21d5323132
* Rework faux-redaction audit per maintainer review - Paint-order aware: a rectangle counts as a cover only when painted strictly after the text (positions from the joined content stream). - Colour-aware: WCAG contrast between text and cover must be below 3.0, so page backgrounds, table shading and highlights are not flagged. - Fail closed: audit_redactions returns Err on undecodable content streams (decoded_strict) and malformed /Annots; the operator bound is an error, not a silent truncation. - Graphics state carries across a page's content streams (one joined walk); form XObjects still isolate their state at Do. - Audit-only: the sanitize-for-sharing half is dropped (upstream #162). - Parity entry marked partial, not shipped. * Audit: register its layer, add a README, fail closed past 32 nested forms, document what it doesn't check --------- Co-authored-by: Erick Barraza <ejbarraza1994@gmail.com> Co-authored-by: Brandon Thomas <echelon@gmail.com> |
||
|---|---|---|
| .. | ||
| src | ||
| Cargo.toml | ||
| README.md | ||
README.md
pdfcraft-audit
Layer L4 (may use edit): verification tooling, the faux-redaction audit.
let findings: Vec<Finding> = audit_redactions(&doc)?; // page, kind, rect, covered_text
It reports two kinds of finding:
- faux redaction: an opaque filled rectangle painted after text it overlaps, dark enough against the text's colour (WCAG contrast below 3) to hide it, while the text is still extractable underneath;
- unapplied mark: a Redact annotation that was marked but never applied.
A properly applied redaction removes the text, so it never flags. Page backgrounds, table shading and highlights don't either: they're painted before the text, or light against it.
Limits, by design and documented rather than hidden:
- only
rerectangles closed by a fill count as covers (not arbitrary paths, shadings or patterns), and a translucent one (/cabelow 1) is not flagged; - covers inside form XObjects are found, but only text drawn directly in the page content is checked under them;
- annotation rectangles are compared in unrotated user space, so
/Rotatepages may misalign.
It fails closed: an undecodable content stream, malformed /Annots, form XObjects nested deeper
than 32 or in a cycle, or a walk past the operator bound is an error, never "no findings".
Surfaces: the redact_audit automation tool and pdfcraft-cli.