Skip to content
Snippets Groups Projects

269 implement workflow for signing already uploaded document dev

Merged 269 implement workflow for signing already uploaded document dev
269-implement-workflow-for-signing-already-uploaded-document-dev into master
Merged Damyan Mitev requested to merge 269-implement-workflow-for-signing-already-uploaded-document-dev into master
Viewing commit 7a6de6d8
Prev Next
Show latest version
1 file
+ 775
− 770
Compare changes
  • Side-by-side
  • Inline
javascript/src/utilities/pdfUtilities.js
+ 775
− 770
/*
* Based on PDFSign v1.0.0
* https://github.com/Communication-Systems-Group/pdfsign.js
*
* Copyright 2015, Thomas Bocek, University of Zurich
*
* Licensed under the MIT license:
* http://www.opensource.org/licenses/MIT
*/
import {
ObjectIdentifier,
UTCTime,
OctetString
} from 'asn1js';
import {
ContentInfo,
SignedData,
Attribute,
SignerInfo,
IssuerAndSerialNumber,
SignedAndUnsignedAttributes,
EncapsulatedContentInfo,
getCrypto
} from 'pkijs';
import {
parseCertificate,
parsePrivateKey,
} from './signingUtilities';
//keep this import to include the patched version of pdfjs library
import {PDFJS} from "../lib/pdfjs.parser.js";
function createXrefTable(xrefEntries) {
xrefEntries = sortOnKeys(xrefEntries);
var retVal ='xref\n';
var last = -2;
for(var i in xrefEntries) {
i = parseInt(i);
if(typeof xrefEntries[i].offset === 'undefined') { continue; }
retVal += calcFlow(i, last, xrefEntries);
var offset = xrefEntries[i].offset;
retVal += pad10(offset)+' '+pad5(xrefEntries[i].gen)+' '+(xrefEntries[i].free?'f':'n')+' \n';
last = i;
}
return retVal;
}
function calcFlow(i, last, xrefEntries) {
if(last + 1 === i) {return '';}
var count = 1;
while(typeof xrefEntries[(i+count)] !== 'undefined'
&& typeof xrefEntries[(i+count)].offset !== 'undefined') {count ++;}
return i + ' '+count+'\n';
}
function createTrailer(topDict, startxref, sha256Hex, size, prev) {
var retVal ='trailer <<\n';
retVal +=' /Size '+(size)+'\n';
var refRoot = topDict.getRaw('Root');
if(typeof refRoot !== 'undefined') {
retVal +=' /Root '+refRoot.num+' '+refRoot.gen+' R\n';
}
var refInfo = topDict.getRaw('Info');
if(typeof refInfo !== 'undefined') {
retVal +=' /Info '+refInfo.num+' '+refInfo.gen+' R\n';
}
retVal +=' /ID [<'+sha256Hex.substring(0,32)+'><'+sha256Hex.substring(32,64)+'>]\n';
if(typeof prev !== 'undefined' ) {
retVal +=' /Prev '+prev+'\n';
}
retVal +='>>\n';
retVal +='startxref\n';
retVal +=startxref + '\n';
retVal +='%%EOF\n';
return retVal;
}
function createXrefTableAppend(xrefEntries) {
xrefEntries = sortOnKeys(xrefEntries);
var retVal ='xref\n';
var last = -2;
for(var i in xrefEntries) {
i = parseInt(i);
if(typeof xrefEntries[i].offset === 'undefined') { continue; }
retVal += calcFlow(i, last, xrefEntries);
var offset = xrefEntries[i].offset;
retVal += pad10(offset)+' '+pad5(xrefEntries[i].gen)+' '+(xrefEntries[i].free?'f':'n')+' \n';
last = i;
}
return retVal;
}
//http://stackoverflow.com/questions/10946880/sort-a-dictionary-or-whatever-key-value-data-structure-in-js-on-word-number-ke
function sortOnKeys(dict) {
var sorted = [];
for(var key in dict) {
sorted[sorted.length] = key;
}
sorted.sort();
var tempDict = {};
for(var i = 0; i < sorted.length; i++) {
tempDict[sorted[i]] = dict[sorted[i]];
}
return tempDict;
}
function removeFromArray(array, from, to) {
var cutlen = to - from;
var buf = new Uint8Array(array.length - cutlen);
for (var i = 0; i < from; i++) {
buf[i] = array[i];
}
for (var i = to, len = array.length; i < len; i++) {
buf[i-cutlen] = array[i];
}
return buf;
}
function findXrefBlocks(xrefBlocks) {
var num = xrefBlocks.length / 2;
var retVal = [];
for (var i=0;i<num;i++) {
retVal.push({start: xrefBlocks[i], end: xrefBlocks[i+num]});
}
return retVal;
}
function convertUint8ArrayToBinaryString(u8Array) {
var i, len = u8Array.length, b_str = "";
for (i=0; i<len; i++) {
b_str += String.fromCharCode(u8Array[i]);
}
return b_str;
}
function arrayObjectIndexOf(array, start, end, orig) {
for(var i = 0, len = array.length; i < len; i++) {
if ((array[i].start === start) && (array[i].end === end) && (array[i].orig === orig)) {
return i;
}
}
return -1;
}
function pad10(num) {
var s = "000000000" + num;
return s.substr(s.length-10);
}
function pad5(num) {
var s = "0000" + num;
return s.substr(s.length-5);
}
function pad2(num) {
var s = "0" + num;
return s.substr(s.length-2);
}
function findRootEntry(xref) {
var rootNr = xref.root.objId.substring(0, xref.root.objId.length - 1);
return xref.entries[rootNr];
}
function findSuccessorEntry(xrefEntries, current) {
//find it first
var currentOffset = current.offset;
var currentMin = Number.MAX_SAFE_INTEGER;
var currentMinIndex = -1;
for(var i in xrefEntries) {
if(xrefEntries[i].offset > currentOffset) {
if(xrefEntries[i].offset < currentMin) {
currentMin = xrefEntries[i].offset;
currentMinIndex = i;
}
}
}
if(currentMinIndex === -1) {
return current;
}
return xrefEntries[currentMinIndex];
}
function updateArray(array, pos, str) {
var upd = stringToUint8Array(str);
for (var i = 0, len=upd.length; i < len; i++) {
array[i+pos] = upd[i];
}
return array;
}
function copyToEnd(array, from, to) {
var buf = new Uint8Array(array.length + (to - from));
for (var i = 0, len=array.length; i < len; i++) {
buf[i] = array[i];
}
for (var i = 0, len=(to - from); i < len; i++) {
buf[array.length + i] = array[from + i];
}
return buf;
}
function insertIntoArray(array, pos, str) {
var ins = stringToUint8Array(str);
var buf = new Uint8Array(array.length + ins.length);
for (var i = 0; i < pos; i++) {
buf[i] = array[i];
}
for (var i = 0; i < ins.length; i++) {
buf[pos+i] = ins[i];
}
for (var i = pos; i < array.length; i++) {
buf[ins.length+i] = array[i];
}
return buf;
}
function stringToUint8Array(str) {
var buf = new Uint8Array(str.length);
for (var i=0, strLen=str.length; i<strLen; i++) {
buf[i] = str.charCodeAt(i);
}
return buf;
}
function uint8ArrayToString(buf, from, to) {
if(typeof from !== 'undefined' && typeof to !== 'undefined') {
var s = '';
for (var i=from; i<to; i++) {
s = s + String.fromCharCode(buf[i]);
}
return s;
}
return String.fromCharCode.apply(null, buf);
}
function findFreeXrefNr(xrefEntries, used) {
used = typeof used !== 'undefined' ? used : [];
var inc = used.length;
for (var i=1;i<xrefEntries.length;i++) {
var index = used.indexOf(i);
var entry = xrefEntries[""+i];
if(index === -1 && (typeof entry === 'undefined' || entry.free)) {
return i;
}
if(index !== -1) {
inc--;
}
}
return xrefEntries.length + inc;
}
function find(uint8, needle, start, limit) {
start = typeof start !== 'undefined' ? start : 0;
limit = typeof limit !== 'undefined' ? limit : Number.MAX_SAFE_INTEGER;
