders = new HashMap(); + private byte[] mockResponseContent = "received message".getBytes(); + private String mockResponseContentType = "text/plain;charset=utf-8"; + private boolean mockResponseContentEchoRequest; + + public void setMockResponseHeaders(Map headers) { + mockResponseHeaders.clear(); + mockResponseHeaders.putAll(headers); + } + + public void setMockResponseHeader(String name, String value) { + mockResponseHeaders.put(name, value); + } + + public Map getMockResponseHeaders() { + return mockResponseHeaders; + } + + public void setMockResponseCode(int responseCode) { + this.mockResponseCode = responseCode; + } + + public int getMockResponseCode() { + return mockResponseCode; + } + + public void setMockResponseContent(String content) { + mockResponseContent = content.getBytes(); + } + + public void setMockResponseContent(byte[] content) { + mockResponseContent = content; + } + + public byte[] getMockResponseContent() { + return mockResponseContent; + } + + public void setMockResponseContentType(String type) { + mockResponseContentType = type; + } + + public String getMockResponseContentType() { + return mockResponseContentType; + } + + public void setMockResponseContentEchoRequest(boolean echo) { + mockResponseContentEchoRequest = echo; + } + + public boolean getMockResponseContentEchoRequest() { + return mockResponseContentEchoRequest; + } + } + + private Thread serverThread = null; + private ServerSocket serverSocket = null; + private boolean serverStarted = false; + private ServerSocketFactory serverSocketFactory = null; + private int serverPort; + private int readTimeOut = 5000; // 5 + // seconds + private int delayResponseTime = 0; + private static byte[] NEW_LINE = "\r\n".getBytes(); + // request data + private String requestMethod = null; + private String requestUrl = null; + private Map> requestHeaders = + new HashMap>(); + private ByteArrayOutputStream requestContent = new ByteArrayOutputStream(); + private List mockHttpServerResponses = + new ArrayList(); + private int responseCounter = 0; + + public MockHttpServer(int serverPort) { + this(serverPort, false); + } + + public MockHttpServer(int serverPort, boolean ssl) { + mockHttpServerResponses.add(new MockHttpServerResponse()); // set a + // default + // response + this.serverPort = serverPort; + try { + serverSocketFactory = ServerSocketFactory.getDefault(); + if (ssl) { + serverSocketFactory = SSLServerSocketFactory.getDefault(); + } + while (serverSocket == null) { + try { + serverSocket = serverSocketFactory.createServerSocket(++this.serverPort); + } catch (BindException e) { + + } + } + } catch (IOException e) { + throw new RuntimeException(e); + } + } + + public synchronized void startServer() { + if (serverStarted) + return; + + // start the server thread + start(); + serverStarted = true; + + // wait for the server thread to start + waitForServerToStart(); + } + + private synchronized void waitForServerToStart() { + try { + wait(5000); + } catch (InterruptedException e) { + throw new RuntimeException(e); + } + } + + private synchronized void waitForServerToStop() { + try { + wait(5000); + } catch (InterruptedException e) { + throw new RuntimeException(e); + } + } + + @Override + public void run() { + serverThread = Thread.currentThread(); + executeLoop(); + } + + private void executeLoop() { + serverStarted(); + try { + while (true) { + Socket socket = serverSocket.accept(); + HttpProcessor processor = new HttpProcessor(socket); + processor.run(); + } + } catch (IOException e) { + if (e instanceof SocketException) { + if (!("Socket closed".equalsIgnoreCase(e.getMessage()) || "Socket is closed" + .equalsIgnoreCase(e.getMessage()))) { + e.printStackTrace(); + throw new RuntimeException(e); + } + } else { + e.printStackTrace(); + throw new RuntimeException(e); + } + } finally { + // notify that the server was stopped + serverStopped(); + } + } + + private synchronized void serverStarted() { + // notify the waiting thread that the thread started + notifyAll(); + } + + private synchronized void serverStopped() { + // notify the waiting thread that the thread started + notifyAll(); + } + + public synchronized void stopServer() { + if (!serverStarted) + return; + + try { + serverStarted = false; + // the server may be sleeping somewhere... + serverThread.interrupt(); + // close the server socket + serverSocket.close(); + // wait for the server to stop + waitForServerToStop(); + } catch (IOException e) { + e.printStackTrace(); + } + } + + private class HttpProcessor { + + private Socket socket; + + public HttpProcessor(Socket socket) throws SocketException { + // set the read timeout (5 seconds by default) + socket.setSoTimeout(readTimeOut); + socket.setKeepAlive(false); + this.socket = socket; + } + + public void run() { + try { + processRequest(socket); + processResponse(socket); + } catch (IOException e) { + if (e instanceof SocketException) { + if (!("socket closed".equalsIgnoreCase(e.getMessage()))) { + e.printStackTrace(); + throw new RuntimeException(e); + } + } else { + e.printStackTrace(); + throw new RuntimeException(e); + } + } finally { + try { + socket.shutdownOutput(); + socket.close(); + } catch (IOException e) { + e.printStackTrace(); + } + } + } + + private void processRequest(Socket socket) throws IOException { + requestContent.reset(); + BufferedInputStream is = new BufferedInputStream(socket.getInputStream()); + String requestMethodHeader = new String(readLine(is)); + processRequestMethod(requestMethodHeader); + processRequestHeaders(is); + processRequestContent(is); + } + + private void processRequestMethod(String requestMethodHeader) { + String[] parts = requestMethodHeader.split(" "); + if (parts.length < 2) { + throw new RuntimeException("illegal http request"); + } + requestMethod = parts[0]; + requestUrl = parts[1]; + } + + private void processRequestHeaders(InputStream is) throws IOException { + requestHeaders.clear(); + byte[] line; + while ((line = readLine(is)) != null) { + String lineStr = new String(line); + // if there are no more headers + if ("".equals(lineStr.trim())) { + break; + } + addRequestHeader(lineStr); + } + } + + private void processRequestContent(InputStream is) throws NumberFormatException, + IOException { + if (!("PUT".equals(requestMethod) || "POST".equals(requestMethod))) { + return; + } + + List transferEncodingValues = requestHeaders.get("Transfer-Encoding"); + String transferEncoding = + (transferEncodingValues == null || transferEncodingValues.isEmpty()) ? null + : transferEncodingValues.get(0); + if ("chunked".equals(transferEncoding)) { + processChunkedContent(is); + } else { + processRegularContent(is); + } + + if (mockHttpServerResponses.get(responseCounter).getMockResponseContentEchoRequest()) { + mockHttpServerResponses.get(responseCounter).setMockResponseContent(requestContent + .toByteArray()); + } + + } + + private void processRegularContent(InputStream is) throws IOException { + List contentLengthValues = requestHeaders.get("Content-Length"); + String contentLength = + (contentLengthValues == null || contentLengthValues.isEmpty()) ? null + : contentLengthValues.get(0); + if (contentLength == null) { + return; + } + int contentLen = Integer.parseInt(contentLength); + byte[] bytes = new byte[contentLen]; + is.read(bytes); + requestContent.write(bytes); + } + + private void processChunkedContent(InputStream is) throws IOException { + requestContent.write("".getBytes()); + byte[] chunk; + byte[] line = null; + boolean lastChunk = false; + // we should exit this loop only after we get to the end of stream + while (!lastChunk && (line = readLine(is)) != null) { + + String lineStr = new String(line); + // a chunk is identified as: + // 1) not an empty line + // 2) not 0. 0 means that there are no more chunks + if ("0".equals(lineStr)) { + lastChunk = true; + } + + if (!lastChunk) { + // get the length of the current chunk (it is in hexadecimal + // form) + int chunkLen = Integer.parseInt(lineStr, 16); + + // get the chunk + chunk = getChunk(is, chunkLen); + + // consume the newline after the chunk that separates + // between + // the chunk content and the next chunk size + readLine(is); + + requestContent.write(chunk); + } + } + + // do one last read to consume the empty line after the last chunk + if (lastChunk) { + readLine(is); + } + } + + private byte[] readLine(InputStream is) throws IOException { + int n; + ByteArrayOutputStream tmpOs = new ByteArrayOutputStream(); + while ((n = is.read()) != -1) { + if (n == '\r') { + n = is.read(); + if (n == '\n') { + return tmpOs.toByteArray(); + } else { + tmpOs.write('\r'); + if (n != -1) { + tmpOs.write(n); + } else { + return tmpOs.toByteArray(); + } + } + } else if (n == '\n') { + return tmpOs.toByteArray(); + } else { + tmpOs.write(n); + } + } + return tmpOs.toByteArray(); + } + + private byte[] getChunk(InputStream is, int len) throws IOException { + ByteArrayOutputStream chunk = new ByteArrayOutputStream(); + int read; + int totalRead = 0; + byte[] bytes = new byte[512]; + // read len bytes as the chunk + while (totalRead < len) { + read = is.read(bytes, 0, Math.min(bytes.length, len - totalRead)); + chunk.write(bytes, 0, read); + totalRead += read; + } + return chunk.toByteArray(); + } + + private void addRequestHeader(String line) { + String[] parts = line.split(": "); + List values = requestHeaders.get(parts[0]); + if (values == null) { + values = new ArrayList(); + requestHeaders.put(parts[0], values); + } + values.add(parts[1]); + } + + private void processResponse(Socket socket) throws IOException { + // if delaying the response failed (because it was interrupted) + // then don't send the response + if (!delayResponse()) + return; + + OutputStream sos = socket.getOutputStream(); + BufferedOutputStream os = new BufferedOutputStream(sos); + String reason = ""; + Status statusCode = + Response.Status.fromStatusCode(mockHttpServerResponses.get(responseCounter) + .getMockResponseCode()); + if (statusCode != null) { + reason = statusCode.toString(); + } + os.write(("HTTP/1.1 " + mockHttpServerResponses.get(responseCounter) + .getMockResponseCode() + + " " + reason).getBytes()); + os.write(NEW_LINE); + processResponseHeaders(os); + processResponseContent(os); + os.flush(); + responseCounter++; + } + + // return: + // true - delay was successful + // false - delay was unsuccessful + private boolean delayResponse() { + // delay the response by delayResponseTime milliseconds + if (delayResponseTime > 0) { + try { + Thread.sleep(delayResponseTime); + return true; + } catch (InterruptedException e) { + return false; + } + } + return