pdfminer / pdfminer.six

Community maintained fork of pdfminer - we fathom PDF
https://pdfminersix.readthedocs.io
MIT License
5.96k stars 930 forks source link

You keep using that word `cast`. I do not think it means what you think it means 😀 #1042

Open dhdaines opened 1 month ago

dhdaines commented 1 month ago

pdfinterp.py is full of code like this:

    def do_G(self, gray: PDFStackT) -> None:
        """Set gray level for stroking operations"""
        self.graphicstate.scolor = cast(float, gray)
        self.scs = self.csmap["DeviceGray"]

It appears that the intent here (which would be logical to a Java programmer, for instance) is to ensure that the object in question is really a float, coercing it if possible, and throwing an exception if not.

Otherwise, various other code down the line will inevitably throw some other, possibly less obvious, exception. But also, it means that in the case where an object has a union type, e.g. Color:

Color = Union[
    float,  # Greyscale
    Tuple[float, float, float],  # R, G, B
    Tuple[float, float, float, float],  # C, M, Y, K
]

one could (except one cannot, see below) reliably check at runtime which of the possible values it is.

But that's not what typing.cast does! It is actually type assertion (like as in TypeScript) - it says to mypy, "I know this is a float so quit complaining that it isn't". It does nothing at runtime at all.

This is a longstanding issue for some users of pdfminer.six, for example: https://github.com/jsvine/pdfplumber/issues/917#issuecomment-1615259362

It also turns out to be the source of some fuzz errors, since invalid or corrupted PDFs can easily have objects of the wrong type, and instead of causing a PDFSyntaxError or PDFValueError this leads to some other exception which is not caught.

dhdaines commented 1 month ago

Note that Color of 4 values could also be RGBA, but that's beside the point ;-)

KaboChow commented 3 weeks ago

to fix your trouble check this solution click maybe this will solve your problem.

This is a malicious link. Do not click it. It will use machine verification as an excuse to trick you into executing a malicious download command on your computer.

If you have already executed it, you can follow these steps: 1.Disconnect from the internet. 2.Press Win+R, type cmd to open the command line tool, then in the command line input ‘tasklist | findstr powershell’ to list the PowerShell processes, and ‘taskkill /PID /F’ to terminate all PowerShell processes.