var search = stringToUint8Array(needle);
var match = 0;
for(var i=start;i<uint8.length && i<limit;i++) {
if(uint8[i] === search[match]) {
match++;
} else {
match = 0;
if(uint8[i] === search[match]) {
match++;
}
}
if(match === search.length) {
return (i + 1) - match;
}
}
return -1;
}
function findBackwards(uint8, needle, start, limit) {
start = typeof start !== 'undefined' ? start : uint8.length;
limit = typeof limit !== 'undefined' ? limit : Number.MAX_SAFE_INTEGER;
var search = stringToUint8Array(needle);
var match = search.length - 1;
for(var i=start;i>=0 && i<limit;i--) {
if(uint8[i] === search[match]) {
match--;
} else {
match = search.length - 1;
if(uint8[i] === search[match]) {
match--;
}
}
if(match === 0) {
return i - 1;
}
}
return -1;
}
function strHex(s) {
var a = "";
for( var i=0; i<s.length; i++ ) {
a = a + pad2(s.charCodeAt(i).toString(16));
}
return a;
}
async function sha256(array) {
const cryptoLib = getCrypto();
const digestTmpBuf = await cryptoLib.digest({ name: "SHA-256" }, array);
const digestTmpArray = new Uint8Array(digestTmpBuf);
const digestTmpStr = uint8ArrayToString(digestTmpArray);
const sha256Hex = strHex(digestTmpStr);
return sha256Hex;
}
function isSigInRoot(pdf) {
if (!pdf.acroForm) {
return false;
}
return pdf.acroForm.get('SigFlags') === 3;
}
function updateXrefOffset(xref, offset, offsetDelta) {
for(var i in xref.entries) {
if(xref.entries[i].offset >= offset) {
xref.entries[i].offset += offsetDelta;
}
}
for(var i in xref.xrefBlocks) {
if(xref.xrefBlocks[i] >= offset) {
xref.xrefBlocks[i] += offsetDelta;
}
}
}
function updateXrefBlocks(xrefBlocks, offset, offsetDelta) {
for(var i in xrefBlocks) {
if(xrefBlocks[i].start >= offset) {
xrefBlocks[i].start += offsetDelta;
}
if(xrefBlocks[i].end >= offset) {
xrefBlocks[i].end += offsetDelta;
}
}
}
function updateOffset(pos, offset, offsetDelta) {
if(pos >= offset) {
return pos + offsetDelta;
}
return pos;
}
function round256(x) {
return (Math.ceil(x/256)*256) - 1;
}
/**
* (D:YYYYMMDDHHmmSSOHH'mm)
* e.g. (D:20151210164400+01'00')
* where:
* YYYY shall be the year
* MM shall be the month (01–12)
* DD shall be the day (01–31)
* HH shall be the hour (00–23)
* mm shall be the minute (00–59)
* SS shall be the second (00–59)
* O shall be the relationship of local time to Universal Time (UT), and shall be denoted by one of the characters PLUS SIGN (U+002B) (+), HYPHEN-MINUS (U+002D) (-), or LATIN CAPITAL LETTER Z (U+005A) (Z) (see below)
* HH followed by APOSTROPHE (U+0027) (') shall be the absolute value of the offset from UT in hours (00–23)
* mm shall be the absolute value of the offset from UT in minutes (00–59)
*/
function now(date) {
//date = typeof date !== 'undefined' ? date : new Date();
var yyyy = date.getFullYear().toString();
var MM = pad2(date.getMonth() + 1);
var dd = pad2(date.getDate());
var hh = pad2(date.getHours());
var mm = pad2(date.getMinutes());
var ss = pad2(date.getSeconds());
return yyyy + MM + dd+ hh + mm + ss + createOffset(date);
}
function createOffset(date) {
var sign = (date.getTimezoneOffset() > 0) ? "-" : "+";
var offset = Math.abs(date.getTimezoneOffset());
var hours = pad2(Math.floor(offset / 60));
var minutes = pad2(offset % 60);
return sign + hours + "'" + minutes;
}
async function newSig(pdf, root, rootSuccessor, date, signingCert, certificateChain, privateKey) {
try {
// {annotEntry} is the ref to the annot widget. If we enlarge the array, make sure all the offsets
// after the modification will be updated -> xref table and startxref
var annotEntry = findFreeXrefNr(pdf.xref.entries);
// we'll store all the modifications we make, as we need to adjust the offset in the PDF
var offsetForm = find(pdf.stream.bytes, '<<', root.offset, rootSuccessor.offset) + 2;
//first we need to find the root element and add the following:
//
// /AcroForm<</Fields[{annotEntry} 0 R] /SigFlags 3>>
//
var appendAcroForm = '/AcroForm<</Fields[' + annotEntry + ' 0 R] /SigFlags 3>>';
//before we insert the acroform, we find the right place for annotentry
//we need to add Annots [x y R] to the /Type /Page section. We can do that by searching /Contents[
var pages = pdf.catalog.catDict.get('Pages');
//get first page, we have hidden sig, so don't bother
var ref = pages.get('Kids')[0];
var xref = pdf.xref.fetch(ref);
var offsetContentEnd = xref.get('#Contents_offset');
//we now search backwards, this is safe as we don't expect user content here
var offsetContent = findBackwards(pdf.stream.bytes, '/Contents', offsetContentEnd);
var appendAnnots = '/Annots[' + annotEntry + ' 0 R]\n ';
//now insert string into stream
var array = insertIntoArray(pdf.stream.bytes, offsetForm, appendAcroForm);
//recalculate the offsets in the xref table, only update those that are affected
updateXrefOffset(pdf.xref, offsetForm, appendAcroForm.length);
offsetContent = updateOffset(offsetContent, offsetForm, appendAcroForm.length);
var array = insertIntoArray(array, offsetContent, appendAnnots);
updateXrefOffset(pdf.xref, offsetContent, appendAnnots.length);
offsetContent = -1; //not needed anymore, don't update when offset changes
//Then add to the next free object (annotEntry)
//add right before the xref table or stream
//if its a table, place element before the xref table
//
// sigEntry is the ref to the signature content. Next we need the signature object
var sigEntry = findFreeXrefNr(pdf.xref.entries, [annotEntry]);
//
// {annotEntry} 0 obj
// <</F 132/Type/Annot/Subtype/Widget/Rect[0 0 0 0]/FT/Sig/DR<<>>/T(signature)/V Y 0 R>>
// endobj
//
var append = annotEntry + ' 0 obj\n<</F 132/Type/Annot/Subtype/Widget/Rect[0 0 0 0]/FT/Sig/DR<<>>/T(signature' + annotEntry + ')/V ' + sigEntry + ' 0 R>>\nendobj\n\n';
// we want the offset just before the last xref table or entry
var blocks = findXrefBlocks(pdf.xref.xrefBlocks);
var offsetAnnot = blocks[0].start;
array = insertIntoArray(array, offsetAnnot, append);
//no updateXrefOffset, as the next entry will be following
//
// {sigEntry} 0 obj
// <</Contents <0481801e6d931d561563fb254e27c846e08325570847ed63d6f9e35 ... b2c8788a5>
// /Type/Sig/SubFilter/adbe.pkcs7.detached/Location(Ghent)/M(D:20120928104114+02'00')
// /ByteRange [A B C D]/Filter/Adobe.PPKLite/Reason(Test)/ContactInfo()>>
// endobj
//
//the next entry goes below the above
var offsetSig = offsetAnnot + append.length;
// Both {annotEntry} and {sigEntry} objects need to be added to the last xref table. The byte range needs
// to be adjusted. Since the signature will always be in a gap, use first an empty sig
// to check the size, add ~25% size, then calculate the signature and place in the empty
// space.