true; + } + + private void processResponseContent(OutputStream os) throws IOException { + if (mockHttpServerResponses.get(responseCounter).getMockResponseContent() == null) { + return; + } + + os.write(mockHttpServerResponses.get(responseCounter).getMockResponseContent()); + } + + private void processResponseHeaders(OutputStream os) throws IOException { + addServerResponseHeaders(); + for (String header : mockHttpServerResponses.get(responseCounter) + .getMockResponseHeaders().keySet()) { + os.write((header + ": " + mockHttpServerResponses.get(responseCounter) + .getMockResponseHeaders().get(header)).getBytes()); + os.write(NEW_LINE); + } + os.write(NEW_LINE); + } + + private void addServerResponseHeaders() { + Map mockResponseHeaders = + mockHttpServerResponses.get(responseCounter).getMockResponseHeaders(); + mockResponseHeaders.put("Content-Type", mockHttpServerResponses.get(responseCounter) + .getMockResponseContentType()); + mockResponseHeaders.put("Content-Length", mockHttpServerResponses.get(responseCounter) + .getMockResponseContent().length + ""); + mockResponseHeaders.put("Server", "Mock HTTP Server v1.0"); + mockResponseHeaders.put("Connection", "closed"); + } + } + + public void setReadTimeout(int milliseconds) { + readTimeOut = milliseconds; + } + + public void setDelayResponse(int milliseconds) { + delayResponseTime = milliseconds; + } + + public String getRequestContentAsString() { + return requestContent.toString(); + } + + public byte[] getRequestContent() { + return requestContent.toByteArray(); + } + + public Map> getRequestHeaders() { + return requestHeaders; + } + + public String getRequestMethod() { + return requestMethod; + } + + public String getRequestUrl() { + return requestUrl; + } + + public void setMockHttpServerResponses(MockHttpServerResponse... responses) { + mockHttpServerResponses.clear(); + mockHttpServerResponses.addAll(Arrays.asList(responses)); + } + + public List getMockHttpServerResponses() { + return mockHttpServerResponses; + } + + public void setServerPort(int serverPort) { + this.serverPort = serverPort; + } + + public int getServerPort() { + return serverPort; + } +} diff -Nru libpdfbox2-java-2.0.9/fontbox/pom.xml libpdfbox2-java-2.0.13/fontbox/pom.xml --- libpdfbox2-java-2.0.9/fontbox/pom.xml 2018-03-20 16:19:48.000000000 +0000 +++ libpdfbox2-java-2.0.13/fontbox/pom.xml 2018-11-28 17:18:34.000000000 +0000 @@ -21,7 +21,7 @@ org.apache.pdfbox pdfbox-parent - 2.0.9 + 2.0.13 ../parent/pom.xml @@ -70,7 +70,6 @@ com.googlecode.maven-download-plugin download-maven-plugin - 1.3.0 PDFBOX-4038 diff -Nru libpdfbox2-java-2.0.9/fontbox/src/main/appended-resources/META-INF/LICENSE libpdfbox2-java-2.0.13/fontbox/src/main/appended-resources/META-INF/LICENSE --- libpdfbox2-java-2.0.9/fontbox/src/main/appended-resources/META-INF/LICENSE 2018-03-20 16:19:46.000000000 +0000 +++ libpdfbox2-java-2.0.13/fontbox/src/main/appended-resources/META-INF/LICENSE 2018-11-28 17:18:34.000000000 +0000 @@ -30,3 +30,100 @@ LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +Lohit-Bengali font (https://pagure.io/lohit): + + Copyright 2011-13 Lohit Fonts Project contributors + + + This Font Software is licensed under the SIL Open Font License, Version 1.1. + This license is copied below, and is also available with a FAQ at: + http://scripts.sil.org/OFL + + + ----------------------------------------------------------- + SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007 + ----------------------------------------------------------- + + PREAMBLE + The goals of the Open Font License (OFL) are to stimulate worldwide + development of collaborative font projects, to support the font creation + efforts of academic and linguistic communities, and to provide a free and + open framework in which fonts may be shared and improved in partnership + with others. + + The OFL allows the licensed fonts to be used, studied, modified and + redistributed freely as long as they are not sold by themselves. The + fonts, including any derivative works, can be bundled, embedded, + redistributed and/or sold with any software provided that any reserved + names are not used by derivative works. The fonts and derivatives, + however, cannot be released under any other type of license. The + requirement for fonts to remain under this license does not apply + to any document created using the fonts or their derivatives. + + DEFINITIONS + "Font Software" refers to the set of files released by the Copyright + Holder(s) under this license and clearly marked as such. This may + include source files, build scripts and documentation. + + "Reserved Font Name" refers to any names specified as such after the + copyright statement(s). + + "Original Version" refers to the collection of Font Software components as + distributed by the Copyright Holder(s). + + "Modified Version" refers to any derivative made by adding to, deleting, + or substituting -- in part or in whole -- any of the components of the + Original Version, by changing formats or by porting the Font Software to a + new environment. + + "Author" refers to any designer, engineer, programmer, technical + writer or other person who contributed to the Font Software. + + PERMISSION & CONDITIONS + Permission is hereby granted, free of charge, to any person obtaining + a copy of the Font Software, to use, study, copy, merge, embed, modify, + redistribute, and sell modified and unmodified copies of the Font + Software, subject to the following conditions: + + 1) Neither the Font Software nor any of its individual components, + in Original or Modified Versions, may be sold by itself. + + 2) Original or Modified Versions of the Font Software may be bundled, + redistributed and/or sold with any software, provided that each copy + contains the above copyright notice and this license. These can be + included either as stand-alone text files, human-readable headers or + in the appropriate machine-readable metadata fields within text or + binary files as long as those fields can be easily viewed by the user. + + 3) No Modified Version of the Font Software may use the Reserved Font + Name(s) unless explicit written permission is granted by the corresponding + Copyright Holder. This restriction only applies to the primary font name as + presented to the users. + + 4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font + Software shall not be used to promote, endorse or advertise any + Modified Version, except to acknowledge the contribution(s) of the + Copyright Holder(s) and the Author(s) or with their explicit written + permission. + + 5) The Font Software, modified or unmodified, in part or in whole, + must be distributed entirely under this license, and must not be + distributed under any other license. The requirement for fonts to + remain under this license does not apply to any document created + using the Font Software. + + TERMINATION + This license becomes null and void if any of the above conditions are + not met. + + DISCLAIMER + THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, + EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF + MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT + OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE + COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, + INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL + DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING + FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM + OTHER DEALINGS IN THE FONT SOFTWARE. diff -Nru libpdfbox2-java-2.0.9/fontbox/src/main/java/org/apache/fontbox/afm/AFMParser.java libpdfbox2-java-2.0.13/fontbox/src/main/java/org/apache/fontbox/afm/AFMParser.java --- libpdfbox2-java-2.0.9/fontbox/src/main/java/org/apache/fontbox/afm/AFMParser.java 2018-03-20 16:19:46.000000000 +0000 +++ libpdfbox2-java-2.0.13/fontbox/src/main/java/org/apache/fontbox/afm/AFMParser.java 2018-11-28 17:18:32.000000000 +0000 @@ -951,9 +951,11 @@ buf.append( (char)nextByte ); //now read the data - while( !isEOL(nextByte = input.read()) ) + nextByte = input.read(); + while (nextByte != -1 && !isEOL(nextByte)) { - buf.append( (char)nextByte ); + buf.append((char) nextByte); + nextByte = input.read(); } return buf.toString(); } @@ -978,9 +980,11 @@ buf.append( (char)nextByte ); //now read the data - while( !isWhitespace(nextByte = input.read()) ) + nextByte = input.read(); + while (nextByte != -1 && !isWhitespace(nextByte)) { - buf.append( (char)nextByte ); + buf.append((char) nextByte); + nextByte = input.read(); } return buf.toString(); } diff -Nru libpdfbox2-java-2.0.9/fontbox/src/main/java/org/apache/fontbox/afm/package.html libpdfbox2-java-2.0.13/fontbox/src/main/java/org/apache/fontbox/afm/package.html --- libpdfbox2-java-2.0.9/fontbox/src/main/java/org/apache/fontbox/afm/package.html 2018-03-20 16:19:46.000000000 +0000 +++ libpdfbox2-java-2.0.13/fontbox/src/main/java/org/apache/fontbox/afm/package.html 2018-11-28 17:18:34.000000000 +0000 @@ -21,7 +21,7 @@ This package holds classes used to parse AFM(Adobe Font Metrics) files. -
+
