[
https://issues.apache.org/jira/browse/PDFBOX-6244?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18108312#comment-18108312
]
Michael Klink edited comment on PDFBOX-6244 at 8/26/26 1:35 PM:
----------------------------------------------------------------
{quote}Clarify that parsing doesn't check whether any signatures are verified /
valid, and that loading a manipulated / "updated" PDF will not fail parsing.
This applies to certification constraints as well.{quote}
Is it really necessary to stress this? In particular in the JavaDocs? Every
developer should be aware that parsing or opening a PDF is not the same as
validating contained signatures, shouldn't they?
And if you really think it is necessary, what about other security features? If
you mention that signatures aren't validated and certification constraints are
ignored, shouldn't you also mention that encryption permissions also are
ignored? And usage rights signatures, too?
{quote}This behavior is not a security flaw, it's a missing feature.{quote}
It is missing, but would it really be a feature?
{quote}The ShowSignature example offers a limited signature check. The gold
standard is Adobe Reader.{quote}
No, Adobe Reader clearly is not the gold standard in regard to signature
validation. It's far too lax in regard to cryptographic signature validation,
and its MDP validation is implementing a mostly undocumented policy. Not gold
at all.
-----
I just wonder, did possibly someone create a CVE for PDFBox about this missing
signature validation, and you started this issue to counter that? In that case
I'd understand if you added a "Security Considerations" chapter to the
documentation in which you described what PDFBox does and does not
security-wise.
If you really want to add JavaDoc to the PDF parsing methods, you may want to
describe there how lenient the parsing actually is, which format errors it
ignores or even repairs under the hood. That would be material of interest to
developers.
-----
As an aside, the addition to SECURITY.md IMO is too extreme, "PDF signature
validation is unsupported. The project does not provide cryptographic
validation of PDF signatures, and applications requiring signature validation
must perform that validation using a dedicated, trusted component." While all
the actual validation is in examples, PDFBox serves as a framework for that.
Formulated as it is now it may make AI tools consider breaking validation
related functionality to be allowed.
was (Author: mkl):
{quote}Clarify that parsing doesn't check whether any signatures are verified /
valid, and that loading a manipulated / "updated" PDF will not fail parsing.
This applies to certification constraints as well.{quote}
Is it really necessary to stress this? In particular in the JavaDocs? Every
developer should be aware that parsing or opening a PDF is not the same as
validating contained signatures, shouldn't they?
And if you really think it is necessary, what about other security features? If
you mention that signatures aren't validated and certification constraints are
ignored, shouldn't you also mention that encryption permissions also are
ignored? And usage rights signatures, too?
{quote}This behavior is not a security flaw, it's a missing feature.{quote}
It is missing, but would it really be a feature?
{quote}The ShowSignature example offers a limited signature check. The gold
standard is Adobe Reader.{quote}
No, Adobe Reader clearly is not the gold standard in regard to signature
validation. It's far too lax in regard to cryptographic signature validation,
and its MDP validation is implementing a mostly undocumented policy. Not gold
at all.
-----
I just wonder, did possibly someone create a CVE for PDFBox about this missing
signature validation, and you started this issue to counter that? In that case
I'd understand if you added a "Security Considerations" chapter to the
documentation in which you described what PDFBox does and does not
security-wise.
If you really want to add JavaDoc to the PDF parsing methods, you may want to
describe there how lenient the parsing actually is, which format errors it
ignores or even repairs under the hood. That would be material of interest to
developers.
> Clarify that parsing doesn't check signatures
> ---------------------------------------------
>
> Key: PDFBOX-6244
> URL: https://issues.apache.org/jira/browse/PDFBOX-6244
> Project: PDFBox
> Issue Type: Improvement
> Components: Documentation
> Reporter: Tilman Hausherr
> Assignee: Tilman Hausherr
> Priority: Minor
> Fix For: 2.0.38, 3.0.9 PDFBox, 4.0.0
>
>
> Clarify that parsing doesn't check whether any signatures are verified /
> valid, and that loading a manipulated / "updated" PDF will not fail parsing.
> This applies to certification constraints as well. This behavior is not a
> security flaw, it's a missing feature. The ShowSignature example offers a
> limited signature check. The gold standard is Adobe Reader.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