var start = sigEntry + ' 0 obj\n<</Contents <';
var dummy = await sign_pki(signingCert, certificateChain, privateKey, stringToUint8Array('A'), date);
//TODO: Adobe thinks its important to have the right size, no idea why this is the case
var crypto = new Array(round256(dummy.length * 2)).join('0');
var middle = '>\n/Type/Sig/SubFilter/adbe.pkcs7.detached/Location()/M(D:' + now(date) + '\')\n/ByteRange ';
var byteRange = '[0000000000 0000000000 0000000000 0000000000]';
var end = '/Filter/Adobe.PPKLite/Reason()/ContactInfo()>>\nendobj\n\n';
//all together
var append2 = start + crypto + middle + byteRange + end;
var offsetByteRange = start.length + crypto.length + middle.length;
array = insertIntoArray(array, offsetSig, append2);
updateXrefOffset(pdf.xref, offsetAnnot, append2.length + append.length);
//find the xref tables, remove them and also the EOF, as we'll write a new table
var xrefBlocks = findXrefBlocks(pdf.xref.xrefBlocks);
for (var i in xrefBlocks) {
var oldSize = array.length;
array = removeFromArray(array, xrefBlocks[i].start, xrefBlocks[i].end);
var length = array.length - oldSize;
updateXrefOffset(pdf.xref, xrefBlocks[i].start, length);
//check for %%EOF and remove it as well
var offsetEOF = find(array, '%%EOF', xrefBlocks[i].start, xrefBlocks[i].start + 20);
if (offsetEOF > 0) {
var lengthEOF = '%%EOF'.length;
array = removeFromArray(array, offsetEOF, offsetEOF + lengthEOF);
updateXrefOffset(pdf.xref, offsetEOF, -lengthEOF);
updateXrefBlocks(xrefBlocks, offsetEOF, -lengthEOF);
offsetAnnot = updateOffset(offsetAnnot, offsetEOF, -lengthEOF);
offsetSig = updateOffset(offsetSig, offsetEOF, -lengthEOF);
}
updateXrefBlocks(xrefBlocks, xrefBlocks[i].start, length);
offsetAnnot = updateOffset(offsetAnnot, xrefBlocks[i].start, length);
offsetSig = updateOffset(offsetSig, xrefBlocks[i].start, length);
}
var sha256Hex = await sha256(array);
//add the new entries to the xref
pdf.xref.entries[annotEntry] = {offset: offsetAnnot, gen: 0, free: false};
pdf.xref.entries[sigEntry] = {offset: offsetSig, gen: 0, free: false};
var xrefTable = createXrefTable(pdf.xref.entries);
//also empty entries count as in the PDF spec, page 720 (example)
xrefTable += createTrailer(pdf.xref.topDict, array.length, sha256Hex, pdf.xref.entries.length);
array = insertIntoArray(array, array.length, xrefTable);
//since we consolidate, no prev! [adjust /Prev -> rawparsing + offset]
var from1 = 0;
var to1 = offsetSig + start.length;
var from2 = to1 + crypto.length;
var to2 = (array.length - from2) - 1;
var byteRange = '[' + pad10(from1) + ' ' + pad10(to1 - 1) + ' ' + pad10(from2 + 1) + ' ' + pad10(to2) + ']';
array = updateArray(array, (offsetSig + offsetByteRange), byteRange);
var data = removeFromArray(array, to1 - 1, from2 + 1);
var crypto2 = await sign_pki(signingCert, certificateChain, privateKey, data.buffer, date);
array = updateArray(array, to1, crypto2);
return array;
} catch (err) {
throw new Error('Error creating new signature in PDF: ' + err);
}
}
async function appendSig(pdf, root, rootSuccessor, date, signingCert, certificateChain, privateKey) {
try {
//copy root and the entry with contents to the end
var startRoot = pdf.stream.bytes.length + 1;
var array = copyToEnd(pdf.stream.bytes, root.offset - 1, rootSuccessor.offset);
//since we signed the first one, we know how the pdf has to look like:
var offsetAcroForm = find(array, '/AcroForm<</Fields', startRoot);
var endOffsetAcroForm = find(array, ']', offsetAcroForm);
var annotEntry = findFreeXrefNr(pdf.xref.entries);
var sigEntry = findFreeXrefNr(pdf.xref.entries, [annotEntry]);
var appendAnnot = ' ' + annotEntry + ' 0 R';
array = insertIntoArray(array, endOffsetAcroForm, appendAnnot);
//we need to add Annots [x y R] to the /Type /Page section. We can do that by searching /Annots
var pages = pdf.catalog.catDict.get('Pages');
//get first page, we have hidden sig, so don't bother
var contentRef = pages.get('Kids')[0];
var xref = pdf.xref.fetch(contentRef);
var offsetAnnotEnd = xref.get('#Annots_offset');
//we now search ], this is safe as we signed it previously
var endOffsetAnnot = find(array, ']', offsetAnnotEnd);
var xrefEntry = pdf.xref.getEntry(contentRef.num);
var xrefEntrySuccosser = findSuccessorEntry(pdf.xref.entries, xrefEntry);
var offsetAnnotRelative = endOffsetAnnot - xrefEntrySuccosser.offset;
var startContent = array.length;
array = copyToEnd(array, xrefEntry.offset, xrefEntrySuccosser.offset);
array = insertIntoArray(array, array.length + offsetAnnotRelative, appendAnnot);
var startAnnot = array.length;
var append = annotEntry + ' 0 obj\n<</F 132/Type/Annot/Subtype/Widget/Rect[0 0 0 0]/FT/Sig/DR<<>>/T(signature' + annotEntry + ')/V ' + sigEntry + ' 0 R>>\nendobj\n\n';
array = insertIntoArray(array, startAnnot, append);
var startSig = array.length;
var start = sigEntry + ' 0 obj\n<</Contents <';
var dummy = await sign_pki(signingCert, certificateChain, privateKey, stringToUint8Array('A'), date);
//TODO: Adobe thinks its important to have the right size, no idea why this is the case
var crypto = new Array(round256(dummy.length * 2)).join('0');
var middle = '>\n/Type/Sig/SubFilter/adbe.pkcs7.detached/Location()/M(D:' + now(date) + '\')\n/ByteRange ';
var byteRange = '[0000000000 0000000000 0000000000 0000000000]';
var end = '/Filter/Adobe.PPKLite/Reason()/ContactInfo()>>\nendobj\n\n';
//all together
var append2 = start + crypto + middle + byteRange + end;
array = insertIntoArray(array, startSig, append2);
var sha256Hex = await sha256(array);
var prev = pdf.xref.xrefBlocks[0];
var startxref = array.length;
var xrefEntries = [];
xrefEntries[0] = {offset: 0, gen: 65535, free: true};
xrefEntries[pdf.xref.topDict.getRaw('Root').num] = {offset: startRoot, gen: 0, free: false};
xrefEntries[contentRef.num] = {offset: startContent, gen: 0, free: false};
xrefEntries[annotEntry] = {offset: startAnnot, gen: 0, free: false};
