Repository navigation
Redaction: paths cut out of the areas, overlay text (part of #198) - #230
Merged
Merged
Conversation
The /BBox of an annotation's appearance stream is mapped onto its /Rect, and the border of a field lies on the edge of that box. With the box off the pixels, the exact clip and the border's edge, both antialiased, lightened the edge pixels twice: a field Editor.SetFields wrote was drawn with other edges than the same value shown from a FormState, which is not clipped. The clip of an annotation's appearance is now rounded outward to whole device pixels when it stays on the axes, as PDFium, MuPDF, Poppler and Ghostscript clip rectangles. The accuracy report against PDFium is unchanged. overlayFile puts its fields off the pixels, which the test held them to. Fixes #222.
The first fix of #222 rounded the clip of every annotation's appearance outward to whole pixels. That made the render of an appearance stream differ from the page it is flattened to, whose content clips exactly: the corpus API run reported 41 files of pdf.js whose flattened first page differed, by up to 4.9 % of its pixels. The other way round: the appearance cera generates for a widget is clipped to the widget's box exactly, as the stream Editor.SetFields writes for it and the form Editor.Flatten draws are. The render with a FormState, the saved file and the flattened page are drawn alike at any scale; the border of a field off the pixels is lighter on its outer edge in all three, as the appearance streams of documents are. The corpus API report and the accuracy report against PDFium are the same as on main.
ImportOptions.Structure brings the elements of the source's structure tree whose content is on imported pages, with the elements above them; an element left without content is dropped. Where the result has a tree, the elements follow its own in a Part under its Document element (or its root): the source's Document becomes the Part, or one is made around its elements, with the source's /Lang where it differs. A result without a tree takes the first one brought as its own. The keys of the parent tree are numbered anew after the result's: pages (/StructParents), their annotations (/StructParent) and the form XObjects they draw. A page imported twice is tagged once, its first copy; a form only pages that did not come draw as tagged content loses its keys. Marked content and object references are mapped to the copies. Role maps are merged, a type the result maps otherwise written as what the source means by it; a class the result defines otherwise is renamed Cls_2, an identifier the result has id_2; namespaces are joined. /MarkInfo says /Marked. The corpus API run gets a step: the pages looked at, imported with their structure into the document itself, keep their marked content in the tree. Over the pdf.js corpus it finds no difference. Fixes #183.
PDF 2.0 lets a page carry /OutputIntents of its own (14.11.5), which take precedence over the document's on it. Such a page is now drawn with a view of the document (Page.cmykDoc) whose DeviceCMYK converts through the profile of the page's intent, read as the catalogue's is: the first intent of kind GTS_PDFX, GTS_PDFA1 or ISO_PDFE1 with a CMYK profile. Document is split into what all views share (docShared: the reader, fonts, the form, the profiles and their budget, transfer functions) and what stands on DeviceCMYK (cmykView: colour spaces, shadings and patterns by reference, decoded images under an id of their own). Pages with one profile share a view; forms and patterns drawn on a page take its view. NaiveCMYK, CMYKProfile and IgnoreOutputIntent decide for the pages as for the document. A page profile counts against maxCMYKProfiles, and one cera cannot read is counted as icc-lut, the page then converting as the document does. The corpus API report and the accuracy report against PDFium are the same as before. Fixes #186.
