[
https://issues.apache.org/jira/browse/PDFBOX-6244?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18108696#comment-18108696
]
Maruan Sahyoun commented on PDFBOX-6244:
----------------------------------------
I'd add that to SECURITY.md.
{quote}
PDF semantics and validation
PDFBox is a low-level library for creating, manipulating, and extracting
content from PDF documents. Loading or processing a PDF with PDFBox does not
imply that the document conforms to a particular PDF standard or profile, or
that any security- or application-level properties of the document have been
validated.
In particular, PDFBox does not automatically validate PDF signatures, document
restrictions or permissions, font requirements, PDF/A or other standards
conformance, or similar document-level properties. Applications that require
such validation are responsible for performing the appropriate checks using the
PDFBox APIs and, where necessary, other suitable validation components.
The fact that PDFBox does not automatically perform these validations when
loading, processing, or storing a PDF is not considered a security
vulnerability. Findings that merely identify the absence of
application-specific PDF signature, permission, conformance, font, or similar
validation are out of scope unless they demonstrate a security impact within
PDFBox's security model.
{quote}
WDYT?
> Clarify that parsing doesn't check signatures
> ---------------------------------------------
>
> Key: PDFBOX-6244
> URL: https://issues.apache.org/jira/browse/PDFBOX-6244
> Project: PDFBox
> Issue Type: Improvement
> Components: Documentation
> Reporter: Tilman Hausherr
> Assignee: Tilman Hausherr
> Priority: Minor
> Fix For: 2.0.38, 3.0.9 PDFBox, 4.0.0
>
>
> Clarify that parsing doesn't check whether any signatures are verified /
> valid, and that loading a manipulated / "updated" PDF will not fail parsing.
> This applies to certification constraints as well. This behavior is not a
> security flaw, it's a missing feature. The ShowSignature example offers a
> limited signature check. The gold standard is Adobe Reader.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