xrefEntries[sigEntry] = {offset: startSig, gen: 0, free: false};
var xrefTable = createXrefTableAppend(xrefEntries);
xrefTable += createTrailer(pdf.xref.topDict, startxref, sha256Hex, xrefEntries.length, prev);
array = insertIntoArray(array, array.length, xrefTable);
var from1 = 0;
var to1 = startSig + start.length;
var from2 = to1 + crypto.length;
var to2 = (array.length - from2) - 1;
var byteRange = '[' + pad10(from1) + ' ' + pad10(to1 - 1) + ' ' + pad10(from2 + 1) + ' ' + pad10(to2) + ']';
array = updateArray(array, from2 + middle.length, byteRange);
//now sign from1-to1 / from2-to2 and update byterange
var data = removeFromArray(array, to1 - 1, from2 + 1);
var crypto2 = await sign_pki(signingCert, certificateChain, privateKey, data.buffer, date);
array = updateArray(array, to1, crypto2);
return array;
} catch (err) {
throw new Error('Error appending signature in PDF: ' + err);
}
}
function loadPdf(pdfArray) {
try {
var pdf = new pdfjsCoreDocument.PDFDocument(false, pdfArray, '');
pdf.parseStartXRef();
pdf.parse();
return pdf;
}
catch(err) {
throw new Error('Error parsing PDF: ' + err);
}
}
//data must be Uint8Array
async function sign_pki(signingCert, certificateChain, privateKey, data, date) {
console.log("Calling sign_pki");
const crypto = getCrypto();
//date = typeof date !== 'undefined' ? date : new Date();
const hashAlg = "SHA-256";
const digest = await crypto.digest({ name: hashAlg }, data);
const signedAttr = [];
signedAttr.push(new Attribute({
type: "1.2.840.113549.1.9.3",
values: [
new ObjectIdentifier({ value: "1.2.840.113549.1.7.1" })
]
})); // contentType
signedAttr.push(new Attribute({
type: "1.2.840.113549.1.9.4",
values: [
new OctetString({ valueHex: digest })
]
})); // messageDigest
signedAttr.push(new Attribute({
type: "1.2.840.113549.1.9.5",
values: [
new UTCTime({ valueDate: date })
]
})); // signingTime
const cmsSignedSimpl = new SignedData({
version: 1,
encapContentInfo: new EncapsulatedContentInfo({
eContentType: "1.2.840.113549.1.7.1" // "data" content type
}),
signerInfos: [
new SignerInfo({
version: 1,
sid: new IssuerAndSerialNumber({
issuer: signingCert.issuer,
serialNumber: signingCert.serialNumber
}),
signedAttrs: new SignedAndUnsignedAttributes({
type: 0,
attributes: signedAttr
})
})
],
certificates: certificateChain
});
const signatureBuffer = await cmsSignedSimpl.sign(privateKey, 0, hashAlg, data.buffer);
const cmsSignedSchema = cmsSignedSimpl.toSchema(true);
const cmsContentSimp = new ContentInfo({
contentType: "1.2.840.113549.1.7.2",
content: cmsSignedSchema
});
const _cmsSignedSchema = cmsContentSimp.toSchema();
//region Make length of some elements in "indefinite form"
_cmsSignedSchema.lenBlock.isIndefiniteForm = true;
const block1 = _cmsSignedSchema.valueBlock.value[1];
block1.lenBlock.isIndefiniteForm = true;
const block2 = block1.valueBlock.value[0];
block2.lenBlock.isIndefiniteForm = true;
//endregion
let cmsSignedBuffer = _cmsSignedSchema.toBER(false);
const cmsSignedArray = new Uint8Array(cmsSignedBuffer);
const cmsSignedString = uint8ArrayToString(cmsSignedArray);
const hex = strHex(cmsSignedString);
return hex;
}
async function signPdfObjects (pdfRaw, signingCert, certificateChain, privateKey, date) {
console.log("Calling signPdfObjects");
date = ((typeof date !== 'undefined') && (date !== null)) ? date : new Date();
if (pdfRaw instanceof Buffer) {
pdfRaw = new Uint8Array(pdfRaw);
} else
if(pdfRaw instanceof ArrayBuffer) {
pdfRaw = new Uint8Array(pdfRaw);
}
console.log("Calling loadPdf");
var pdf = loadPdf(pdfRaw);
console.log("Calling findRootEntry");
var root = findRootEntry(pdf.xref);
console.log("Calling findSuccessorEntry");
var rootSuccessor = findSuccessorEntry(pdf.xref.entries, root);
console.log("Calling isSigInRoot");
if(!isSigInRoot(pdf)) {
console.log("Calling newSig");
return await newSig(pdf, root, rootSuccessor, date, signingCert, certificateChain, privateKey);
} else {
console.log("Calling appendSig");
return await appendSig(pdf, root, rootSuccessor, date, signingCert, certificateChain, privateKey);
}
}
export async function signPdf(pdfRaw, signingCert, certificateChain, privateKey) {
console.log("Calling signPdf");
const signingCertObj = parseCertificate(signingCert);
const certificateChainObj = [];
certificateChainObj[0] = parseCertificate(signingCert);
for (let i = 0; i < certificateChain.length; i++) {
certificateChainObj[i + 1] = parseCertificate(certificateChain[i])
}
let privateKeyDecoded;
try {
console.log("Calling parsePrivateKey");
privateKeyDecoded = await parsePrivateKey(privateKey);
} catch (e) {
console.log("Error decoding private key: ", e);
throw new Error('Error decoding private key: ' + e);
}
return await signPdfObjects(pdfRaw, signingCertObj, certificateChainObj, privateKeyDecoded);
/*
* Based on PDFSign v1.0.0
* https://github.com/Communication-Systems-Group/pdfsign.js
*
* Copyright 2015, Thomas Bocek, University of Zurich
*
* Licensed under the MIT license:
* http://www.opensource.org/licenses/MIT
*/
import {
ObjectIdentifier,
UTCTime,
OctetString
} from 'asn1js';
import {
ContentInfo,
SignedData,
Attribute,
SignerInfo,
IssuerAndSerialNumber,
SignedAndUnsignedAttributes,
EncapsulatedContentInfo,
getCrypto
} from 'pkijs';
import {
parseCertificate,
parsePrivateKey,
} from './signingUtilities';
//keep this import to include the patched version of pdfjs library
import {PDFJS} from "../lib/pdfjs.parser.js";
function createXrefTable(xrefEntries) {
xrefEntries = sortOnKeys(xrefEntries);
var retVal ='xref\n';
var last = -2;
for(var i in xrefEntries) {
i = parseInt(i);
if(typeof xrefEntries[i].offset === 'undefined') { continue; }
retVal += calcFlow(i, last, xrefEntries);
var offset = xrefEntries[i].offset;
retVal += pad10(offset)+' '+pad5(xrefEntries[i].gen)+' '+(xrefEntries[i].free?'f':'n')+' \n';
last = i;
}
return retVal;
}
