build(deps): Bump actions/checkout from 4 to 7 - #8
Closed
dependabot[bot] wants to merge 19 commits into
Closed
Conversation
Contenu initial depuis la branche claude/search-repo-issues-NtaBM de hazyhaar/pdfcpu. Inclut ARCHITECTURE.md et PLAN.md. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Architecture "jobs atomiques as library" : Op/Registry/Pipeline/Middleware. CGO_ENABLED=0, zero regex, zero panic, zero os.Exit. Packages implémentés : - internal/object — types PDF avec Span (error reporting) - internal/parse — lexer + parser récursif, stream parsing - internal/xref — table/stream xref, recovery, chaînage /Prev - internal/filter — FlateDecode, ASCII85, ASCIIHex, zip bomb protection - internal/store — ObjectStore lazy, cache, object streams - internal/security — limits, structural scan, actions dangereuses, injection - internal/write — sérialisation PDF (objets, xref, trailer) - internal/content — tokenizer + interpreter content stream (17 opérateurs texte) - internal/font — CMap parser, WinAnsi/MacRoman/Standard encoding, font resolver - internal/cmapcheck — détection injection par CMap falsifié (5 heuristiques N1) - pkg/pdf — Document, Op, Registry, ChangeSet, SecurityReport - pkg/reader — Open() avec sas sécurité 3 gates - ops/ — info, text, validate, sanitize, merge, split, page 20 packages testés, 0 échec, race detector clean. ~9.6k LOC (code + tests). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Trois extensions "job as library" : - ops/layout/ — détection de colonnes (biggest jump), marges, reading order - ops/tables/ — extraction de tableaux structurés (clustering spatial Y+X) → Table.ToStrings() pour export en grille [][]string - ops/forms/ — AcroForm : ListFields, Fill, Flatten, Export → support text, checkbox, radio, dropdown, signature → Flatten supprime /AcroForm et nettoie les widgets des pages 22 packages testés, 0 échec, race detector clean. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Static analysis of the full codebase covering all layers (S0-S7). Identifies 3 critical, 6 high, 8 medium, and 6 low severity findings including decompression bomb bypass, panic violations, unenforced security limits, and middleware bypass conditions. https://claude.ai/code/session_01EgSdisKNMraSnmpsnRGRpm
Adds 3 high (URI sanitize bypass, negative size, unreliable memory limit), 4 medium (page walk depth, CMap unbounded, mutable Raw, scan window), and 3 low severity findings. Updates totals to 3C/9H/12M/9L. https://claude.ai/code/session_01EgSdisKNMraSnmpsnRGRpm
Critical fixes: - [C1] Decompression bomb: io.LimitReader in flateFilter.Decode DURING decompression - [C2] XRef stream panic: validate /W values in [0, 8] - [C3] Store panic: validate /First <= len(data) before slice High fixes: - [1.1a] Parser pushBack: return bool instead of panic - [1.1b] Registry: add TryRegister() for safe dynamic registration - [H1-H2] Security middleware: block /JavaScript//JS//Launch instead of discarding - [H3-H4] Parser: enforce maxArraySize (10K) on arrays and dicts - [H5] Parser: validate /Length against file size before allocation - [H6] Writer: add maxWriteDepth=100 to appendObject recursion - [H7] Reader: reject size <= 0 in Open() - [H8] Sanitize: strip leading whitespace/control chars before URI scheme check - [H9] WithMemoryLimit: document as approximation Medium fixes: - [M1] XRef table: cap count at 1M entries - [M2] Actions: add GoToR, GoToE, Sound, Movie, Rendition, ResetForm, EmbeddedFile - [M3-M4] Structural: add JPEG, TIFF, OLE, WASM polyglot signatures - [M5] ScanFromReader: distinguish I/O errors from oversized - [M6] Sentinel errors: ErrStructural, ErrDangerousAction, ErrInjection - [M7] ASCII85: correct allocation factor (4/5 instead of 4x) - [M8] XRef recovery: cap at 1M objects - [M9] walkPages: add depth limit (50) in text, merge, page ops - [M10] CMap: cap AllTargetCodepoints range iteration at 65536 - [M11] Document.Raw: add mutability warning comment - [M12] reader: dangerous action scan already in Gate 2 (documented) Low fixes: - [L1] Lexer: octal escape &0xFF to prevent silent wrap - [L3] Store: check generation number on resolve - [L4] Flate: implement PNG Average and Paeth predictors - [L5] Injection: fix severity ranking (low=1, none=0) - [L6] Trailer: use slice indexing instead of string concatenation - [L7] Merge: return null for unmapped refs instead of silent redirect - [L8] Text: document hardcoded limits matching DefaultLimits - [L9] Content: cap Tokenize at 1M instructions https://claude.ai/code/session_01EgSdisKNMraSnmpsnRGRpm