More information about AFM files can be found at http://partners.adobe.com/asn/developer/type/ diff -Nru libpdfbox2-java-2.0.9/fontbox/src/main/java/org/apache/fontbox/cff/CFFParser.java libpdfbox2-java-2.0.13/fontbox/src/main/java/org/apache/fontbox/cff/CFFParser.java --- libpdfbox2-java-2.0.9/fontbox/src/main/java/org/apache/fontbox/cff/CFFParser.java 2018-03-20 16:19:46.000000000 +0000 +++ libpdfbox2-java-2.0.13/fontbox/src/main/java/org/apache/fontbox/cff/CFFParser.java 2018-11-28 17:18:34.000000000 +0000 @@ -24,6 +24,8 @@ import java.util.LinkedList; import java.util.List; import java.util.Map; +import org.apache.commons.logging.Log; +import org.apache.commons.logging.LogFactory; import org.apache.fontbox.util.Charsets; @@ -33,6 +35,11 @@ */ public class CFFParser { + /** + * Log instance. + */ + private static final Log LOG = LogFactory.getLog(CFFParser.class); + private static final String TAG_OTTO = "OTTO"; private static final String TAG_TTCF = "ttcf"; private static final String TAG_TTFONLY = "\u0000\u0001\u0000\u0000"; @@ -336,6 +343,7 @@ StringBuilder sb = new StringBuilder(); boolean done = false; boolean exponentMissing = false; + boolean hasExponent = false; while (!done) { int b = input.readUnsignedByte(); @@ -361,12 +369,24 @@ sb.append("."); break; case 0xb: + if (hasExponent) + { + LOG.warn("duplicate 'E' ignored after " + sb); + break; + } sb.append("E"); exponentMissing = true; + hasExponent = true; break; case 0xc: + if (hasExponent) + { + LOG.warn("duplicate 'E-' ignored after " + sb); + break; + } sb.append("E-"); exponentMissing = true; + hasExponent = true; break; case 0xd: break; diff -Nru libpdfbox2-java-2.0.9/fontbox/src/main/java/org/apache/fontbox/cmap/CMap.java libpdfbox2-java-2.0.13/fontbox/src/main/java/org/apache/fontbox/cmap/CMap.java --- libpdfbox2-java-2.0.9/fontbox/src/main/java/org/apache/fontbox/cmap/CMap.java 2018-03-20 16:19:46.000000000 +0000 +++ libpdfbox2-java-2.0.13/fontbox/src/main/java/org/apache/fontbox/cmap/CMap.java 2018-11-28 17:18:34.000000000 +0000 @@ -22,6 +22,8 @@ import java.util.HashMap; import java.util.List; import java.util.Map; +import org.apache.commons.logging.Log; +import org.apache.commons.logging.LogFactory; /** * This class represents a CMap file. @@ -30,6 +32,8 @@ */ public class CMap { + private static final Log LOG = LogFactory.getLog(CMap.class); + private int wmode = 0; private String cmapName = null; private String cmapVersion = null; @@ -120,7 +124,13 @@ bytes[byteCount] = (byte)in.read(); } } - throw new IOException("CMap is invalid"); + String seq = ""; + for (int i = 0; i < maxCodeLength; ++i) + { + seq += String.format("0x%02X (%04o) ", bytes[i], bytes[i]); + } + LOG.warn("Invalid character code sequence " + seq + "in CMap " + cmapName); + return 0; } /** diff -Nru libpdfbox2-java-2.0.9/fontbox/src/main/java/org/apache/fontbox/ttf/CmapSubtable.java libpdfbox2-java-2.0.13/fontbox/src/main/java/org/apache/fontbox/ttf/CmapSubtable.java --- libpdfbox2-java-2.0.9/fontbox/src/main/java/org/apache/fontbox/ttf/CmapSubtable.java 2018-03-20 16:19:46.000000000 +0000 +++ libpdfbox2-java-2.0.13/fontbox/src/main/java/org/apache/fontbox/ttf/CmapSubtable.java 2018-11-28 17:18:34.000000000 +0000 @@ -45,7 +45,7 @@ private long subTableOffset; private int[] glyphIdToCharacterCode; private final Map> glyphIdToCharacterCodeMultiple = new HashMap>(); - private Map characterCodeToGlyphId; + private Map characterCodeToGlyphId= new HashMap(); /** * This will read the required data from the stream. @@ -513,6 +513,10 @@ if (p > 0) { p = (p + idDelta) % 65536; + if (p < 0) + { + p += 65536; + } } if (p >= numGlyphs) diff -Nru libpdfbox2-java-2.0.9/fontbox/src/main/java/org/apache/fontbox/ttf/CmapTable.java libpdfbox2-java-2.0.13/fontbox/src/main/java/org/apache/fontbox/ttf/CmapTable.java --- libpdfbox2-java-2.0.9/fontbox/src/main/java/org/apache/fontbox/ttf/CmapTable.java 2018-03-20 16:19:48.000000000 +0000 +++ libpdfbox2-java-2.0.13/fontbox/src/main/java/org/apache/fontbox/ttf/CmapTable.java 2018-11-28 17:18:34.000000000 +0000 @@ -68,8 +68,10 @@ * @param data The stream to read the data from. * @throws IOException If there is an error reading the data. */ + @Override public void read(TrueTypeFont ttf, TTFDataStream data) throws IOException { + @SuppressWarnings({"unused", "squid:S1854", "squid:S1481"}) int version = data.readUnsignedShort(); int numberOfTables = data.readUnsignedShort(); cmaps = new CmapSubtable[numberOfTables]; diff -Nru libpdfbox2-java-2.0.9/fontbox/src/main/java/org/apache/fontbox/ttf/GlyphTable.java libpdfbox2-java-2.0.13/fontbox/src/main/java/org/apache/fontbox/ttf/GlyphTable.java --- libpdfbox2-java-2.0.9/fontbox/src/main/java/org/apache/fontbox/ttf/GlyphTable.java 2018-03-20 16:19:46.000000000 +0000 +++ libpdfbox2-java-2.0.13/fontbox/src/main/java/org/apache/fontbox/ttf/GlyphTable.java 2018-11-28 17:18:34.000000000 +0000 @@ -80,10 +80,14 @@ /** * Returns all glyphs. This method can be very slow. + * + * @throws IOException If there is an error reading the data. */ public GlyphData[] getGlyphs() throws IOException { - synchronized (font) + // PDFBOX-4219: synchronize on data because it is accessed by several threads + // when PDFBox is accessing a standard 14 font for the first time + synchronized (data) { // the glyph offsets long[] offsets = loca.getOffsets(); @@ -157,7 +161,9 @@ return glyphs[gid]; } - synchronized (font) + // PDFBOX-4219: synchronize on data because it is accessed by several threads + // when PDFBox is accessing a standard 14 font for the first time + synchronized (data) { // read a single glyph long[] offsets = loca.getOffsets(); diff -Nru libpdfbox2-java-2.0.9/fontbox/src/main/java/org/apache/fontbox/ttf/RAFDataStream.java libpdfbox2-java-2.0.13/fontbox/src/main/java/org/apache/fontbox/ttf/RAFDataStream.java --- libpdfbox2-java-2.0.9/fontbox/src/main/java/org/apache/fontbox/ttf/RAFDataStream.java 2018-03-20 16:19:48.000000000 +0000 +++ libpdfbox2-java-2.0.13/fontbox/src/main/java/org/apache/fontbox/ttf/RAFDataStream.java 2018-11-28 17:18:34.000000000 +0000 @@ -96,8 +96,11 @@ @Override public void close() throws IOException { - raf.close(); - raf = null; + if (raf != null) + { + raf.close(); + raf = null; + } } /** diff -Nru libpdfbox2-java-2.0.9/fontbox/src/main/java/org/apache/fontbox/ttf/TrueTypeFont.java libpdfbox2-java-2.0.13/fontbox/src/main/java/org/apache/fontbox/ttf/TrueTypeFont.java --- libpdfbox2-java-2.0.9/fontbox/src/main/java/org/apache/fontbox/ttf/TrueTypeFont.java 2018-03-20 16:19:46.000000000 +0000 +++ libpdfbox2-java-2.0.13/fontbox/src/main/java/org/apache/fontbox/ttf/TrueTypeFont.java 2018-11-28 17:18:34.000000000 +0000 @@ -343,12 +343,17 @@ */ void readTable(TTFTable table) throws IOException { - // save current position - long currentPosition = data.getCurrentPosition(); - data.seek(table.getOffset()); - table.read(this, data); - // restore current position - data.seek(currentPosition); + // PDFBOX-4219: synchronize on data because it is accessed by several threads + // when PDFBox is accessing a standard 14 font for the first time + synchronized (data) + { + // save current position + long currentPosition = data.getCurrentPosition(); + data.seek(table.getOffset()); + table.read(this, data); + // restore current position + data.seek(currentPosition); + } } /** diff -Nru libpdfbox2-java-2.0.9/fontbox/src/main/java/org/apache/fontbox/util/autodetect/FontFileFinder.java libpdfbox2-java-2.0.13/fontbox/src/main/java/org/apache/fontbox/util/autodetect/FontFileFinder.java --- libpdfbox2-java-2.0.9/fontbox/src/main/java/org/apache/fontbox/util/autodetect/FontFileFinder.java 2018-03-20 16:19:48.000000000 +0000 +++ libpdfbox2-java-2.0.13/fontbox/src/main/java/org/apache/fontbox/util/autodetect/FontFileFinder.java 2018-11-28 17:18:34.000000000 +0000 @@ -48,16 +48,17 @@ { return new WindowsFontDirFinder(); } + else if (osName.startsWith("Mac")) + { + return new MacFontDirFinder(); + } + else if (osName.startsWith("OS/400")) + { + return new OS400FontDirFinder(); + } else { - if (osName.startsWith("Mac")) - { - return new MacFontDirFinder(); - } - else - { - return new UnixFontDirFinder(); - } + return new UnixFontDirFinder(); } } diff -Nru libpdfbox2-java-2.0.9/fontbox/src/main/java/org/apache/fontbox/util/autodetect/OS400FontDirFinder.java libpdfbox2-java-2.0.13/fontbox/src/main/java/org/apache/fontbox/util/autodetect/OS400FontDirFinder.java --- libpdfbox2-java-2.0.9/fontbox/src/main/java/org/apache/fontbox/util/autodetect/OS400FontDirFinder.java 1970-01-01 00:00:00.000000000 +0000 +++ libpdfbox2-java-2.0.13/fontbox/src/main/java/org/apache/fontbox/util/autodetect/OS400FontDirFinder.java 2018-11-28 17:18:34.000000000 +0000 @@ -0,0 +1,31 @@ +/* + * Copyright 2018 The Apache Software Foundation. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package org.apache.fontbox.util.autodetect; + +/** + * Font finder for OS/400 systems. + */ +public class OS400FontDirFinder extends NativeFontDirFinder +{ + @Override + protected String[] getSearchableDirectories() + { + return new String[] { System.getProperty("user.home") + "/.fonts", // user + "/QIBM/ProdData/OS400/Fonts" + }; + } +} diff -Nru libpdfbox2-java-2.0.9/fontbox/src/test/java/org/apache/fontbox/afm/AFMParserTest.java libpdfbox2-java-2.0.13/fontbox/src/test/java/org/apache/fontbox/afm/AFMParserTest.java --- libpdfbox2-java-2.0.9/fontbox/src/test/java/org/apache/fontbox/afm/AFMParserTest.java 1970-01-01 00:00:00.000000000 +0000 +++ libpdfbox2-java-2.0.13/fontbox/src/test/java/org/apache/fontbox/afm/AFMParserTest.java 2018-11-28 17:18:32.000000000 +0000 @@ -0,0 +1,44 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. + * The ASF licenses this file to You under the Apache License, Version 2.0 + * (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package org.apache.fontbox.afm; + +import java.io.ByteArrayInputStream; +import java.io.IOException; +import org.apache.fontbox.util.Charsets; +import org.junit.Assert; +import org.junit.Test; + +/** + * + * @author Tilman Hausherr + */ +public class AFMParserTest +{ + @Test + public void testEof() throws IOException + { + try + { + new AFMParser(new ByteArrayInputStream("huhu".getBytes(Charsets.US_ASCII))).parse(); + } + catch (IOException ex) + { + Assert.assertEquals("Error: The AFM file should start with StartFontMetrics and not 'huhu'", ex.getMessage()); + } + } +} diff -Nru libpdfbox2-java-2.0.9/fontbox/src/test/java/org/apache/fontbox/ttf/RAFDataStreamTest.java libpdfbox2-java-2.0.13/fontbox/src/test/java/org/apache/fontbox/ttf/RAFDataStreamTest.java --- libpdfbox2-java-2.0.9/fontbox/src/test/java/org/apache/fontbox/ttf/RAFDataStreamTest.java 1970-01-01 00:00:00.000000000 +0000 +++ libpdfbox2-java-2.0.13/fontbox/src/test/java/org/apache/fontbox/ttf/RAFDataStreamTest.java 2018-11-28 17:18:32.000000000 +0000 @@ -0,0 +1,40 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. + * The ASF licenses this file to You under the Apache License, Version 2.0 + * (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.apache.fontbox.ttf; + +import java.io.IOException; +import org.junit.Test; + +/** + * + * @author Tilman Hausherr + */ +public class RAFDataStreamTest +{ + /** + * Test of PDFBOX-4242: make sure that the Closeable.close() contract is fulfilled. + * + * @throws IOException + */ + @Test + public void testDoubleClose() throws IOException + { + RAFDataStream raf = new RAFDataStream("src/test/resources/ttf/LiberationSans-Regular.ttf", "r"); + raf.close(); + raf.close(); + } +} Binary files /tmp/tmpAhqVVB/umSeuAuTn3/libpdfbox2-java-2.0.9/fontbox/src/test/resources/ttf/Lohit-Bengali.ttf and /tmp/tmpAhqVVB/Y0XihoDyIA/libpdfbox2-java-2.0.13/fontbox/src/test/resources/ttf/Lohit-Bengali.ttf differ diff -Nru libpdfbox2-java-2.0.9/parent/pom.xml libpdfbox2-java-2.0.13/parent/pom.xml --- libpdfbox2-java-2.0.9/parent/pom.xml 2018-03-20 16:19:42.000000000 +0000 +++ libpdfbox2-java-2.0.13/parent/pom.xml 2018-11-28 17:18:40.000000000 +0000 @@ -23,13 +23,17 @@ org.apache apache - 16 + + + 19 + org.apache.pdfbox pdfbox-parent - 2.0.9 + 2.0.13 pom PDFBox parent @@ -39,7 +43,7 @@ The Apache Software Foundation http://pdfbox.apache.org - + jira https://issues.apache.org/jira/browse/PDFBOX @@ -48,11 +52,9 @@ UTF-8 UTF-8 + + 1.60 - - - 3.0.0 - @@ -70,46 +72,41 @@ commons-io commons-io - 2.4 + 2.6 test org.bouncycastle bcprov-jdk15on - 1.54 + ${bouncycastle.version} org.bouncycastle bcmail-jdk15on - 1.54 + ${bouncycastle.version} org.bouncycastle bcpkix-jdk15on - 1.54 - - - log4j - log4j - 1.2.17 + ${bouncycastle.version} org.apache.pdfbox jbig2-imageio - 3.0.0 + 3.0.2 test - com.github.jai-imageio jai-imageio-core - 1.3.1 + 1.4.0 test - + com.github.jai-imageio jai-imageio-jpeg2000 @@ -123,11 +120,41 @@ jdk9 + + + [9,10] + --add-modules java.activation --add-modules java.xml.bind + + + jdk11 + + [11,) + + + + + javax.xml.bind + jaxb-api + 2.3.1 + + + javax.activation + activation + 1.1.1 + + + + + pedantic @@ -146,7 +173,7 @@ org.owasp dependency-check-maven - 3.1.1 + 3.3.3 true @@ -166,6 +193,23 @@ + maven-enforcer-plugin + + + + enforce + + + + + 3.0.0 + + + + + + + maven-compiler-plugin true @@ -179,10 +223,11 @@ 1.6 - http://download.oracle.com/javase/1.6.0/docs/api/ + https://docs.oracle.com/javase/6/docs/api/ UTF-8 true + en @@ -221,7 +266,7 @@ org.codehaus.mojo animal-sniffer-maven-plugin - 1.14 + 1.17 check-java-version @@ -238,14 +283,24 @@ - + + + com.googlecode.maven-download-plugin + download-maven-plugin + 1.3.0 + + + com.googlecode.maven-download-plugin + + maven-download-plugin + 1.1.0 + org.apache.rat apache-rat-plugin - 0.11 release.properties @@ -258,6 +313,11 @@ 2.5.4 + + + maven-surefire-plugin + 2.22.1 + @@ -428,8 +488,8 @@ - scm:svn:http://svn.apache.org/repos/asf/maven/pom/tags/2.0.9/pdfbox-parent - scm:svn:https://svn.apache.org/repos/asf/maven/pom/tags/2.0.9/pdfbox-parent - http://svn.apache.org/viewvc/maven/pom/tags/2.0.9/pdfbox-parent + scm:svn:http://svn.apache.org/repos/asf/maven/pom/tags/2.0.13/pdfbox-parent + scm:svn:https://svn.apache.org/repos/asf/maven/pom/tags/2.0.13/pdfbox-parent + http://svn.apache.org/viewvc/maven/pom/tags/2.0.13/pdfbox-parent diff -Nru libpdfbox2-java-2.0.9/pdfbox/pom.xml libpdfbox2-java-2.0.13/pdfbox/pom.xml --- libpdfbox2-java-2.0.9/pdfbox/pom.xml 2018-03-20 16:19:52.000000000 +0000 +++ libpdfbox2-java-2.0.13/pdfbox/pom.xml 2018-11-28 17:18:38.000000000 +0000 @@ -23,7 +23,7 @@ org.apache.pdfbox pdfbox-parent - 2.0.9 + 2.0.13 ../parent/pom.xml @@ -184,7 +184,6 @@ com.googlecode.maven-download-plugin download-maven-plugin - 1.3.0 PDFBOX-3208 @@ -393,6 +392,92 @@ 8eafe21ffa6f3d7d0a50e9f4e5bcdeb727e804b552d74e65b709e778c9ed4605e5aa63743be285f0bc17ad162768583fec4196e1d1146d98f8703359247f22d0 + + PDFBOX-4197 + generate-test-resources + + wget + + + https://issues.apache.org/jira/secure/attachment/12919726/sample.pdf + ${project.build.directory}/pdfs + PDFBOX-4197.pdf + 6fefc869dff9db8cd539db177d35beeacc62304173245742eaee8882dab330860a31cbbd4c4ec6cc724603cc453afc07ec61361fbc1e80a47f44b04ccfbaf40d + + + + PDFBOX-4184 + generate-test-resources + + wget + + + https://issues.apache.org/jira/secure/attachment/12949710/032163.jpg + + ${project.build.directory}/imgs + PDFBOX-4184-032163.jpg + 35241c979d3808ca9d2641b5ec5e40637132b313f75070faca8b8f6d00ddce394070414236db3993f1092fe3bc16995750d528b6d803a7851423c14c308ccdde + + + + PDFBOX-4184-2 + generate-test-resources + + wget + + + https://issues.apache.org/jira/secure/attachment/12929821/16bit.png + + ${project.build.directory}/imgs + PDFBOX-4184-16bit.png + 45f148913590ea1a94c3ac17080969b74e579fe51967a5bf535caa3f7104ea81ee222b99deb8ee528b0a53640f97d87cf668633a1bdd61a62092246df1807471 + + + + PDFBOX-4308 + generate-test-resources + + wget + + + https://issues.apache.org/jira/secure/attachment/12938094/Quelldatei.pdf + ${project.build.directory}/pdfs + PDFBOX-4308.pdf + 566346239d51f10b2ccfc435620e8f3b0281e91286983cb86660060a8d48777998eab46dfda93d35024e7e4b50b7ab6654f9a1002524163d228a5e41a80a1221 + + + + PDFBOX-4338 + generate-test-resources + + wget + + + https://issues.apache.org/jira/secure/attachment/12943502/ArrayIndexOutOfBoundsException%20COSParser + ${project.build.directory}/pdfs + PDFBOX-4338.pdf + 130fa4b49345410b203613f3e67263f483f9a9797bef22322647655bb55cc55bcb1d1e0eb03c27f6f2855b3823675b27e8899d8eeb880d27a74fad5f60f23b47 + + + + PDFBOX-4339 + generate-test-resources + + wget + + + https://issues.apache.org/jira/secure/attachment/12943503/NullPointerException%20COSParser + ${project.build.directory}/pdfs + PDFBOX-4339.pdf + 2e48aeae83ef6fc4c5f95aafdfe8c76dd8d2dcf3516701c70ffeb14f06ba246a17c21f2dadf8fa48bccef5b72daffdd30ed7c9aa7f5183ddf889968caa2ded6a + + diff -Nru libpdfbox2-java-2.0.9/pdfbox/src/main/java/org/apache/pdfbox/contentstream/PDFStreamEngine.java libpdfbox2-java-2.0.13/pdfbox/src/main/java/org/apache/pdfbox/contentstream/PDFStreamEngine.java --- libpdfbox2-java-2.0.9/pdfbox/src/main/java/org/apache/pdfbox/contentstream/PDFStreamEngine.java 2018-03-20 16:19:48.000000000 +0000 +++ libpdfbox2-java-2.0.13/pdfbox/src/main/java/org/apache/pdfbox/contentstream/PDFStreamEngine.java 2018-11-28 17:18:38.000000000 +0000 @@ -118,7 +118,7 @@ } /** - * Initialises the stream engine for the given page. + * Initializes the stream engine for the given page. */ private void initPage(PDPage page) { @@ -136,7 +136,7 @@ } /** - * This will initialise and process the contents of the stream. + * This will initialize and process the contents of the stream. * * @param page the page to process * @throws IOException if there is an error accessing the stream @@ -1008,7 +1008,8 @@ } /** - * @return the stream' resources. + * @return the stream' resources. This is mainly to be used by the {@link OperatorProcessor} + * classes. */ public PDResources getResources() { diff -Nru libpdfbox2-java-2.0.9/pdfbox/src/main/java/org/apache/pdfbox/cos/COSArray.java libpdfbox2-java-2.0.13/pdfbox/src/main/java/org/apache/pdfbox/cos/COSArray.java --- libpdfbox2-java-2.0.9/pdfbox/src/main/java/org/apache/pdfbox/cos/COSArray.java 2018-03-20 16:19:48.000000000 +0000 +++ libpdfbox2-java-2.0.13/pdfbox/src/main/java/org/apache/pdfbox/cos/COSArray.java 2018-11-28 17:18:36.000000000 +0000 @@ -534,9 +534,11 @@ public float[] toFloatArray() { float[] retval = new float[size()]; - for( int i=0; i filters; private final COSDictionary parameters; - // todo: this is an in-memory buffer, should use scratch file (if any) instead - private ByteArrayOutputStream buffer = new ByteArrayOutputStream(); - + private final ScratchFile scratchFile; + private RandomAccess buffer; + /** * Creates a new COSOutputStream writes to an encoded COS stream. * * @param filters Filters to apply. * @param parameters Filter parameters. * @param output Encoded stream. - * @param scratchFile Scratch file to use, or null. + * @param scratchFile Scratch file to use. + * + * @throws IOException If there was an error creating a temporary buffer */ COSOutputStream(List filters, COSDictionary parameters, OutputStream output, - ScratchFile scratchFile) + ScratchFile scratchFile) throws IOException { super(output); this.filters = filters; this.parameters = parameters; + this.scratchFile = scratchFile; + + if (filters.isEmpty()) + { + this.buffer = null; + } + else + { + this.buffer = scratchFile.createBuffer(); + } } @Override public void write(byte[] b) throws IOException { - buffer.write(b); + if (buffer != null) + { + buffer.write(b); + } + else + { + super.write(b); + } } @Override public void write(byte[] b, int off, int len) throws IOException { - buffer.write(b, off, len); + if (buffer != null) + { + buffer.write(b, off, len); + } + else + { + super.write(b, off, len); + } } @Override public void write(int b) throws IOException { - buffer.write(b); + if (buffer != null) + { + buffer.write(b); + } + else + { + super.write(b); + } } @Override public void flush() throws IOException { } - + @Override public void close() throws IOException { - if (buffer == null) - { - return; + try { + if (buffer != null) + { + try + { + // apply filters in reverse order + for (int i = filters.size() - 1; i >= 0; i--) + { + InputStream unfilteredIn = new RandomAccessInputStream(buffer); + try + { + if (i == 0) + { + /* + * The last filter to run can encode directly to the enclosed output + * stream. + */ + filters.get(i).encode(unfilteredIn, out, parameters, i); + } + else + { + RandomAccess filteredBuffer = scratchFile.createBuffer(); + try + { + OutputStream filteredOut = new RandomAccessOutputStream(filteredBuffer); + try + { + filters.get(i).encode(unfilteredIn, filteredOut, parameters, i); + } + finally + { + filteredOut.close(); + } + + RandomAccess tmpSwap = filteredBuffer; + filteredBuffer = buffer; + buffer = tmpSwap; + } + finally + { + filteredBuffer.close(); + } + } + } + finally + { + unfilteredIn.close(); + } + } + } + finally + { + buffer.close(); + buffer = null; + } + } } - // apply filters in reverse order - for (int i = filters.size() - 1; i >= 0; i--) + finally { - // todo: this is an in-memory buffer, should use scratch file (if any) instead - ByteArrayInputStream input = new ByteArrayInputStream(buffer.toByteArray()); - buffer = new ByteArrayOutputStream(); - filters.get(i).encode(input, buffer, parameters, i); - } - // flush the entire stream - out.write(buffer.toByteArray()); - super.close(); - buffer = null; + super.close(); + } } } diff -Nru libpdfbox2-java-2.0.9/pdfbox/src/main/java/org/apache/pdfbox/cos/package.html libpdfbox2-java-2.0.13/pdfbox/src/main/java/org/apache/pdfbox/cos/package.html --- libpdfbox2-java-2.0.9/pdfbox/src/main/java/org/apache/pdfbox/cos/package.html 2018-03-20 16:19:48.000000000 +0000 +++ libpdfbox2-java-2.0.13/pdfbox/src/main/java/org/apache/pdfbox/cos/package.html 2018-11-28 17:18:36.000000000 +0000 @@ -21,7 +21,7 @@ These are the low level objects that make up a PDF document. -

+

