PDF header within the first 1024 bytes - #8
Open
rsaccani wants to merge 10 commits into
Open
Conversation
…s extension are frequent" This reverts commit ea55f0c.
Owner
|
That's interesting: indeed Adobe Reader allows this, but all the legit PDF files I've seen so far have %PDF at offset 0. I'd be curious to see legit samples with data before %PDF. Do you have some that you could share by email? |
Author
I've just sent a sample via email. It happens mostly with automatically generated pdf files, it is usually because of programming mistakes that are not detected because adobe opens the files without warnings. It happens also with major vendors, for some reason the frequency of these files increased in the last couple of months. This has not been an issue for years, it is becoming recently. |
Full Python 2 → Python 3 migration. All core scanner functionality tested and working with Python 3.x (26 demo files analyzed correctly). Changes: - print statements → print() calls throughout - raise X, msg → raise X(msg) syntax - except X, e → except X as e syntax - import renames: ConfigParser→configparser, StringIO→io, Queue→queue, urlparse→urllib.parse, HTMLParser→html.parser, htmlentitydefs→html.entities - bytes vs str: binary file parsing updated to use bytes literals (b"..."), bytes comparisons, and proper encode/decode at boundaries - Implicit relative imports → explicit (from . import Filtre) in Filtres/ - OleFileIO_PL: StringIO→io.BytesIO, i16/i32 via struct.unpack_from, string.join→b"".join, L-suffix integers removed, __cmp__→__lt__ - pdfid_PL: binary read loop, EOF check with b"", bytes writes - pyclamd: base64 module usage, socket bytes encode/decode - path.py: octal literals 0755→0o755, basestring→str, file→open - plx.py: unistr/str_lat1 updated for Python 3 str/bytes model - RechercherRemplacer: str/bytes regex normalization in Motif.__init__ - cherrypy wsgiserver: queue, io, urllib.parse, exec syntax, 3-arg raise - HTML/__init__.py: relative import fix - HTMLParser_PL: Python 3 html.parser API Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Ruby changes: - numeric.rb: replace DelegateClass(Bignum) with DelegateClass(::Integer), Bignum/Fixnum were removed in Ruby 3.0 - object.rb: merge class Bignum + class Fixnum reopen into class ::Integer - object.rb: Symbol#id2name -> Symbol#to_s (removed in Ruby 3.0) - string.rb: remove dead RUBY_VERSION < 1.9 / Fixnum#ord block - string.rb: replace iconv (removed in Ruby 2.0) with String#encode - graphics/instruction.rb: fix Hash.new(key: val) treated as keyword args in Ruby 3+ Python change: - origapy.py: add stdin.flush() after writing file paths to subprocess; Python 3 pipe I/O is buffered, causing deadlock without explicit flush Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Replace outdated Python 2.x / Ruby 1.8.x requirements with the versions actually needed after the origami compatibility port. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Port bundled Origami Ruby library to Ruby 3.3+: - Replace removed Bignum/Fixnum with ::Integer - Replace iconv (removed in Ruby 2.0) with String#encode - Fix Symbol#id2name -> to_s (removed in Ruby 3.0) - Fix Hash.new keyword args ambiguity (Ruby 3.0) - Fix Python 3 subprocess pipe buffering in origapy.py Update README files: require Ruby 3.3+ and Python 3.
In Python 3 implicit relative imports are removed. Filtre_PDF.py was the only filter not updated to use 'from . import Filtre', causing a ModuleNotFoundError on startup. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
exefilter searches for the %PDF- header at the beginning of the file. Adobe allows this header to be placed within the first 1024 bytes of the file and unfortunately many legit files have some characters before %PDF-.
I replaced startswith with find in order to allow such files to be analyzed.