…r deadlock Corrections majeures pour supporter les vrais PDFs : - Fix streams ToUnicode non décompressés (resolver.go, scan.go passaient les données brutes compressées à ParseCMap → texte garbled) - Ajout filtre LZWDecode (golang.org/x/image/tiff/lzw, pas compress/lzw) - Fix tokenizer inline images BI/ID/EI (skip données binaires, évite boucle infinie sur pages avec images) - Fix deadlock RefResolver : Resolve() → resolveUnlocked() + le callback utilise resolveUnlocked() directement - Fix variable shadowing lengthOk dans parseStreamData - CMap parser : normalisation \r\n/\r, codespace range, multi-paires bfchar - XRef recovery : scan binaire 64KB + maxRecoveryObjects + synthetic trailer - StandardEncoding complète + glyphToRune étendu - Layout column detection proportionnelle (15% content width, min 50pt) Testé : AoK Manual FR 145p/4MB → 10255 blocs, 98ms, texte lisible. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Re-audit after merge of new modules (LZW, forms, layout, tables, inline images, debugpdf). All 33 previous fixes confirmed intact. New findings: 1 critical (LZW decompression bomb), 5 high (forms recursion unbounded x2, injection not validated, hardcoded paths with PII, encoding panic on negative index), 6 medium, 5 low. https://claude.ai/code/session_01EgSdisKNMraSnmpsnRGRpm
Critical: - N1: LZW decompression bomb — add io.LimitReader (same pattern as flate.go) High: - N2-N3: forms recursion unbounded — add depth limit (maxFieldDepth=50) - N4/N13: forms Fill error handling — return errors instead of silent continue - N5: Remove hardcoded personal paths from debugpdf, tests — use PDFAST_TEST_CORPUS env var - N6: ApplyDifferences panic on negative index — add code >= 0 check - N6b: ScanDangerousActions bypass via #XX encoding — decode PDF names before scan Medium: - N8: CMap parser entries unlimited — add maxCMapEntries=65536 - N10: forms Flatten rootNum=0 corruption — error if /Root not indirect ref - N11: store.go nObj unbounded — add maxObjStreamEntries=100000 - N12: xref recovery parseInt overflow — add length limit + overflow detection - N12c: store.go negative offsets — validate offset >= 0 - N12d: actions.go bytes.ToLower full copy — replace with containsFoldBytes Low: - N15: debugpdf Stat error ignored — check error - N16: bench_test missing Seek between iterations — add f.Seek(0,0) - N17: forms unused strings import — removed 3 findings accepted (architectural): N7, N9, N12b, N14 https://claude.ai/code/session_01EgSdisKNMraSnmpsnRGRpm
High: - A1: merge/remapRefs unbounded recursion — add maxRemapDepth=100 Medium: - A2: sanitize/cleanObject recursion — add maxCleanDepth=100 - A3: walkPages cycle detection — add visited map to all 4 implementations (text.go, merge.go, page.go, forms.go) - A4: operator.go operand accumulation — add maxOperands=10000 https://claude.ai/code/session_01EgSdisKNMraSnmpsnRGRpm
…on, startxref bounds) - filter.go: ratio check off-by-one (> → >=) - stream.go: validate /Index start/count for negatives and upper bound - trailer.go: validate startxref offset against file size https://claude.ai/code/session_01EgSdisKNMraSnmpsnRGRpm
Security audit v2: fix 22 new findings + prevent regressions
…elpers - Module renamed from pdfast to github.com/hazyhaar/pdfast (all 51 files) - Add ExtractFile, ExtractReader, FileInfo, ReaderInfo helpers (ops/text/file.go) - Add HasImageStreams detection for ExtractionQuality (scanImageStreams) - Add GitHub Actions CI (lint + test + gate) - Add PLAN_INTEGRATION.md for HOROS ecosystem integration Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add dependabot.yml (weekly gomod grouped + github-actions) - Add concurrency group with cancel-in-progress - Add timeout-minutes: 10 on lint and test jobs - Add -race flag to test step (was missing, mandatory per HOROS rules) - Add bin/, .env to .gitignore Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- errcheck: handle w.Write return in filter tests - errcheck: propagate walkPagesClean error in forms - unused: remove unused skipUntilKeyword in parser - gosimple: remove redundant nil check in middleware - ineffassign: use _ for unused err in calibrate_test Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 7. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Contributor
Author
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps actions/checkout from 4 to 7.
Release notes
Sourced from actions/checkout's releases.
... (truncated)
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
3d3c42eprep v7.0.1 release (#2531)2880268escape values passed to --unset (#2530)12cd223trim only ascii whitespace for branch (#2521)62661c4skip running unsafe pr check if input is default (#2518)e8d4307Bump the minor-actions-dependencies group with 2 updates (#2499)631c942eslint 9 (#2474)4f1f4aeBump actions/upload-artifact from 4 to 7 (#2476)ba09753Bump actions/checkout from 6 to 7 (#2488)b9e0990Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)e8cb398Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)