function calcFlow(i, last, xrefEntries) {
if(last + 1 === i) {return '';}
var count = 1;
while(typeof xrefEntries[(i+count)] !== 'undefined'
&& typeof xrefEntries[(i+count)].offset !== 'undefined') {count ++;}
return i + ' '+count+'\n';
}
function createTrailer(topDict, startxref, sha256Hex, size, prev) {
var retVal ='trailer <<\n';
retVal +=' /Size '+(size)+'\n';
var refRoot = topDict.getRaw('Root');
if(typeof refRoot !== 'undefined') {
retVal +=' /Root '+refRoot.num+' '+refRoot.gen+' R\n';
}
var refInfo = topDict.getRaw('Info');
if(typeof refInfo !== 'undefined') {
retVal +=' /Info '+refInfo.num+' '+refInfo.gen+' R\n';
}
retVal +=' /ID [<'+sha256Hex.substring(0,32)+'><'+sha256Hex.substring(32,64)+'>]\n';
if(typeof prev !== 'undefined' ) {
retVal +=' /Prev '+prev+'\n';
}
retVal +='>>\n';
retVal +='startxref\n';
retVal +=startxref + '\n';
retVal +='%%EOF\n';
return retVal;
}
function createXrefTableAppend(xrefEntries) {
xrefEntries = sortOnKeys(xrefEntries);
var retVal ='xref\n';
var last = -2;
for(var i in xrefEntries) {
i = parseInt(i);
if(typeof xrefEntries[i].offset === 'undefined') { continue; }
retVal += calcFlow(i, last, xrefEntries);
var offset = xrefEntries[i].offset;
retVal += pad10(offset)+' '+pad5(xrefEntries[i].gen)+' '+(xrefEntries[i].free?'f':'n')+' \n';
last = i;
}
return retVal;
}
//http://stackoverflow.com/questions/10946880/sort-a-dictionary-or-whatever-key-value-data-structure-in-js-on-word-number-ke
function sortOnKeys(dict) {
var sorted = [];
for(var key in dict) {
sorted[sorted.length] = key;
}
sorted.sort();
var tempDict = {};
for(var i = 0; i < sorted.length; i++) {
tempDict[sorted[i]] = dict[sorted[i]];
}
return tempDict;
}
function removeFromArray(array, from, to) {
var cutlen = to - from;
var buf = new Uint8Array(array.length - cutlen);
for (var i = 0; i < from; i++) {
buf[i] = array[i];
}
for (var i = to, len = array.length; i < len; i++) {
buf[i-cutlen] = array[i];
}
return buf;
}
function findXrefBlocks(xrefBlocks) {
var num = xrefBlocks.length / 2;
var retVal = [];
for (var i=0;i<num;i++) {
retVal.push({start: xrefBlocks[i], end: xrefBlocks[i+num]});
}
return retVal;
}
function convertUint8ArrayToBinaryString(u8Array) {
var i, len = u8Array.length, b_str = "";
for (i=0; i<len; i++) {
b_str += String.fromCharCode(u8Array[i]);
}
return b_str;
}
function arrayObjectIndexOf(array, start, end, orig) {
for(var i = 0, len = array.length; i < len; i++) {
if ((array[i].start === start) && (array[i].end === end) && (array[i].orig === orig)) {
return i;
}
}
return -1;
}
function pad10(num) {
var s = "000000000" + num;
return s.substr(s.length-10);
}
function pad5(num) {
var s = "0000" + num;
return s.substr(s.length-5);
}
function pad2(num) {
var s = "0" + num;
return s.substr(s.length-2);
}
function findRootEntry(xref) {
var rootNr = xref.root.objId.substring(0, xref.root.objId.length - 1);
return xref.entries[rootNr];
}
function findSuccessorEntry(xrefEntries, current) {
//find it first
var currentOffset = current.offset;
var currentMin = Number.MAX_SAFE_INTEGER;
var currentMinIndex = -1;
for(var i in xrefEntries) {
if(xrefEntries[i].offset > currentOffset) {
if(xrefEntries[i].offset < currentMin) {
currentMin = xrefEntries[i].offset;
currentMinIndex = i;
}
}
}
if(currentMinIndex === -1) {
return current;
}
return xrefEntries[currentMinIndex];
}
function updateArray(array, pos, str) {
var upd = stringToUint8Array(str);
for (var i = 0, len=upd.length; i < len; i++) {
array[i+pos] = upd[i];
}
return array;
}
function copyToEnd(array, from, to) {
var buf = new Uint8Array(array.length + (to - from));
for (var i = 0, len=array.length; i < len; i++) {
buf[i] = array[i];
}
for (var i = 0, len=(to - from); i < len; i++) {
buf[array.length + i] = array[from + i];
}
return buf;
}
function insertIntoArray(array, pos, str) {
var ins = stringToUint8Array(str);
var buf = new Uint8Array(array.length + ins.length);
for (var i = 0; i < pos; i++) {
buf[i] = array[i];
}
for (var i = 0; i < ins.length; i++) {
buf[pos+i] = ins[i];
}
for (var i = pos; i < array.length; i++) {
buf[ins.length+i] = array[i];
}
return buf;
}
function stringToUint8Array(str) {
var buf = new Uint8Array(str.length);
for (var i=0, strLen=str.length; i<strLen; i++) {
buf[i] = str.charCodeAt(i);
}
return buf;
}
function uint8ArrayToString(buf, from, to) {
if(typeof from !== 'undefined' && typeof to !== 'undefined') {
var s = '';
for (var i=from; i<to; i++) {
s = s + String.fromCharCode(buf[i]);
}
return s;
}
return String.fromCharCode.apply(null, buf);
}
function findFreeXrefNr(xrefEntries, used) {
used = typeof used !== 'undefined' ? used : [];
var inc = used.length;
for (var i=1;i<xrefEntries.length;i++) {
var index = used.indexOf(i);
var entry = xrefEntries[""+i];
if(index === -1 && (typeof entry === 'undefined' || entry.free)) {
return i;
}
if(index !== -1) {
inc--;
}
}
return xrefEntries.length + inc;
}
function find(uint8, needle, start, limit) {
start = typeof start !== 'undefined' ? start : 0;
limit = typeof limit !== 'undefined' ? limit : Number.MAX_SAFE_INTEGER;
var search = stringToUint8Array(needle);
var match = 0;
for(var i=start;i<uint8.length && i<limit;i++) {
if(uint8[i] === search[match]) {
match++;
} else {
match = 0;
if(uint8[i] === search[match]) {
match++;
}
}
if(match === search.length) {
return (i + 1) - match;
}
}
return -1;
}
function findBackwards(uint8, needle, start, limit) {
start = typeof start !== 'undefined' ? start : uint8.length;
limit = typeof limit !== 'undefined' ? limit : Number.MAX_SAFE_INTEGER;
var search = stringToUint8Array(needle);
var match = search.length - 1;
for(var i=start;i>=0 && i<limit;i--) {
if(uint8[i] === search[match]) {
match--;
} else {
match = search.length - 1;
if(uint8[i] === search[match]) {
match--;
}
}
if(match === 0) {
return i - 1;
}
}
return -1;
}
function strHex(s) {
var a = "";
