MokiMeow/pdf

[Critical] Security Bypass in "Protect PDF" & Coordinate Misalignment in Editor

Open

#1 opened on Dec 4, 2025

View on GitHub
 (0 comments) (1 reaction) (1 assignee)TypeScript (0 forks)auto 404
bugenhancementgood first issue

Repository metrics

Stars
 (0 stars)
PR merge metrics
 (PR metrics pending)

Description

Bug Report: Protect PDF Functionality Failure

Module: Protect PDF Severity: Critical

Current Behavior: When using the "Protect PDF" tool, I can upload a file and set a password. The system appears to process the file and provides a download. However, the resulting downloaded PDF does not actually require a password to open. It opens immediately in any viewer.

Expected Behavior: The downloaded PDF should be encrypted and prompt the user for the password before displaying content.

Bug Report: Signature Misalignment in Editor

Module: Edit PDF / Sign Severity: Medium

Current Behavior: When using the "Edit PDF" tool to add a signature, there is a significant offset. When I click on the canvas to place the signature, the element appears in a different location than where my cursor clicked. The mouse coordinates do not match the canvas.

Expected Behavior: The signature should appear exactly where the user clicks.

Contributor guide

Research direction
Inspect the PDF encryption code to verify password is applied, and check canvas coordinate mapping for signature placement.
Tech stack
typescript
Domain
backendfrontend
Issue type
Bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
2
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
Git
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
70