[PDFBOX-4155] Password Security with Unicode needs SASLprep

• Type: Bug
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 2.0.8
• Fix Version/s: 2.0.16, 3.0.0 PDFBox
• Component/s: Crypto
• Labels: security
• Assignee: Tilman Hausherr
• Reporter: Marc Kaufman
• Created: 18/Mar/18 00:02
• Updated: 27/Sep/19 08:28
• Resolved: 01/Jun/19 17:57

Description

Standard Security handler for Version 6 (AES256) handles Unicode passwords. However the current handler is missing this part:

"The UTF-8 password string shall be generated from Unicode input by processing the input string with the SASLprep (RFC 4013) profile of stringprep (RFC 3454) using the Normalize and BiDi options, and then converting to a UTF-8 representation."

SASLprep is required to normalize equivalent codings for complex glyphs (such as those using umlauts, etc).

pdmodel/encryption/StandardSecurityHandler.java

Issue Links

• is related to: PDFBOX-4660 Can't decrypt PDF when password contains special national characters
• relates to: KAFKA-6272 SASL PLAIN and SCRAM do not apply SASLPrep
• relates to: PDFBOX-4587 SASLPrep declares that u2070E is private use
• relates to: TIKA-2858 JAXRS server: allow passwords with special chars (MIME encoded words)
• relates to: DIRAPI-256 We need to implement the SASLPrep RFC (RFC 4013)
• links to: Implementation of the SASLPrep algorithm by Tom Bentley