for( var i=0; i<s.length; i++ ) {
a = a + pad2(s.charCodeAt(i).toString(16));
}
return a;
}
async function sha256(array) {
const cryptoLib = getCrypto();
const digestTmpBuf = await cryptoLib.digest({ name: "SHA-256" }, array);
const digestTmpArray = new Uint8Array(digestTmpBuf);
const digestTmpStr = uint8ArrayToString(digestTmpArray);
const sha256Hex = strHex(digestTmpStr);
return sha256Hex;
}
function isSigInRoot(pdf) {
if (typeof pdf.acroForm === 'undefined') {
return false;
}
if (!pdf.acroForm) {
return false;
}
return pdf.acroForm.get('SigFlags') === 3;
}
function updateXrefOffset(xref, offset, offsetDelta) {
for(var i in xref.entries) {
if(xref.entries[i].offset >= offset) {
xref.entries[i].offset += offsetDelta;
}
}
for(var i in xref.xrefBlocks) {
if(xref.xrefBlocks[i] >= offset) {
xref.xrefBlocks[i] += offsetDelta;
}
}
}
function updateXrefBlocks(xrefBlocks, offset, offsetDelta) {
for(var i in xrefBlocks) {
if(xrefBlocks[i].start >= offset) {
xrefBlocks[i].start += offsetDelta;
}
if(xrefBlocks[i].end >= offset) {
xrefBlocks[i].end += offsetDelta;
}
}
}
function updateOffset(pos, offset, offsetDelta) {
if(pos >= offset) {
return pos + offsetDelta;
}
return pos;
}
function round256(x) {
return (Math.ceil(x/256)*256) - 1;
}
/**
* (D:YYYYMMDDHHmmSSOHH'mm)
* e.g. (D:20151210164400+01'00')
* where:
* YYYY shall be the year
* MM shall be the month (01–12)
* DD shall be the day (01–31)
* HH shall be the hour (00–23)
* mm shall be the minute (00–59)
* SS shall be the second (00–59)
* O shall be the relationship of local time to Universal Time (UT), and shall be denoted by one of the characters PLUS SIGN (U+002B) (+), HYPHEN-MINUS (U+002D) (-), or LATIN CAPITAL LETTER Z (U+005A) (Z) (see below)
* HH followed by APOSTROPHE (U+0027) (') shall be the absolute value of the offset from UT in hours (00–23)
* mm shall be the absolute value of the offset from UT in minutes (00–59)
*/
function now(date) {
//date = typeof date !== 'undefined' ? date : new Date();
var yyyy = date.getFullYear().toString();
var MM = pad2(date.getMonth() + 1);
var dd = pad2(date.getDate());
var hh = pad2(date.getHours());
var mm = pad2(date.getMinutes());
var ss = pad2(date.getSeconds());
return yyyy + MM + dd+ hh + mm + ss + createOffset(date);
}
function createOffset(date) {
var sign = (date.getTimezoneOffset() > 0) ? "-" : "+";
var offset = Math.abs(date.getTimezoneOffset());
var hours = pad2(Math.floor(offset / 60));
var minutes = pad2(offset % 60);
return sign + hours + "'" + minutes;
}
async function newSig(pdf, root, rootSuccessor, date, signingCert, certificateChain, privateKey) {
try {
// {annotEntry} is the ref to the annot widget. If we enlarge the array, make sure all the offsets
// after the modification will be updated -> xref table and startxref
var annotEntry = findFreeXrefNr(pdf.xref.entries);
// we'll store all the modifications we make, as we need to adjust the offset in the PDF
var offsetForm = find(pdf.stream.bytes, '<<', root.offset, rootSuccessor.offset) + 2;
//first we need to find the root element and add the following:
//
// /AcroForm<</Fields[{annotEntry} 0 R] /SigFlags 3>>
//
var appendAcroForm = '/AcroForm<</Fields[' + annotEntry + ' 0 R] /SigFlags 3>>';
//before we insert the acroform, we find the right place for annotentry
//we need to add Annots [x y R] to the /Type /Page section. We can do that by searching /Contents[
var pages = pdf.catalog.catDict.get('Pages');
//get first page, we have hidden sig, so don't bother
var ref = pages.get('Kids')[0];
var xref = pdf.xref.fetch(ref);
var offsetContentEnd = xref.get('#Contents_offset');
//we now search backwards, this is safe as we don't expect user content here
var offsetContent = findBackwards(pdf.stream.bytes, '/Contents', offsetContentEnd);
var appendAnnots = '/Annots[' + annotEntry + ' 0 R]\n ';
//now insert string into stream
var array = insertIntoArray(pdf.stream.bytes, offsetForm, appendAcroForm);
//recalculate the offsets in the xref table, only update those that are affected
updateXrefOffset(pdf.xref, offsetForm, appendAcroForm.length);
offsetContent = updateOffset(offsetContent, offsetForm, appendAcroForm.length);
var array = insertIntoArray(array, offsetContent, appendAnnots);
updateXrefOffset(pdf.xref, offsetContent, appendAnnots.length);
offsetContent = -1; //not needed anymore, don't update when offset changes
//Then add to the next free object (annotEntry)
//add right before the xref table or stream
//if its a table, place element before the xref table
//
// sigEntry is the ref to the signature content. Next we need the signature object
var sigEntry = findFreeXrefNr(pdf.xref.entries, [annotEntry]);
//
// {annotEntry} 0 obj
// <</F 132/Type/Annot/Subtype/Widget/Rect[0 0 0 0]/FT/Sig/DR<<>>/T(signature)/V Y 0 R>>
// endobj
//
var append = annotEntry + ' 0 obj\n<</F 132/Type/Annot/Subtype/Widget/Rect[0 0 0 0]/FT/Sig/DR<<>>/T(signature' + annotEntry + ')/V ' + sigEntry + ' 0 R>>\nendobj\n\n';
// we want the offset just before the last xref table or entry
var blocks = findXrefBlocks(pdf.xref.xrefBlocks);
var offsetAnnot = blocks[0].start;
array = insertIntoArray(array, offsetAnnot, append);
//no updateXrefOffset, as the next entry will be following
//
// {sigEntry} 0 obj
// <</Contents <0481801e6d931d561563fb254e27c846e08325570847ed63d6f9e35 ... b2c8788a5>
// /Type/Sig/SubFilter/adbe.pkcs7.detached/Location(Ghent)/M(D:20120928104114+02'00')
// /ByteRange [A B C D]/Filter/Adobe.PPKLite/Reason(Test)/ContactInfo()>>
// endobj
//
//the next entry goes below the above
var offsetSig = offsetAnnot + append.length;
// Both {annotEntry} and {sigEntry} objects need to be added to the last xref table. The byte range needs
// to be adjusted. Since the signature will always be in a gap, use first an empty sig
// to check the size, add ~25% size, then calculate the signature and place in the empty
// space.
