Repository navigation
fix(esign): refuse uploaded signatures that also add annotations - #78
Merged
Merged
Conversation
The upload fallback compared old objects only: new objects were skipped and page /Annots only had to keep its old prefix. A signer could add any annotation (free text or a stamp drawn over the page, a link, a script) in the revision they sign with their own valid CIE, and the changed document was accepted and sent on to the other signers and recipients. Every annotation appended to a page, and every field appended to the form, must now be a signature widget or field with no actions and a new signature value. The form dictionary itself is compared wherever it lives, so a form held in the catalog can't gain /XFA either. Filling an existing empty signature field must also set a new signature value.
Contributor
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 23 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Carry the verified signature field and value references from PDF inspection into upload validation. Accept only that field and its owned widgets, including separate widget children; reject dummy values, unrelated aliases and extra child fields before committing a version.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Uploaded PDFs could append an annotation that changes the document while adding a valid signature. The initial fix still accepted unrelated widgets whose signature value merely contained
/ByteRange.PDF inspection now records the new signature's field and value references on the server. After cryptographic verification, upload validation accepts only that exact field and its owned widgets. Dummy signature values, unrelated widgets that reuse the verified value or parent, additional non-signature fields, annotation actions, and XFA changes are rejected before saving a version or recording a signature. Separate field/widget layouts and existing empty signature fields remain supported.
Validation:
The change applies to external uploads. The approved signature retains its existing appearance behavior and placement rules.