Dangerzone: Convert potentially dangerous PDFs, documents, or images to safe PDF
It&#x27;s nice that PDF security is getting a bit more attention, but there are a number of things that this approach will trash, for instance, I don&#x27;t have high hopes for the accessibility of the resulting PDF. (edit: and needless to say, any software in your pipeline which does full interpretation of an untrusted file will <i>itself</i> become the target for attacks, so this is only a useful tool if it is run in an extremely restricted environment)<p>I for one have been looking a lot into PDF&#x2F;A for security. PDF&#x2F;A is really meant for archival, but as a side effect has disallowed an awful lot of weird PDF features which are a security nightmare and pdf readers tend to implement badly&#x2F;buggily. PDF&#x2F;A-1 for example, the strictest level, disallows JPEG2000, TIFF, JavaScript, PostScript, embedded files... (PDF&#x2F;A-3, FWIW is essentially useless from this angle, because they decided to allow arbitrary embedded files, so a valid PDF&#x2F;A-3 could have pretty much anything in it).<p>There now exists a good PDF&#x2F;A validator (<a href="https:&#x2F;&#x2F;verapdf.org&#x2F;" rel="nofollow">https:&#x2F;&#x2F;verapdf.org&#x2F;</a>) which can be used to ensure PDFs conform to the standard, but of course, won&#x27;t <i>fix</i> them if they&#x27;re not.<p>PDF&#x2F;A has an interesting implementation detail however - compliant PDF readers are <i>supposed</i> to automatically &quot;turn off&quot; non-PDF&#x2F;A features when they encounter a PDF which declares itself as a particular PDF&#x2F;A variant (even if it then goes on to attempt to use non-compliant features), which would <i>hopefully</i> prevent dangerous sections from being decoded and avoid exploitation). Another interesting feature of PDF is its appendable nature, which might raise the possibility of being able to &quot;declare&quot; an arbitrary PDF as PDF&#x2F;A by simply appending an extra section to it, hopefully rendering it less harmful (though possibly at the expense of it appearing to have missing content when rendered).