var start = sigEntry + ' 0 obj\n<</Contents <';
var dummy = await sign_pki(signingCert, certificateChain, privateKey, stringToUint8Array('A'), date);
//TODO: Adobe thinks its important to have the right size, no idea why this is the case
var crypto = new Array(round256(dummy.length * 2)).join('0');
var middle = '>\n/Type/Sig/SubFilter/adbe.pkcs7.detached/Location()/M(D:' + now(date) + '\')\n/ByteRange ';
var byteRange = '[0000000000 0000000000 0000000000 0000000000]';
var end = '/Filter/Adobe.PPKLite/Reason()/ContactInfo()>>\nendobj\n\n';
//all together
var append2 = start + crypto + middle + byteRange + end;
var offsetByteRange = start.length + crypto.length + middle.length;
array = insertIntoArray(array, offsetSig, append2);
updateXrefOffset(pdf.xref, offsetAnnot, append2.length + append.length);
//find the xref tables, remove them and also the EOF, as we'll write a new table
var xrefBlocks = findXrefBlocks(pdf.xref.xrefBlocks);
for (var i in xrefBlocks) {
var oldSize = array.length;
array = removeFromArray(array, xrefBlocks[i].start, xrefBlocks[i].end);
var length = array.length - oldSize;
updateXrefOffset(pdf.xref, xrefBlocks[i].start, length);
//check for %%EOF and remove it as well
var offsetEOF = find(array, '%%EOF', xrefBlocks[i].start, xrefBlocks[i].start + 20);
if (offsetEOF > 0) {
var lengthEOF = '%%EOF'.length;
array = removeFromArray(array, offsetEOF, offsetEOF + lengthEOF);
updateXrefOffset(pdf.xref, offsetEOF, -lengthEOF);
updateXrefBlocks(xrefBlocks, offsetEOF, -lengthEOF);
offsetAnnot = updateOffset(offsetAnnot, offsetEOF, -lengthEOF);
offsetSig = updateOffset(offsetSig, offsetEOF, -lengthEOF);
}
updateXrefBlocks(xrefBlocks, xrefBlocks[i].start, length);
offsetAnnot = updateOffset(offsetAnnot, xrefBlocks[i].start, length);
offsetSig = updateOffset(offsetSig, xrefBlocks[i].start, length);
}
var sha256Hex = await sha256(array);
//add the new entries to the xref
pdf.xref.entries[annotEntry] = {offset: offsetAnnot, gen: 0, free: false};
pdf.xref.entries[sigEntry] = {offset: offsetSig, gen: 0, free: false};
var xrefTable = createXrefTable(pdf.xref.entries);
//also empty entries count as in the PDF spec, page 720 (example)
xrefTable += createTrailer(pdf.xref.topDict, array.length, sha256Hex, pdf.xref.entries.length);
array = insertIntoArray(array, array.length, xrefTable);
//since we consolidate, no prev! [adjust /Prev -> rawparsing + offset]
var from1 = 0;
var to1 = offsetSig + start.length;
var from2 = to1 + crypto.length;
var to2 = (array.length - from2) - 1;
var byteRange = '[' + pad10(from1) + ' ' + pad10(to1 - 1) + ' ' + pad10(from2 + 1) + ' ' + pad10(to2) + ']';
array = updateArray(array, (offsetSig + offsetByteRange), byteRange);
var data = removeFromArray(array, to1 - 1, from2 + 1);
var crypto2 = await sign_pki(signingCert, certificateChain, privateKey, data.buffer, date);
array = updateArray(array, to1, crypto2);
return array;
} catch (err) {
throw new Error('Error creating new signature in PDF: ' + err);
}
}
async function appendSig(pdf, root, rootSuccessor, date, signingCert, certificateChain, privateKey) {
try {
//copy root and the entry with contents to the end
var startRoot = pdf.stream.bytes.length + 1;
var array = copyToEnd(pdf.stream.bytes, root.offset - 1, rootSuccessor.offset);
//since we signed the first one, we know how the pdf has to look like:
var offsetAcroForm = find(array, '/AcroForm<</Fields', startRoot);
var endOffsetAcroForm = find(array, ']', offsetAcroForm);
var annotEntry = findFreeXrefNr(pdf.xref.entries);
var sigEntry = findFreeXrefNr(pdf.xref.entries, [annotEntry]);
var appendAnnot = ' ' + annotEntry + ' 0 R';
array = insertIntoArray(array, endOffsetAcroForm, appendAnnot);
//we need to add Annots [x y R] to the /Type /Page section. We can do that by searching /Annots
var pages = pdf.catalog.catDict.get('Pages');
//get first page, we have hidden sig, so don't bother
var contentRef = pages.get('Kids')[0];
var xref = pdf.xref.fetch(contentRef);
var offsetAnnotEnd = xref.get('#Annots_offset');
//we now search ], this is safe as we signed it previously
var endOffsetAnnot = find(array, ']', offsetAnnotEnd);
var xrefEntry = pdf.xref.getEntry(contentRef.num);
var xrefEntrySuccosser = findSuccessorEntry(pdf.xref.entries, xrefEntry);
var offsetAnnotRelative = endOffsetAnnot - xrefEntrySuccosser.offset;
var startContent = array.length;
array = copyToEnd(array, xrefEntry.offset, xrefEntrySuccosser.offset);
array = insertIntoArray(array, array.length + offsetAnnotRelative, appendAnnot);
var startAnnot = array.length;
var append = annotEntry + ' 0 obj\n<</F 132/Type/Annot/Subtype/Widget/Rect[0 0 0 0]/FT/Sig/DR<<>>/T(signature' + annotEntry + ')/V ' + sigEntry + ' 0 R>>\nendobj\n\n';
array = insertIntoArray(array, startAnnot, append);
var startSig = array.length;
var start = sigEntry + ' 0 obj\n<</Contents <';
var dummy = await sign_pki(signingCert, certificateChain, privateKey, stringToUint8Array('A'), date);
//TODO: Adobe thinks its important to have the right size, no idea why this is the case
var crypto = new Array(round256(dummy.length * 2)).join('0');
var middle = '>\n/Type/Sig/SubFilter/adbe.pkcs7.detached/Location()/M(D:' + now(date) + '\')\n/ByteRange ';
var byteRange = '[0000000000 0000000000 0000000000 0000000000]';
var end = '/Filter/Adobe.PPKLite/Reason()/ContactInfo()>>\nendobj\n\n';
