Qubes: maliciously creafted PDF could limit the number of pages converted

[deeplow]

7 months ago in commit aeeed4

• search = re.search(r"^Pages: (\d+)", line) got replaced with
• search = re.search(r"Pages:\s*(\d+)\s*\n", stdout.decode())
  This code parsed the output of pdfinfo and this meant that if the PDF had metadata called Pages: 1, the end "safe" pdf would be 1 page long, regardless of the original length.

This document is a proof of concept. It has 4 pages but when converted (in Qubes) it results in 1 page. This is not security-critical since the Qubes port is in alpha and with no security guarantees and in the containers version (Windows, macOS and Linux) it only affects the timeout.

A fix is pretty simple:

diff --git a/dangerzone/conversion/doc_to_pixels.py b/dangerzone/conversion/doc_to_pixels.py
index 38f16150..48f301dc 100644
--- a/dangerzone/conversion/doc_to_pixels.py
+++ b/dangerzone/conversion/doc_to_pixels.py
@@ -254,7 +254,7 @@ class DocumentToPixels(DangerzoneConverter):
             timeout=timeout,
         )
 
-        search = re.search(r"Pages:\s*(\d+)\s*\n", stdout.decode())
+        search = re.search(r"^Pages:\s*(\d+)\s*\n", stdout.decode(), re.MULTILINE)
         if search is not None:
             num_pages: int = int(search.group(1))
         else:

However, a more long-term fix is finding python bindings for pdfinfo or a similar tool with such bindings or python module.