Problem encrypting/decrypting document : Possibility to fully decrypt a document only with user password

[Baptiste Aiglin]

Hi, 

I ran into the following problem : 
I encrypt my document with a owner and user password thanks to the 
StandardProtectionPolicy class with a null password
I then set permissions to false
I save my document

                        PDDocument aDocument = PDDocument.load(new 
ByteArrayInputStream(this.getData().get(0)));
                        try{
 
                                // Create a new AccessPermission Object
                                AccessPermission aAp = new 
AccessPermission();
                                // Set all the permission for the Document
                                aAp.setCanAssembleDocument(false);
                                aAp.setCanExtractContent(false);  
                                aAp.setCanExtractForAccessibility(false);
                                aAp.setCanFillInForm(false);
                                aAp.setCanModify(false);
                                aAp.setCanModifyAnnotations(false);
                                aAp.setCanPrint(true);
                                aAp.setCanPrintDegraded(true);
 
 
                                StandardProtectionPolicy aPolicy = new 
StandardProtectionPolicy(owner_pwd, null, aAp);
                                aPolicy.setEncryptionKeyLength(128);
 
 
                                aDocument.protect(aPolicy);
 
                                ByteArrayOutputStream output = new 
ByteArrayOutputStream();
                                aDocument.save(output);
                                ...
}catch...

I then reopen it and try to decrypt it with the null user password
 

                                PDDocument aDocument = PDDocument.load(new 
ByteArrayInputStream(sDocumentToDecrypt.get(0)));

                                        try{
                                                aDocument.openProtection(
new StandardDecryptionMaterial(null));

                                        }catch(CryptographyException e){
                                                LOGGER.error("Error 
unexpected in  generation\n" + Tools.getTrace(e));

                                        }
                                }
 
                                // Protect the document with the 
ProtectionPolicy object
                                ByteArrayOutputStream output = new 
ByteArrayOutputStream();
                                aDocument.setAllSecurityToBeRemoved(true); 
 
                                aDocument.save(output);

I can then modify my document as i want, while it is said : 

Class StandardProtectionPolicy

This class represents the protection policy to add to a document for 
password-based protection. The following example shows how to protect a 
PDF document with password. In this example, the document will be 
protected so that someone opening the document with the user password 
user_pwd will not be able to modify the document.