//all together
var append2 = start + crypto + middle + byteRange + end;
array = insertIntoArray(array, startSig, append2);
var sha256Hex = await sha256(array);
var prev = pdf.xref.xrefBlocks[0];
var startxref = array.length;
var xrefEntries = [];
xrefEntries[0] = {offset: 0, gen: 65535, free: true};
xrefEntries[pdf.xref.topDict.getRaw('Root').num] = {offset: startRoot, gen: 0, free: false};
xrefEntries[contentRef.num] = {offset: startContent, gen: 0, free: false};
xrefEntries[annotEntry] = {offset: startAnnot, gen: 0, free: false};
xrefEntries[sigEntry] = {offset: startSig, gen: 0, free: false};
var xrefTable = createXrefTableAppend(xrefEntries);
xrefTable += createTrailer(pdf.xref.topDict, startxref, sha256Hex, xrefEntries.length, prev);
array = insertIntoArray(array, array.length, xrefTable);
var from1 = 0;
var to1 = startSig + start.length;
var from2 = to1 + crypto.length;
var to2 = (array.length - from2) - 1;
var byteRange = '[' + pad10(from1) + ' ' + pad10(to1 - 1) + ' ' + pad10(from2 + 1) + ' ' + pad10(to2) + ']';
array = updateArray(array, from2 + middle.length, byteRange);
//now sign from1-to1 / from2-to2 and update byterange
var data = removeFromArray(array, to1 - 1, from2 + 1);
var crypto2 = await sign_pki(signingCert, certificateChain, privateKey, data.buffer, date);
array = updateArray(array, to1, crypto2);
return array;
} catch (err) {
throw new Error('Error appending signature in PDF: ' + err);
}
}
function loadPdf(pdfArray) {
try {
var pdf = new pdfjsCoreDocument.PDFDocument(false, pdfArray, '');
pdf.parseStartXRef();
pdf.parse();
return pdf;
}
catch(err) {
throw new Error('Error parsing PDF: ' + err);
}
}
//data must be Uint8Array
async function sign_pki(signingCert, certificateChain, privateKey, data, date) {
console.log("Calling sign_pki");
const crypto = getCrypto();
//date = typeof date !== 'undefined' ? date : new Date();
const hashAlg = "SHA-256";
const digest = await crypto.digest({ name: hashAlg }, data);
const signedAttr = [];
signedAttr.push(new Attribute({
type: "1.2.840.113549.1.9.3",
values: [
new ObjectIdentifier({ value: "1.2.840.113549.1.7.1" })
]
})); // contentType
signedAttr.push(new Attribute({
type: "1.2.840.113549.1.9.4",
values: [
new OctetString({ valueHex: digest })
]
})); // messageDigest
signedAttr.push(new Attribute({
type: "1.2.840.113549.1.9.5",
values: [
new UTCTime({ valueDate: date })
]
})); // signingTime
const cmsSignedSimpl = new SignedData({
version: 1,
encapContentInfo: new EncapsulatedContentInfo({
eContentType: "1.2.840.113549.1.7.1" // "data" content type
}),
signerInfos: [
new SignerInfo({
version: 1,
sid: new IssuerAndSerialNumber({
issuer: signingCert.issuer,
serialNumber: signingCert.serialNumber
}),
signedAttrs: new SignedAndUnsignedAttributes({
type: 0,
attributes: signedAttr
})
})
],
certificates: certificateChain
});
const signatureBuffer = await cmsSignedSimpl.sign(privateKey, 0, hashAlg, data.buffer);
const cmsSignedSchema = cmsSignedSimpl.toSchema(true);
const cmsContentSimp = new ContentInfo({
contentType: "1.2.840.113549.1.7.2",
content: cmsSignedSchema
});
const _cmsSignedSchema = cmsContentSimp.toSchema();
//region Make length of some elements in "indefinite form"
_cmsSignedSchema.lenBlock.isIndefiniteForm = true;
const block1 = _cmsSignedSchema.valueBlock.value[1];
block1.lenBlock.isIndefiniteForm = true;
const block2 = block1.valueBlock.value[0];
block2.lenBlock.isIndefiniteForm = true;
//endregion
let cmsSignedBuffer = _cmsSignedSchema.toBER(false);
const cmsSignedArray = new Uint8Array(cmsSignedBuffer);
const cmsSignedString = uint8ArrayToString(cmsSignedArray);
const hex = strHex(cmsSignedString);
return hex;
}
async function signPdfObjects (pdfRaw, signingCert, certificateChain, privateKey, date) {
console.log("Calling signPdfObjects");
date = ((typeof date !== 'undefined') && (date !== null)) ? date : new Date();
if (pdfRaw instanceof Buffer) {
pdfRaw = new Uint8Array(pdfRaw);
} else
if(pdfRaw instanceof ArrayBuffer) {
pdfRaw = new Uint8Array(pdfRaw);
}
console.log("Calling loadPdf");
var pdf = loadPdf(pdfRaw);
console.log("Calling findRootEntry");
var root = findRootEntry(pdf.xref);
console.log("Calling findSuccessorEntry");
var rootSuccessor = findSuccessorEntry(pdf.xref.entries, root);
console.log("Calling isSigInRoot");
if(!isSigInRoot(pdf)) {
console.log("Calling newSig");
return await newSig(pdf, root, rootSuccessor, date, signingCert, certificateChain, privateKey);
} else {
console.log("Calling appendSig");
return await appendSig(pdf, root, rootSuccessor, date, signingCert, certificateChain, privateKey);
}
}
export async function signPdf(pdfRaw, signingCert, certificateChain, privateKey) {
console.log("Calling signPdf");
const signingCertObj = parseCertificate(signingCert);
const certificateChainObj = [];
certificateChainObj[0] = parseCertificate(signingCert);
for (let i = 0; i < certificateChain.length; i++) {
certificateChainObj[i + 1] = parseCertificate(certificateChain[i])
}
let privateKeyDecoded;
try {
console.log("Calling parsePrivateKey");
privateKeyDecoded = await parsePrivateKey(privateKey);
} catch (e) {
console.log("Error decoding private key: ", e);
throw new Error('Error decoding private key: ' + e);
}
return await signPdfObjects(pdfRaw, signingCertObj, certificateChainObj, privateKeyDecoded);
}
\ No newline at end of file