See the PDF Reference 1.4. diff -Nru libpdfbox2-java-2.0.9/pdfbox/src/main/java/org/apache/pdfbox/filter/ASCIIHexFilter.java libpdfbox2-java-2.0.13/pdfbox/src/main/java/org/apache/pdfbox/filter/ASCIIHexFilter.java --- libpdfbox2-java-2.0.9/pdfbox/src/main/java/org/apache/pdfbox/filter/ASCIIHexFilter.java 2018-03-20 16:19:50.000000000 +0000 +++ libpdfbox2-java-2.0.13/pdfbox/src/main/java/org/apache/pdfbox/filter/ASCIIHexFilter.java 2018-11-28 17:18:38.000000000 +0000 @@ -45,7 +45,22 @@ /* 70 */ 15, -1, -1, -1, -1, -1, -1, -1, -1, -1, /* 80 */ -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, /* 90 */ -1, -1, -1, -1, -1, -1, -1, 10, 11, 12, - /* 100 */ 13, 14, 15 + /* 100 */ 13, 14, 15, -1, -1, -1, -1, -1, -1, -1, + /* 110 */ -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, + /* 120 */ -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, + /* 130 */ -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, + /* 140 */ -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, + /* 150 */ -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, + /* 160 */ -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, + /* 170 */ -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, + /* 180 */ -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, + /* 190 */ -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, + /* 200 */ -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, + /* 210 */ -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, + /* 220 */ -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, + /* 230 */ -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, + /* 240 */ -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, + /* 250 */ -1, -1, -1, -1, -1, -1 }; @Override diff -Nru libpdfbox2-java-2.0.9/pdfbox/src/main/java/org/apache/pdfbox/filter/CCITTFaxDecoderStream.java libpdfbox2-java-2.0.13/pdfbox/src/main/java/org/apache/pdfbox/filter/CCITTFaxDecoderStream.java --- libpdfbox2-java-2.0.9/pdfbox/src/main/java/org/apache/pdfbox/filter/CCITTFaxDecoderStream.java 2018-03-20 16:19:50.000000000 +0000 +++ libpdfbox2-java-2.0.13/pdfbox/src/main/java/org/apache/pdfbox/filter/CCITTFaxDecoderStream.java 2018-11-28 17:18:38.000000000 +0000 @@ -258,7 +258,7 @@ private void decodeRowType4() throws IOException { if(optionByteAligned) { - bufferPos = -1; // Skip remaining bits and fetch the next byte at row start + resetBuffer(); } eof: while (true) { // read till next EOL code @@ -287,7 +287,7 @@ private void decodeRowType6() throws IOException { if(optionByteAligned) { - bufferPos = -1; // Skip remaining bits and fetch the next byte at row start + resetBuffer(); } decode2D(); } @@ -383,17 +383,7 @@ } private void resetBuffer() throws IOException { - for (int i = 0; i < decodedRow.length; i++) { - decodedRow[i] = 0; - } - - while (true) { - if (bufferPos == -1) { - return; - } - - readBit(); - } + bufferPos = -1; } int buffer = -1; diff -Nru libpdfbox2-java-2.0.9/pdfbox/src/main/java/org/apache/pdfbox/filter/Filter.java libpdfbox2-java-2.0.13/pdfbox/src/main/java/org/apache/pdfbox/filter/Filter.java --- libpdfbox2-java-2.0.9/pdfbox/src/main/java/org/apache/pdfbox/filter/Filter.java 2018-03-20 16:19:50.000000000 +0000 +++ libpdfbox2-java-2.0.13/pdfbox/src/main/java/org/apache/pdfbox/filter/Filter.java 2018-11-28 17:18:38.000000000 +0000 @@ -123,7 +123,11 @@ COSArray array = (COSArray)obj; if (index < array.size()) { - return (COSDictionary)array.getObject(index); + COSBase objAtIndex = array.getObject(index); + if (objAtIndex instanceof COSDictionary) + { + return (COSDictionary)array.getObject(index); + } } } else if (obj != null && !(filter instanceof COSArray || obj instanceof COSArray)) @@ -161,4 +165,20 @@ return reader; } + /** + * @return the ZIP compression level configured for PDFBox + */ + public static int getCompressionLevel() + { + int compressionLevel = Deflater.DEFAULT_COMPRESSION; + try + { + compressionLevel = Integer.parseInt(System.getProperty(Filter.SYSPROP_DEFLATELEVEL, "-1")); + } + catch (NumberFormatException ex) + { + LOG.warn(ex.getMessage(), ex); + } + return Math.max(-1, Math.min(Deflater.BEST_COMPRESSION, compressionLevel)); + } } diff -Nru libpdfbox2-java-2.0.9/pdfbox/src/main/java/org/apache/pdfbox/filter/FlateFilter.java libpdfbox2-java-2.0.13/pdfbox/src/main/java/org/apache/pdfbox/filter/FlateFilter.java --- libpdfbox2-java-2.0.9/pdfbox/src/main/java/org/apache/pdfbox/filter/FlateFilter.java 2018-03-20 16:19:50.000000000 +0000 +++ libpdfbox2-java-2.0.13/pdfbox/src/main/java/org/apache/pdfbox/filter/FlateFilter.java 2018-11-28 17:18:38.000000000 +0000 @@ -16,8 +16,6 @@ */ package org.apache.pdfbox.filter; -import java.io.ByteArrayInputStream; -import java.io.ByteArrayOutputStream; import java.io.IOException; import java.io.InputStream; import java.io.OutputStream; @@ -28,7 +26,6 @@ import org.apache.commons.logging.Log; import org.apache.commons.logging.LogFactory; import org.apache.pdfbox.cos.COSDictionary; -import org.apache.pdfbox.cos.COSName; /** * Decompresses data encoded using the zlib/deflate compression method, @@ -46,34 +43,12 @@ public DecodeResult decode(InputStream encoded, OutputStream decoded, COSDictionary parameters, int index) throws IOException { - int predictor = -1; - final COSDictionary decodeParams = getDecodeParams(parameters, index); - if (decodeParams != null) - { - predictor = decodeParams.getInt(COSName.PREDICTOR); - } try { - if (predictor > 1) - { - int colors = Math.min(decodeParams.getInt(COSName.COLORS, 1), 32); - int bitsPerPixel = decodeParams.getInt(COSName.BITS_PER_COMPONENT, 8); - int columns = decodeParams.getInt(COSName.COLUMNS, 1); - ByteArrayOutputStream baos = new ByteArrayOutputStream(); - decompress(encoded, baos); - ByteArrayInputStream bais = new ByteArrayInputStream(baos.toByteArray()); - Predictor.decodePredictor(predictor, colors, bitsPerPixel, columns, bais, decoded); - decoded.flush(); - baos.reset(); - bais.reset(); - } - else - { - decompress(encoded, decoded); - } - } + decompress(encoded, Predictor.wrapPredictor(decoded, decodeParams)); + } catch (DataFormatException e) { // if the stream is corrupt a DataFormatException may occur @@ -98,7 +73,7 @@ // use nowrap mode to bypass zlib-header and checksum to avoid a DataFormatException Inflater inflater = new Inflater(true); inflater.setInput(buf,0,read); - byte[] res = new byte[1024]; + byte[] res = new byte[1024]; boolean dataWritten = false; while (true) { @@ -143,16 +118,7 @@ protected void encode(InputStream input, OutputStream encoded, COSDictionary parameters) throws IOException { - int compressionLevel = Deflater.DEFAULT_COMPRESSION; - try - { - compressionLevel = Integer.parseInt(System.getProperty(Filter.SYSPROP_DEFLATELEVEL, "-1")); - } - catch (NumberFormatException ex) - { - LOG.warn(ex.getMessage(), ex); - } - compressionLevel = Math.max(-1, Math.min(Deflater.BEST_COMPRESSION, compressionLevel)); + int compressionLevel = getCompressionLevel(); Deflater deflater = new Deflater(compressionLevel); DeflaterOutputStream out = new DeflaterOutputStream(encoded, deflater); int amountRead; @@ -167,5 +133,6 @@ } out.close(); encoded.flush(); + deflater.end(); } } diff -Nru libpdfbox2-java-2.0.9/pdfbox/src/main/java/org/apache/pdfbox/filter/JPXFilter.java libpdfbox2-java-2.0.13/pdfbox/src/main/java/org/apache/pdfbox/filter/JPXFilter.java --- libpdfbox2-java-2.0.9/pdfbox/src/main/java/org/apache/pdfbox/filter/JPXFilter.java 2018-03-20 16:19:50.000000000 +0000 +++ libpdfbox2-java-2.0.13/pdfbox/src/main/java/org/apache/pdfbox/filter/JPXFilter.java 2018-11-28 17:18:38.000000000 +0000 @@ -16,11 +16,14 @@ */ package org.apache.pdfbox.filter; +import java.awt.color.ColorSpace; import java.awt.image.BufferedImage; import java.awt.image.DataBuffer; import java.awt.image.DataBufferByte; import java.awt.image.DataBufferUShort; -import java.awt.image.WritableRaster; +import java.awt.image.IndexColorModel; +import java.awt.image.MultiPixelPackedSampleModel; +import java.awt.image.Raster; import java.io.IOException; import java.io.InputStream; import java.io.OutputStream; @@ -49,6 +52,9 @@ */ public final class JPXFilter extends Filter { + /** + * {@inheritDoc} + */ @Override public DecodeResult decode(InputStream encoded, OutputStream decoded, COSDictionary parameters, int index, DecodeOptions options) throws IOException @@ -57,7 +63,7 @@ result.getParameters().addAll(parameters); BufferedImage image = readJPX(encoded, options, result); - WritableRaster raster = image.getRaster(); + Raster raster = image.getRaster(); switch (raster.getDataBuffer().getDataType()) { case DataBuffer.TYPE_BYTE: @@ -74,6 +80,23 @@ } return result; + case DataBuffer.TYPE_INT: + // not yet used (as of October 2018) but works as fallback + // if we decide to convert to BufferedImage.TYPE_INT_RGB + int[] ar = new int[raster.getNumBands()]; + for (int y = 0; y < image.getHeight(); ++y) + { + for (int x = 0; x < image.getWidth(); ++x) + { + raster.getPixel(x, y, ar); + for (int i = 0; i < ar.length; ++i) + { + decoded.write(ar[i]); + } + } + } + return result; + default: throw new IOException("Data type " + raster.getDataBuffer().getDataType() + " not implemented"); } @@ -136,7 +159,21 @@ // extract embedded color space if (!parameters.containsKey(COSName.COLORSPACE)) { - result.setColorSpace(new PDJPXColorSpace(image.getColorModel().getColorSpace())); + if (image.getSampleModel() instanceof MultiPixelPackedSampleModel && + image.getColorModel().getPixelSize() == 1 && + image.getRaster().getNumBands() == 1 && + image.getColorModel() instanceof IndexColorModel) + { + // PDFBOX-4326: + // force CS_GRAY colorspace because colorspace in IndexColorModel + // has 3 colors despite that there is only 1 color per pixel + // in raster + result.setColorSpace(new PDJPXColorSpace(ColorSpace.getInstance(ColorSpace.CS_GRAY))); + } + else + { + result.setColorSpace(new PDJPXColorSpace(image.getColorModel().getColorSpace())); + } } return image; @@ -151,6 +188,9 @@ } } + /** + * {@inheritDoc} + */ @Override protected void encode(InputStream input, OutputStream encoded, COSDictionary parameters) throws IOException diff -Nru libpdfbox2-java-2.0.9/pdfbox/src/main/java/org/apache/pdfbox/filter/LZWFilter.java libpdfbox2-java-2.0.13/pdfbox/src/main/java/org/apache/pdfbox/filter/LZWFilter.java --- libpdfbox2-java-2.0.9/pdfbox/src/main/java/org/apache/pdfbox/filter/LZWFilter.java 2018-03-20 16:19:50.000000000 +0000 +++ libpdfbox2-java-2.0.13/pdfbox/src/main/java/org/apache/pdfbox/filter/LZWFilter.java 2018-11-28 17:18:38.000000000 +0000 @@ -15,8 +15,6 @@ */ package org.apache.pdfbox.filter; -import java.io.ByteArrayInputStream; -import java.io.ByteArrayOutputStream; import java.io.EOFException; import java.io.IOException; import java.io.InputStream; @@ -67,37 +65,15 @@ public DecodeResult decode(InputStream encoded, OutputStream decoded, COSDictionary parameters, int index) throws IOException { - int predictor = -1; - int earlyChange = 1; - COSDictionary decodeParams = getDecodeParams(parameters, index); - if (decodeParams != null) - { - predictor = decodeParams.getInt(COSName.PREDICTOR); - earlyChange = decodeParams.getInt(COSName.EARLY_CHANGE, 1); - if (earlyChange != 0 && earlyChange != 1) - { - earlyChange = 1; - } - } - if (predictor > 1) - { - @SuppressWarnings("null") - int colors = Math.min(decodeParams.getInt(COSName.COLORS, 1), 32); - int bitsPerPixel = decodeParams.getInt(COSName.BITS_PER_COMPONENT, 8); - int columns = decodeParams.getInt(COSName.COLUMNS, 1); - ByteArrayOutputStream