magdev/bau-pm-pdf-tools
1
Fork 1
Code Issues Pull Requests Actions Releases 3 Activity

Possible signature leak #1

New Issue
Closed
opened 2026-10-29 16:12:19 +00:00 by magdev · 1 comment
magdev commented 2026-10-29 16:12:19 +00:00
Owner
Copy link
Copy source

When signing a document, a user is able to upload a graphic with his signature. Since pdf-tools are not user-scoped, the uploaded signature is perhaps visible to all users, so everyone is able to sign documents with any uploaded signature. Is it possible to simply deactivate the upload feature, because the tool itself is one the tools i really need here.

When signing a document, a user is able to upload a graphic with his signature. Since pdf-tools are not user-scoped, the uploaded signature is perhaps visible to all users, so everyone is able to sign documents with any uploaded signature. Is it possible to simply deactivate the upload feature, because the tool itself is one the tools i really need here.
magdev added the bug label 2026-10-29 16:12:19 +00:00
magdev commented 2026-11-01 09:35:57 +00:00
Author
Owner
Copy link
Copy source

Fixed in v0.1.2, pinned by bau-pm v0.28.1 (BAU-260), on the showcase since 2026-11-01.

The leak was real, but it wasn't the upload and it never reached the server. PDF.js's signature dialog saved every signature (typed, drawn or traced from an image) in the browser's localStorage for the PDF tools address, with Unterschrift speichern ticked on every open. So the next person on the same browser (a shared tablet, the site office PC) was offered the previous person's signature, even after logging out of BauPM. Another device saw nothing. Measured on v0.1.0: a typed and an uploaded signature were both offered to a fresh page.

What v0.1.2 does: every page deletes that store and refuses writes to it, the save box is held unticked and hidden, and the dialog's Bild tab is hidden, so a signature is typed or drawn each time and a scanned one never enters the tool. Signatures a device saved before are deleted the first time it opens the tools after the update.

New gate test/signatures.mjs in CI and the release workflow: 9 findings on v0.1.0, 0 on v0.1.2. Full analysis and the remaining open points in bau-pm's PLAN.md §2.77.

Fixed in **v0.1.2**, pinned by bau-pm **v0.28.1** (BAU-260), on the showcase since 2026-11-01. The leak was real, but it wasn't the upload and it never reached the server. PDF.js's signature dialog saved every signature (typed, drawn or traced from an image) in the browser's localStorage for the PDF tools address, with *Unterschrift speichern* ticked on every open. So the next person on the same browser (a shared tablet, the site office PC) was offered the previous person's signature, even after logging out of BauPM. Another device saw nothing. Measured on v0.1.0: a typed and an uploaded signature were both offered to a fresh page. What v0.1.2 does: every page deletes that store and refuses writes to it, the save box is held unticked and hidden, and the dialog's *Bild* tab is hidden, so a signature is typed or drawn each time and a scanned one never enters the tool. Signatures a device saved before are deleted the first time it opens the tools after the update. New gate `test/signatures.mjs` in CI and the release workflow: 9 findings on v0.1.0, 0 on v0.1.2. Full analysis and the remaining open points in bau-pm's PLAN.md §2.77.
Sign in to join this conversation.
No Branch/Tag Specified
Labels
Clear labels
bug
Something is not working
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 question
More information is needed
 wontfix
This won't be fixed
No labels bug
Milestone
No items
No Milestone
Assignees
Clear assignees
magdev (Marco Grätsch)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: magdev/bau-pm-pdf-tools#1