SignOptions.Timestamp takes a TimestampFunc that gets a token (RFC 3161) from a timestamp authority for the SHA-256 digest of the signature value; the token goes into the signer info as the unsigned attribute signature-time-stamp (PAdES B-T). cera does no network I/O: the function makes the round trip, and may answer with the token or with the whole TimeStampResp (cms.Token). A token that does not stamp the digest, or whose authority did not sign it, is an error (cms.Stamps). The room for /Contents grows by 16 KB; Editor.SignContext passes a context. Editor.Timestamp writes a document timestamp (/Type /DocTimeStamp, ETSI.RFC3161) over the update, in an invisible field. Editor.AddValidation records certificates, OCSP responses and CRLs the caller fetched, written into the document security store (/DSS with /Certs, /OCSPs, /CRLs and a /VRI entry per signature, keyed by the SHA-1 of its /Contents) by Update, Sign and Timestamp; what the store has stays and is not stored twice. With a document timestamp after it the signatures are B-LTA. Both are no change by the rules of a certification (PDF 2.0, 12.8.2.2.2), so a document certified to allow none may get them, and Verify does not count a document timestamp as a change. Two faults of Verify's comparison of revisions, found on the way: a reference to a page was compared by the page's content, so that a link to a page whose /Annots a later signature changed made the signature report annotations changed; and fields were matched by name, so that a form with two fields of one name reported a value filled in. Pages are now compared by their place, fields by their objects. The corpus API step "sign" signs with a timestamp, adds validation data and a document timestamp, and checks both signatures. Fixes #193. Revocation from /DSS when verifying, and the smaller points #143 left, are #228.
A path that reached into an area was clipped, and its numbers stayed in the file: a curve half under the area could be read back whole. Now its segments are split where they cross the edges of the area (lines and cubic curves against the lines of a convex quad), and each run of pieces in the area is replaced by the straight line across it; the clip stays. The area is convex, so what the path fills outside it is the same. A stroke is cut against the area narrowed by how far it reaches (half its width, the mitre limit with mitre joins), so that its new joins stay in the area; a dashed stroke is only clipped, since a shorter path moves its dashes. A filled subpath is cut as a loop; a stroked open one loses the runs at its ends. s, b and b* are written as S, B and B* with the path closed itself, and a line there and back is stroked as the line, as the renderer draws it. A clip in an area becomes an empty one, a clip that reaches into one is cut too. ApplyRedactions writes /OverlayText over the rectangle of a redaction annotation, in Helvetica (fallback fonts for what it lacks) at the size and in the colour of /DA, aligned by /Q, with /Repeat over and over. Part of #198: the other points of its list stay open.
This was referenced Oct 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of #198 (two of its points; the issue keeps the rest). Stacked on #229 (on #227, #226, #225).
Paths are cut, not only clipped (
redactcut.go)Before, a path reaching into an area was clipped and its numbers stayed in the file. Now:
w/2·√2, orw/2·mitre limitwith mitre joins (default: ten half widths) — so that the new joins stay in the area; what lies nearer the edge stays. A hairline counts as one unit. Dashed strokes are only clipped (a shorter path moves the dashes) — their numbers remain.s,b,b*are written asS,B,B*with the subpath closed explicitly; a closed line there and back (x y m x y l s) is stroked as the line — stilus covers a loop that doubles back with extra points twice at its edges, which showed in the corpus (issue8798r.pdf,issue20232.pdf) before this was handled.W n) in an area becomes an empty clip; one reaching into an area is cut like a fill./OverlayText(redactoverlay.go)ApplyRedactionswrites the overlay text in the annotation's rectangle: Helvetica (with the fallback fonts for what it lacks, embedded), size and colour from/DA(size 0: as large as fits, 12 pt lines when repeated),/Qalignment,/Repeatover and over, clipped to the rectangle./ROis not used (what a viewer shows before applying).Tests
TestCutGeometry: what the cut leaves has no subpath start, segment end or curve sample inside the (narrowed) area, for fills, strokes and both.TestRedactCut: eight shapes (filled circle, stroked curve, open filled path starting inside, round-joined polyline with ends and a corner inside, clip,re … b, a there-and-backsline, a dashed line): renders outside the area equal the original (scale 1 and 3), the area is empty, and the numbers of points inside the area are gone from the file — but for the dashed line.TestRedactOverlay: centred red text, repeated text over a black box, Ω from a fallback font.sfix no file differs (I did not add that check to the corpus run: redaction outside cutting already changes pages outside areas — glyphs whose boxes meet an area, widgets removed whole — in 334 files).