baos = new ByteArrayOutputStream(); - doLZWDecode(encoded, baos, earlyChange); - ByteArrayInputStream bais = new ByteArrayInputStream(baos.toByteArray()); - Predictor.decodePredictor(predictor, colors, bitsPerPixel, columns, bais, decoded); - decoded.flush(); - baos.reset(); - bais.reset(); - } - else + int earlyChange = decodeParams.getInt(COSName.EARLY_CHANGE, 1); + + if (earlyChange != 0 && earlyChange != 1) { - doLZWDecode(encoded, decoded, earlyChange); + earlyChange = 1; } + + doLZWDecode(encoded, Predictor.wrapPredictor(decoded, decodeParams), earlyChange); return new DecodeResult(parameters); } diff -Nru libpdfbox2-java-2.0.9/pdfbox/src/main/java/org/apache/pdfbox/filter/Predictor.java libpdfbox2-java-2.0.13/pdfbox/src/main/java/org/apache/pdfbox/filter/Predictor.java --- libpdfbox2-java-2.0.9/pdfbox/src/main/java/org/apache/pdfbox/filter/Predictor.java 2018-03-20 16:19:50.000000000 +0000 +++ libpdfbox2-java-2.0.13/pdfbox/src/main/java/org/apache/pdfbox/filter/Predictor.java 2018-11-28 17:18:38.000000000 +0000 @@ -15,10 +15,14 @@ */ package org.apache.pdfbox.filter; +import java.io.FilterOutputStream; import java.io.IOException; import java.io.InputStream; import java.io.OutputStream; +import java.util.Arrays; +import org.apache.pdfbox.cos.COSDictionary; +import org.apache.pdfbox.cos.COSName; import org.apache.pdfbox.io.IOUtils; /** @@ -31,6 +35,173 @@ private Predictor() { } + + /** + * Decodes a single line of data in-place. + * @param predictor Predictor value for the current line + * @param colors Number of color components, from decode parameters. + * @param bitsPerComponent Number of bits per components, from decode parameters. + * @param columns Number samples in a row, from decode parameters. + * @param actline Current (active) line to decode. Data will be decoded in-place, + * i.e. - the contents of this buffer will be modified. + * @param lastline The previous decoded line. When decoding the first line, this + * parameter should be an empty byte array of the same length as + * actline. + */ + static void decodePredictorRow(int predictor, int colors, int bitsPerComponent, int columns, byte[] actline, byte[] lastline) + { + if (predictor == 1) + { + // no prediction + return; + } + final int bitsPerPixel = colors * bitsPerComponent; + final int bytesPerPixel = (bitsPerPixel + 7) / 8; + final int rowlength = actline.length; + switch (predictor) + { + case 2: + // PRED TIFF SUB + if (bitsPerComponent == 8) + { + // for 8 bits per component it is the same algorithm as PRED SUB of PNG format + for (int p = bytesPerPixel; p < rowlength; p++) + { + int sub = actline[p] & 0xff; + int left = actline[p - bytesPerPixel] & 0xff; + actline[p] = (byte) (sub + left); + } + break; + } + if (bitsPerComponent == 16) + { + for (int p = bytesPerPixel; p < rowlength; p += 2) + { + int sub = ((actline[p] & 0xff) << 8) + (actline[p + 1] & 0xff); + int left = (((actline[p - bytesPerPixel] & 0xff) << 8) + + (actline[p - bytesPerPixel + 1] & 0xff)); + actline[p] = (byte) (((sub + left) >> 8) & 0xff); + actline[p + 1] = (byte) ((sub + left) & 0xff); + } + break; + } + if (bitsPerComponent == 1 && colors == 1) + { + // bytesPerPixel cannot be used: + // "A row shall occupy a whole number of bytes, rounded up if necessary. + // Samples and their components shall be packed into bytes + // from high-order to low-order bits." + for (int p = 0; p < rowlength; p++) + { + for (int bit = 7; bit >= 0; --bit) + { + int sub = (actline[p] >> bit) & 1; + if (p == 0 && bit == 7) + { + continue; + } + int left; + if (bit == 7) + { + // use bit #0 from previous byte + left = actline[p - 1] & 1; + } + else + { + // use "previous" bit + left = (actline[p] >> (bit + 1)) & 1; + } + if (((sub + left) & 1) == 0) + { + // reset bit + actline[p] = (byte) (actline[p] & ~(1 << bit)); + } + else + { + // set bit + actline[p] = (byte) (actline[p] | (1 << bit)); + } + } + } + break; + } + // everything else, i.e. bpc 2 and 4, but has been tested for bpc 1 and 8 too + int elements = columns * colors; + for (int p = colors; p < elements; ++p) + { + int bytePosSub = p * bitsPerComponent / 8; + int bitPosSub = 8 - p * bitsPerComponent % 8 - bitsPerComponent; + int bytePosLeft = (p - colors) * bitsPerComponent / 8; + int bitPosLeft = 8 - (p - colors) * bitsPerComponent % 8 - bitsPerComponent; + + int sub = getBitSeq(actline[bytePosSub], bitPosSub, bitsPerComponent); + int left = getBitSeq(actline[bytePosLeft], bitPosLeft, bitsPerComponent); + actline[bytePosSub] = (byte) calcSetBitSeq(actline[bytePosSub], bitPosSub, bitsPerComponent, sub + left); + } + break; + case 10: + // PRED NONE + // do nothing + break; + case 11: + // PRED SUB + for (int p = bytesPerPixel; p < rowlength; p++) + { + int sub = actline[p]; + int left = actline[p - bytesPerPixel]; + actline[p] = (byte) (sub + left); + } + break; + case 12: + // PRED UP + for (int p = 0; p < rowlength; p++) + { + int up = actline[p] & 0xff; + int prior = lastline[p] & 0xff; + actline[p] = (byte) ((up + prior) & 0xff); + } + break; + case 13: + // PRED AVG + for (int p = 0; p < rowlength; p++) + { + int avg = actline[p] & 0xff; + int left = p - bytesPerPixel >= 0 ? actline[p - bytesPerPixel] & 0xff : 0; + int up = lastline[p] & 0xff; + actline[p] = (byte) ((avg + (left + up) / 2) & 0xff); + } + break; + case 14: + // PRED PAETH + for (int p = 0; p < rowlength; p++) + { + int paeth = actline[p] & 0xff; + int a = p - bytesPerPixel >= 0 ? actline[p - bytesPerPixel] & 0xff : 0;// left + int b = lastline[p] & 0xff;// upper + int c = p - bytesPerPixel >= 0 ? lastline[p - bytesPerPixel] & 0xff : 0;// upperleft + int value = a + b - c; + int absa = Math.abs(value - a); + int absb = Math.abs(value - b); + int absc = Math.abs(value - c); + + if (absa <= absb && absa <= absc) + { + actline[p] = (byte) ((paeth + a) & 0xff); + } + else if (absb <= absc) + { + actline[p] = (byte) ((paeth + b) & 0xff); + } + else + { + actline[p] = (byte) ((paeth + c) & 0xff); + } + } + break; + default: + break; + } + } static void decodePredictor(int predictor, int colors, int bitsPerComponent, int columns, InputStream in, OutputStream out) throws IOException @@ -43,9 +214,7 @@ else { // calculate sizes - final int bitsPerPixel = colors * bitsPerComponent; - final int bytesPerPixel = (bitsPerPixel + 7) / 8; - final int rowlength = (columns * bitsPerPixel + 7) / 8; + final int rowlength = calculateRowLength(colors, bitsPerComponent, columns); byte[] actline = new byte[rowlength]; byte[] lastline = new byte[rowlength]; @@ -74,155 +243,18 @@ offset += i; } - // do prediction as specified in PNG-Specification 1.2 - switch (linepredictor) - { - case 2: - // PRED TIFF SUB - if (bitsPerComponent == 8) - { - // for 8 bits per component it is the same algorithm as PRED SUB of PNG format - for (int p = bytesPerPixel; p < rowlength; p++) - { - int sub = actline[p] & 0xff; - int left = actline[p - bytesPerPixel] & 0xff; - actline[p] = (byte) (sub + left); - } - break; - } - if (bitsPerComponent == 16) - { - for (int p = bytesPerPixel; p < rowlength; p += 2) - { - int sub = ((actline[p] & 0xff) << 8) + (actline[p + 1] & 0xff); - int left = (((actline[p - bytesPerPixel] & 0xff) << 8) - + (actline[p - bytesPerPixel + 1] & 0xff)); - actline[p] = (byte) (((sub + left) >> 8) & 0xff); - actline[p + 1] = (byte) ((sub + left) & 0xff); - } - break; - } - if (bitsPerComponent == 1 && colors == 1) - { - // bytesPerPixel cannot be used: - // "A row shall occupy a whole number of bytes, rounded up if necessary. - // Samples and their components shall be packed into bytes - // from high-order to low-order bits." - for (int p = 0; p < rowlength; p++) - { - for (int bit = 7; bit >= 0; --bit) - { - int sub = (actline[p] >> bit) & 1; - if (p == 0 && bit == 7) - { - continue; - } - int left; - if (bit == 7) - { - // use bit #0 from previous byte - left = actline[p - 1] & 1; - } - else - { - // use "previous" bit - left = (actline[p] >> (bit + 1)) & 1; - } - if (((sub + left) & 1) == 0) - { - // reset bit - actline[p] = (byte) (actline[p] & ~(1 << bit)); - } - else - { - // set bit - actline[p] = (byte) (actline[p] | (1 << bit)); - } - } - } - break; - } - // everything else, i.e. bpc 2 and 4, but has been tested for bpc 1 and 8 too - int elements = columns * colors; - for (int p = colors; p < elements; ++p) - { - int bytePosSub = p * bitsPerComponent / 8; - int bitPosSub = 8 - p * bitsPerComponent % 8 - bitsPerComponent; - int bytePosLeft = (p - colors) * bitsPerComponent / 8; - int bitPosLeft = 8 - (p - colors) * bitsPerComponent % 8 - bitsPerComponent; - - int sub = getBitSeq(actline[bytePosSub], bitPosSub, bitsPerComponent); - int left = getBitSeq(actline[bytePosLeft], bitPosLeft, bitsPerComponent); - actline[bytePosSub] = (byte) calcSetBitSeq(actline[bytePosSub], bitPosSub, bitsPerComponent, sub + left); - } - break; - case 10: - // PRED NONE - // do nothing - break; - case 11: - // PRED SUB - for (int p = bytesPerPixel; p < rowlength; p++) - { - int sub = actline[p]; - int left = actline[p - bytesPerPixel]; - actline[p] = (byte) (sub + left); - } - break; - case 12: - // PRED UP - for (int p = 0; p < rowlength; p++) - { - int up = actline[p] & 0xff; - int prior = lastline[p] & 0xff; - actline[p] = (byte) ((up + prior) & 0xff); - } - break; - case 13: - // PRED AVG - for (int p = 0; p < rowlength; p++) - { - int avg = actline[p] & 0xff; - int left = p - bytesPerPixel >= 0 ? actline[p - bytesPerPixel] & 0xff : 0; - int up = lastline[p] & 0xff; - actline[p] = (byte) ((avg + (left + up) / 2) & 0xff); - } - break; - case 14: - // PRED PAETH - for (int p = 0; p < rowlength; p++) - { - int paeth = actline[p] & 0xff; - int a = p - bytesPerPixel >= 0 ? actline[p - bytesPerPixel] & 0xff : 0;// left - int b = lastline[p] & 0xff;// upper - int c = p - bytesPerPixel >= 0 ? lastline[p - bytesPerPixel] & 0xff : 0;// upperleft - int value = a + b - c; - int absa = Math.abs(value - a); - int absb = Math.abs(value - b); - int absc = Math.abs(value - c); - - if (absa <= absb && absa <= absc) - { - actline[p] = (byte) ((paeth + a) & 0xff); - } - else if (absb <= absc) - { - actline[p] = (byte) ((paeth + b) & 0xff); - } - else - { - actline[p] = (byte) ((paeth + c) & 0xff); - } - } - break; - default: - break; - } + decodePredictorRow(linepredictor, colors, bitsPerComponent, columns, actline, lastline); System.arraycopy(actline, 0, lastline, 0, rowlength); out.write(actline); } } } + + static int calculateRowLength(int colors, int bitsPerComponent, int columns) + { + final int bitsPerPixel = colors * bitsPerComponent; + return (columns * bitsPerPixel + 7) / 8; + } // get