[jira] [Updated] (PDFBOX-3322) Warning "You did not close a PDF Document" when visual signature is added

["Bernd Engelhardt (JIRA)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/PDFBOX-3322?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Bernd Engelhardt updated PDFBOX-3322:
-------------------------------------
    Attachment: addSignatureFix.patch

We encountered a problem which may be related to this.
As we are adding (/creating) signatures in one method and are saving the created document in another method, we do leave the scope in which we defined the SignatureOptions object. We did not realize, that the SignatureOptions class is closeable, so we did neither store it's instance (thus preventing garbage collection until we want to terminate it.) nor did we take other measures to ensure, that the COSDocument and it's substructures will not be terminated before the document has been saved.

First of all: Thanks for clearing things up! I read through your comments and was able to understand what we were doing wrong and how it could be fixed...

However - as the existing solution is already providing a fallback for users who don't close documents, we would suggest to expand that approach. (We actually do close PDDocuments actively - but didn't realize we would have to in this case)

Summary: If a visual signature is added and the temporary COSDocument of the SignatureOptions instance is garbage collected before saving the document, this will result in corrupted files/exceptions. If however the PDDocument - the Signature is added to - would clone the COSObjects of the temporary COSDocument such errors would be prevented entirely.

You could argue, that we caused the problem in the first place, by not realizing that SignatureOptions is implementing the Closeable interface and handling it accordingly - but I expected a class containg the term "Options" in it's name, would rather be some kind of POJO or simple property container, instead of managing resources aswell... It does feel counterintuitive to a certain extend.

We want to make a suggestion by providing a small two line patch, which does clone the substructures of the temporary COSDocument and thus prevents such errors. When applying this patch, the local options container (Method: "addSignature(PDSignature sigObject, SignatureInterface signatureInterface, SignatureOptions options)" Class: PDDocument) may theoretically be closed directly after calling "prepareVisibleSignature(signatureField, acroForm, visualSignature)". If that thought was expanded upon and the temporary COSDocument was removed from the SignatureOptions class, it would not have to be a Closeable anymore, plus the management of the temporary COSDocument and resulting pitfalls (such as the one we encountered) would be removed.

Keep up the good work!

> Warning "You did not close a PDF Document" when visual signature is added
> -------------------------------------------------------------------------
>
>                 Key: PDFBOX-3322
>                 URL: https://issues.apache.org/jira/browse/PDFBOX-3322
>             Project: PDFBox
>          Issue Type: Improvement
>          Components: PDModel, Signing
>    Affects Versions: 1.8.11
>            Reporter: Petras
>            Assignee: Tilman Hausherr
>              Labels: signature
>         Attachments: addSignatureFix.patch, PDFBOX_3322_VisualSignatureClosing.patch
>
>
> When visual signature is added, warning "You did not close a PDF Document" is added to the output log. It appears, that _VisualSignatureParser_ creates an instance of _COSDocument_ and later is held by _SignatureOptions_, but for this instance the {{#close()}} method is never called, which results to that warning reported by its {{#finalize()}} method.
> Probably it should by closed by _PDDocument_ when used after signing.



--
This message was sent by Atlassian JIRA
(v6.3.15#6346)

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@pdfbox.apache.org
For additional commands, e-mail: dev-help@pdfbox.apache.org