value from bit interval from a byte static int getBitSeq(int by, int startBit, int bitSize) @@ -240,4 +272,144 @@ return (by & mask) | (truncatedVal << startBit); } + /** + * Wraps and OutputStream in a predictor decoding stream as necessary. + * If no predictor is specified by the parameters, the original stream is returned as is. + * + * @param out The stream to which decoded data should be written + * @param decodeParams Decode parameters for the stream + * @return An OutputStream is returned, which will write decoded data + * into the given stream. If no predictor is specified, the original stream is returned. + */ + static OutputStream wrapPredictor(OutputStream out, COSDictionary decodeParams) + { + int predictor = decodeParams.getInt(COSName.PREDICTOR); + if (predictor > 1) + { + int colors = Math.min(decodeParams.getInt(COSName.COLORS, 1), 32); + int bitsPerPixel = decodeParams.getInt(COSName.BITS_PER_COMPONENT, 8); + int columns = decodeParams.getInt(COSName.COLUMNS, 1); + + return new PredictorOutputStream(out, predictor, colors, bitsPerPixel, columns); + } + else + { + return out; + } + } + + /** + * Output stream that implements predictor decoding. Data is buffered until a complete + * row is available, which is then decoded and written to the underlying stream. + * The previous row is retained for decoding the next row. + */ + private static final class PredictorOutputStream extends FilterOutputStream + { + // current predictor type + private int predictor; + // image decode parameters + private final int colors; + private final int bitsPerComponent; + private final int columns; + private final int rowLength; + // PNG predictor (predictor>=10) means every row has a (potentially different) + // predictor value + private final boolean predictorPerRow; + + // data buffers + private byte[] currentRow, lastRow; + // amount of data in the current row + private int currentRowData = 0; + // was the per-row predictor value read for the current row being processed + private boolean predictorRead = false; + + PredictorOutputStream(OutputStream out, int predictor, int colors, int bitsPerComponent, int columns) + { + super(out); + this.predictor = predictor; + this.colors = colors; + this.bitsPerComponent = bitsPerComponent; + this.columns = columns; + this.rowLength = calculateRowLength(colors, bitsPerComponent, columns); + this.predictorPerRow = predictor >= 10; + currentRow = new byte[rowLength]; + lastRow = new byte[rowLength]; + } + + @Override + public void write(byte[] bytes) throws IOException + { + write(bytes, 0, bytes.length); + } + + @Override + public void write(byte[] bytes, int off, int len) throws IOException + { + int currentOffset = off; + int maxOffset = currentOffset + len; + while (currentOffset < maxOffset) + { + if (predictorPerRow && currentRowData == 0 && !predictorRead) + { + // PNG predictor; each row starts with predictor type (0, 1, 2, 3, 4) + // read per line predictor, add 10 to tread value 0 as 10, 1 as 11, ... + predictor = bytes[currentOffset] + 10; + currentOffset++; + predictorRead = true; + } + else + { + int toRead = Math.min(rowLength - currentRowData, maxOffset - currentOffset); + System.arraycopy(bytes, currentOffset, currentRow, currentRowData, toRead); + currentRowData += toRead; + currentOffset += toRead; + + // current row is filled, decode it, write it to underlying stream, + // and reset the state. + if (currentRowData == currentRow.length) + { + decodeAndWriteRow(); + } + } + } + } + + private void decodeAndWriteRow() throws IOException + { + decodePredictorRow(predictor, colors, bitsPerComponent, columns, currentRow, lastRow); + out.write(currentRow); + flipRows(); + } + + /** + * Flips the row buffers (to avoid copying), and resets the current-row index + * and predictorRead flag + */ + private void flipRows() + { + byte[] temp = lastRow; + lastRow = currentRow; + currentRow = temp; + currentRowData = 0; + predictorRead = false; + } + + @Override + public void flush() throws IOException + { + // The last row is allowed to be incomplete, and should be completed with zeros. + if (currentRowData > 0) + { + Arrays.fill(currentRow, currentRowData, rowLength, (byte)0); + decodeAndWriteRow(); + } + super.flush(); + } + + @Override + public void write(int i) throws IOException + { + throw new UnsupportedOperationException("Not supported"); + } + } } diff -Nru libpdfbox2-java-2.0.9/pdfbox/src/main/java/org/apache/pdfbox/io/IOUtils.java libpdfbox2-java-2.0.13/pdfbox/src/main/java/org/apache/pdfbox/io/IOUtils.java --- libpdfbox2-java-2.0.9/pdfbox/src/main/java/org/apache/pdfbox/io/IOUtils.java 2018-03-20 16:19:48.000000000 +0000 +++ libpdfbox2-java-2.0.13/pdfbox/src/main/java/org/apache/pdfbox/io/IOUtils.java 2018-11-28 17:18:38.000000000 +0000 @@ -15,7 +15,7 @@ * limitations under the License. */ -/* $Id: IOUtils.java 1666014 2015-03-11 21:08:39Z tilman $ */ +/* $Id: IOUtils.java 1834594 2018-06-28 10:29:51Z msahyoun $ */ package org.apache.pdfbox.io; @@ -25,6 +25,8 @@ import java.io.InputStream; import java.io.OutputStream; +import org.apache.commons.logging.Log; + /** * This class contains various I/O-related methods. */ @@ -115,4 +117,32 @@ // ignore } } + + /** + * Try to close an IO resource and log and return if there was an exception. + * + *

An exception is only returned if the IOException passed in is null. + * + * @param closeable to be closed + * @param logger the logger to be used so that logging appears under that log instance + * @param resourceName the name to appear in the log output + * @param initialException to be closed + * @return the IOException is there was any but only if initialException is null + */ + public static IOException closeAndLogException(Closeable closeable, Log logger, String resourceName, IOException initialException) + { + try + { + closeable.close(); + } + catch (IOException ioe) + { + logger.warn("Error closing " + resourceName, ioe); + if (initialException == null) + { + return ioe; + } + } + return initialException; + } } diff -Nru libpdfbox2-java-2.0.9/pdfbox/src/main/java/org/apache/pdfbox/multipdf/LayerUtility.java libpdfbox2-java-2.0.13/pdfbox/src/main/java/org/apache/pdfbox/multipdf/LayerUtility.java --- libpdfbox2-java-2.0.9/pdfbox/src/main/java/org/apache/pdfbox/multipdf/LayerUtility.java 2018-03-20 16:19:48.000000000 +0000 +++ libpdfbox2-java-2.0.13/pdfbox/src/main/java/org/apache/pdfbox/multipdf/LayerUtility.java 2018-11-28 17:18:36.000000000 +0000 @@ -45,9 +45,9 @@ import org.apache.pdfbox.util.Matrix; /** - * This class allows to import pages as Form XObjects into a PDF file and use them to create - * layers (optional content groups). - * + * This class allows to import pages as Form XObjects into a document and use them to create layers + * (optional content groups). It should used only on loaded documents, not on generated documents + * because these can contain unfinished parts, e.g. font subsetting information. */ public class LayerUtility { diff -Nru libpdfbox2-java-2.0.9/pdfbox/src/main/java/org/apache/pdfbox/multipdf/Overlay.java libpdfbox2-java-2.0.13/pdfbox/src/main/java/org/apache/pdfbox/multipdf/Overlay.java --- libpdfbox2-java-2.0.9/pdfbox/src/main/java/org/apache/pdfbox/multipdf/Overlay.java 2018-03-20 16:19:48.000000000 +0000 +++ libpdfbox2-java-2.0.13/pdfbox/src/main/java/org/apache/pdfbox/multipdf/Overlay.java 2018-11-28 17:18:36.000000000 +0000 @@ -17,6 +17,7 @@ package org.apache.pdfbox.multipdf; import java.awt.geom.AffineTransform; +import java.io.Closeable; import java.io.File; import java.io.IOException; import java.io.InputStream; @@ -24,8 +25,10 @@ import java.math.BigDecimal; import java.util.ArrayList; import java.util.HashMap; +import java.util.HashSet; import java.util.List; import java.util.Map; +import java.util.Set; import org.apache.pdfbox.cos.COSArray; import org.apache.pdfbox.cos.COSBase; import org.apache.pdfbox.cos.COSDictionary; @@ -45,7 +48,7 @@ * Based on code contributed by Balazs Jerk. * */ -public class Overlay +public class Overlay implements Closeable { /** * Possible location of the overlayed pages: foreground or background. @@ -61,7 +64,7 @@ private LayoutPage oddPageOverlayPage; private LayoutPage evenPageOverlayPage; - private final Map specificPageOverlay = new HashMap(); + private final Set openDocuments = new HashSet(); private Map specificPageOverlayPage = new HashMap(); private Position position = Position.BACKGROUND; @@ -87,21 +90,22 @@ private String evenPageOverlayFilename = null; private PDDocument evenPageOverlay = null; - private int numberOfOverlayPages = 0; private boolean useAllOverlayPages = false; /** - * This will add overlays to a documents. - * - * @param specificPageOverlayFile map of overlay files for specific pages - * - * @return the resulting pdf, which has to be saved and closed be the caller - * + * This will add overlays to a document. + * + * @param specificPageOverlayFile map of overlay files for specific pages. The page numbers are + * 1-based. + * + * @return The modified input PDF document, which has to be saved and closed by the caller. If + * the input document was passed by {@link #setInputPDF(PDDocument) setInputPDF(PDDocument)} + * then it is that object that is returned. + * * @throws IOException if something went wrong */ - public PDDocument overlay(Map specificPageOverlayFile) - throws IOException + public PDDocument overlay(Map specificPageOverlayFile) throws IOException { Map loadedDocuments = new HashMap(); Map layouts = new HashMap(); @@ -115,7 +119,7 @@ loadedDocuments.put(e.getValue(), doc); layouts.put(doc, getLayoutPage(doc)); } - specificPageOverlay.put(e.getKey(), doc); + openDocuments.add(doc); specificPageOverlayPage.put(e.getKey(), layouts.get(doc)); } processPages(inputPDFDocument); @@ -123,10 +127,38 @@ } /** - * Close all input pdfs which were used for the overlay. - * + * This will add overlays documents to a document. + * + * @param specificPageOverlayDocuments map of overlay documents for specific pages. The page + * numbers are 1-based. + * + * @return The modified input PDF document, which has to be saved and closed by the caller. If + * the input document was passed by {@link #setInputPDF(PDDocument) setInputPDF(PDDocument)} + * then it is that object that is returned. + * * @throws IOException if something went wrong */ + public PDDocument overlayDocuments(Map specificPageOverlayDocuments) throws IOException + { + loadPDFs(); + for (Map.Entry e : specificPageOverlayDocuments.entrySet()) + { + PDDocument doc = e.getValue(); + if (doc != null) + { + specificPageOverlayPage.put(e.getKey(), getLayoutPage(doc)); + } + } + processPages(inputPDFDocument); + return inputPDFDocument; + } + + /** + * Close all input documents which were used for the overlay and opened by this class. + * + * @throws IOException if something went wrong + */ + @Override public void close() throws IOException { if (defaultOverlay != null) @@ -153,15 +185,12 @@ { evenPageOverlay.close(); } - if (specificPageOverlay != null) + for (PDDocument doc : openDocuments) { - for (Map.Entry e : specificPageOverlay.entrySet()) - { - e.getValue().close(); - } - specificPageOverlay.clear(); - specificPageOverlayPage.clear(); + doc.close(); } + openDocuments.clear(); + specificPageOverlayPage.clear(); } private void loadPDFs() throws IOException @@ -260,7 +289,7 @@ { resources = new PDResources(); } - return new LayoutPage(page.getMediaBox(), createContentStream(contents), + return new LayoutPage(page.getMediaBox(), createCombinedContentStream(contents), resources.getCOSObject()); } @@ -277,13 +306,13 @@ { resources = new PDResources(); } - layoutPages.put(i,new LayoutPage(page.getMediaBox(), createContentStream(contents), + layoutPages.put(i, new LayoutPage(page.getMediaBox(), createCombinedContentStream(contents), resources.getCOSObject())); } return layoutPages; } - private COSStream createContentStream(COSBase contents) throws IOException + private COSStream createCombinedContentStream(COSBase contents) throws IOException { List contentStreams = createContentStreamList(contents); // concatenate streams @@ -300,10 +329,15 @@ return concatStream; } + // get the content streams as a list private List createContentStreamList(COSBase contents) throws IOException { List contentStreams = new ArrayList(); - if (contents instanceof COSStream) + if (contents == null) + { + return contentStreams; + } + else if (contents instanceof COSStream) { contentStreams.add((COSStream) contents); } @@ -320,45 +354,56 @@ } else { - throw new IOException("Contents are unknown type:" + contents.getClass().getName()); + throw new IOException("Unknown content type: " + contents.getClass().getName()); } return contentStreams; } private void processPages(PDDocument document) throws IOException { - int pageCount = 0; + int pageCounter = 0; for (PDPage page : document.getPages()) { + pageCounter++; COSDictionary pageDictionary = page.getCOSObject(); - COSBase contents = pageDictionary.getDictionaryObject(COSName.CONTENTS); - COSArray contentArray = new COSArray(); + COSBase originalContent = pageDictionary.getDictionaryObject(COSName.CONTENTS); + COSArray newContentArray = new COSArray(); + LayoutPage layoutPage = getLayoutPage(pageCounter, document.getNumberOfPages()); + if (layoutPage == null) + { + continue; + } switch (position) { - case FOREGROUND: - // save state - contentArray.add(createStream("q\n")); - addOriginalContent(contents, contentArray); - // restore state - contentArray.add(createStream("Q\n")); - // overlay content - overlayPage(contentArray, page, pageCount + 1, document.getNumberOfPages()); - break; - case BACKGROUND: - // overlay content - overlayPage(contentArray, page, pageCount + 1, document.getNumberOfPages()); - addOriginalContent(contents, contentArray); - break; - default: - throw new IOException("Unknown type of position:" + position); + case FOREGROUND: + // save state + newContentArray.add(createStream("q\n")); + addOriginalContent(originalContent, newContentArray); + // restore state + newContentArray.add(createStream("Q\n")); + // overlay content last + overlayPage(page, layoutPage, newContentArray); + break; + case BACKGROUND: + // overlay content first + overlayPage(page, layoutPage, newContentArray); + + addOriginalContent(originalContent, newContentArray); + break; + default: + throw new IOException("Unknown type of position:" + position); } - pageDictionary.setItem(COSName.CONTENTS, contentArray); - pageCount++; + pageDictionary.setItem(COSName.CONTENTS, newContentArray); } } private void addOriginalContent(COSBase contents, COSArray contentArray) throws IOException { + if (contents == null) + { + return; + } + if (contents instanceof COSStream) { contentArray.add(contents); @@ -369,13 +414,26 @@ } else { - throw new IOException("Unknown content type:" + contents.getClass().getName()); + throw new IOException("Unknown content type: " + contents.getClass().getName()); } } - private void overlayPage(COSArray array, PDPage page, int pageNumber, int numberOfPages) + private void overlayPage(PDPage page, LayoutPage layoutPage, COSArray array) throws IOException { + PDResources resources = page.getResources(); + if (resources == null) + { + resources = new PDResources(); + page.setResources(resources); + } + COSName xObjectId = createOverlayXObject(page, layoutPage, + layoutPage.overlayContentStream); + array.add(createOverlayStream(page, layoutPage, xObjectId)); + } + + private LayoutPage getLayoutPage(int pageNumber, int numberOfPages) + { LayoutPage layoutPage = null; if (!useAllOverlayPages && specificPageOverlayPage.containsKey(pageNumber)) { @@ -406,18 +464,7 @@ int usePageNum = (pageNumber -1 ) % numberOfOverlayPages; layoutPage = specificPageOverlayPage.get(usePageNum); } - if (layoutPage != null) - { - PDResources resources = page.getResources(); - if (resources == null) - { - resources = new PDResources(); - page.setResources(resources); - } - COSName xObjectId = createOverlayXObject(page, layoutPage, - layoutPage.overlayContentStream); - array.add(createOverlayStream(page, layoutPage, xObjectId)); - } + return layoutPage; } private COSName createOverlayXObject(PDPage page, LayoutPage layoutPage, COSStream contentStream) @@ -435,20 +482,41 @@ throws IOException { // create a new content stream that executes the XObject content - PDRectangle pageMediaBox = page.getMediaBox(); - float hShift = (pageMediaBox.getWidth() - layoutPage.overlayMediaBox.getWidth()) / 2.0f; - float vShift = (pageMediaBox.getHeight() - layoutPage.overlayMediaBox.getHeight()) / 2.0f; StringBuilder overlayStream = new StringBuilder(); - overlayStream.append("q\nq 1 0 0 1 "); - overlayStream.append(float2String(hShift)); - overlayStream.append(" "); - overlayStream.append(float2String(vShift) ); - overlayStream.append(" cm /"); + overlayStream.append("q\nq\n"); + AffineTransform at = calculateAffineTransform(page, layoutPage.overlayMediaBox); + double[] flatmatrix = new double[6]; + at.getMatrix(flatmatrix); + for (double v : flatmatrix) + { + overlayStream.append(float2String((float) v)); + overlayStream.append(" "); + } + overlayStream.append(" cm\n/"); overlayStream.append(xObjectId.getName()); overlayStream.append(" Do Q\nQ\n"); return createStream(overlayStream.toString()); } + /** + * Calculate the transform to be used when positioning the overlay. The default implementation + * centers on the destination. Override this method to do your own, e.g. move to a corner, or + * rotate. + * + * @param page The page that will get the overlay. + * @param overlayMediaBox The overlay media box. + * @return The affine transform to be used. + */ + protected AffineTransform calculateAffineTransform(PDPage page, PDRectangle overlayMediaBox) + { + AffineTransform at = new AffineTransform(); + PDRectangle pageMediaBox = page.getMediaBox(); + float hShift = (pageMediaBox.getWidth() - overlayMediaBox.getWidth()) / 2.0f; + float vShift = (pageMediaBox.getHeight() - overlayMediaBox.getHeight()) / 2.0f; + at.translate(hShift, vShift); + return at; + } + private String float2String(float floatValue) { // use a BigDecimal as intermediate state to avoid @@ -488,8 +556,10 @@ /** * Sets the file to be overlayed. - * - * @param inputFile the file to be overlayed + * + * @param inputFile the file to be overlayed. The {@link PDDocument} object gathered from + * opening this file will be returned by + * {@link #overlay(java.util.Map) overlay(Map<Integer, String>)}. */ public void setInputFile(String inputFile) { @@ -498,8 +568,9 @@ /** * Sets the PDF to be overlayed. - * - * @param inputPDF the PDF to be overlayed + * + * @param inputPDF the PDF to be overlayed. This will be the object that is returned by + * {@link #overlay(java.util.Map) overlay(Map<Integer, String>)}. */ public void setInputPDF(PDDocument inputPDF) { diff -Nru libpdfbox2-java-2.0.9/pdfbox/src/main/java/org/apache/pdfbox/multipdf/PDFCloneUtility.java libpdfbox2-java-2.0.13/pdfbox/src/main/java/org/apache/pdfbox/multipdf/PDFCloneUtility.java --- libpdfbox2-java-2.0.9/pdfbox/src/main/java/org/apache/pdfbox/multipdf/PDFCloneUtility.java 2018-03-20 16:19:48.000000000 +0000 +++ libpdfbox2-java-2.0.13/pdfbox/src/main/java/org/apache/pdfbox/multipdf/PDFCloneUtility.java 2018-11-28 17:18:36.000000000 +0000 @@ -34,11 +34,13 @@ /** * Utility class used to clone PDF objects. It keeps track of objects it has already cloned. - * + * Although this class is public, it is for PDFBox internal use and should not be used outside, + * except by very experienced users. The "public" modifier will be removed in 3.0. The class should + * not be used on documents that are being generated because these can contain unfinished parts, + * e.g. font subsetting information. */ public class PDFCloneUtility { - private final PDDocument destination; private final Map clonedVersion = new HashMap(); diff -Nru libpdfbox2-java-2.0.9/pdfbox/src/main/java/org/apache/pdfbox/multipdf/PDFMergerUtility.java libpdfbox2-java-2.0.13/pdfbox/src/main/java/org/apache/pdfbox/multipdf/PDFMergerUtility.java --- libpdfbox2-java-2.0.9/pdfbox/src/main/java/org/apache/pdfbox/multipdf/PDFMergerUtility.java 2018-03-20 16:19:48.000000000 +0000 +++ libpdfbox2-java-2.0.13/pdfbox/src/main/java/org/apache/pdfbox/multipdf/PDFMergerUtility.java 2018-11-28 17:18:36.000000000 +0000 @@ -31,13 +31,18 @@ import java.util.Map; import java.util.Set; +import org.apache.commons.logging.Log; +import org.apache.commons.logging.LogFactory; + import org.apache.pdfbox.cos.COSArray; import org.apache.pdfbox.cos.COSBase; import org.apache.pdfbox.cos.COSDictionary; import org.apache.pdfbox.cos.COSInteger; import org.apache.pdfbox.cos.COSName; import org.apache.pdfbox.cos.COSNumber; +import org.apache.pdfbox.cos.COSObject; import org.apache.pdfbox.cos.COSStream; +import org.apache.pdfbox.io.IOUtils; import org.apache.pdfbox.io.MemoryUsageSetting; import org.apache.pdfbox.pdmodel.PDDocument; import org.apache.pdfbox.pdmodel.PDDocumentCatalog; @@ -71,21 +76,47 @@ */ public class PDFMergerUtility { - private final List sources; - private final List fileInputStreams; + /** + * Log instance. + */ + private static final Log LOG = LogFactory.getLog(PDFMergerUtility.class); + + private final List