Add opt-in structured XML exemption for Europass CV PDFs

[iobrado]

Description

This adds an opt-in exemption so the PDF scanner stops rejecting Europass CVs, whose builder attaches a machine-readable XML copy of every CV it exports.

Why

• A real Europass export embeds attachment.xml, a <Candidate> document in the http://www.europass.eu/1.0 namespace.
• The file carries no /Subtype, /AFRelationship or /AF, so only the payload bytes can identify it.
• /EmbeddedFile was only exempt for C2PA manifests, so every Europass CV came back as validationFilePdfUnsafe.

Embedded-file verifier refactor

• Rename C2paManifestVerifier to EmbeddedFileVerifier, which keeps only the structural walk.
• Move the JUMBF/C2PA check unchanged into C2paPayloadValidator.
• Add EmbeddedPayloadValidatorInterface (maxBytes(), accepts($payload, $name)).
• Require every embedded stream to pass at least one enabled validator.
• Keep all existing defences: qpdf-only, /ObjStm, /RF, duplicate objects, /Filter, the endstream extent check and the backstop.

File specification names

• Read /F and /UF from the innermost dictionary that contains the /EF, with a single linear pass over the brackets.
• Treat the name as optional, since C2PA Filespecs often have none.
• Reject a name that is unreadable, duplicated, non-ASCII, or different between /F and /UF.
• Reject one stream reached under two different names, which closes "verified as attachment.xml, saved as payload.exe".

Structured XML exemption

• Add StructuredXmlPayloadValidator, which checks in this order:
  • An exact, case-sensitive name on the allowlist (attachment.xml, Europass-XML-Attachment.xml)
  • The 5 MB cap
  • Strict UTF-8 with no control bytes
  • No <!DOCTYPE or <!ENTITY in the raw bytes
  • A full XMLReader parse with LIBXML_NONET
  • The allowlisted root element and namespace
• Add Config::FILE_UPLOAD_PDF_STRUCTURED_XML_ALLOWLIST and FILE_UPLOAD_PDF_STRUCTURED_XML_MAX_BYTES.
• Add the fileSecurityPdfAllowStructuredXml filter, registered in Filters.php.
• The filter is off by default, needs exactly true and needs qpdf, the same as fileSecurityPdfAllowC2pa.
• Add an xmlreader row to the File security diagnostics tab.

add_filter('es_forms_validation_file_security_pdf_allow_structured_xml', '__return_true');

Deliberately not exempted

• LibreOffice hybrid PDFs (Original.odt), which are ZIPs that can carry macros.
• PDF Portfolios and LaTeX attachfile/embedfile.
• Factur-X, ZUGFeRD and XRechnung invoices. Adding them later only needs allowlist entries, once real samples confirm the details.

Accepted residual risk

• Base64 data inside the Europass XML (a photo, and legacy attached documents) passes through as inert text.
• No reader extracts or opens it. /JS, /Launch, /RichMedia and the other blocked keys still apply to the whole PDF.

Tests

• verify-c2pa.php and verify-pdf-scanner.php changed only in class names, and every existing case passes.
• The new tests/security/verify-structured-xml.php harness has 59 checks, and its synthetic fixtures mean no real CV is committed.
• I disabled each key defence in turn to confirm that at least one check fails without it.
• A real Europass export is accepted with the filter on, and rejected by default, with C2PA only, with a truthy 1, and without qpdf.
• composer test, bun run lintJs and bun run lintStyle all pass.

Changelog (for the release)

• Added fileSecurityPdfAllowStructuredXml filter. When enabled, the PDF scanner accepts Europass CVs, whose only dangerous key is the embedded machine-readable CV XML. The file name must be on an allowlist and the payload must parse as the expected Europass document with no DTD. Disabled by default and requires qpdf, like fileSecurityPdfAllowC2pa.

Known follow-ups

• Check the legacy SkillsPassport format against a real 2013–2020 export.
• The pre-commit hook fails on commits that contain only tests/ PHP files, because PHPStan excludes tests/.

🤖 Generated with Claude Code

[goranalkovic-infinum]

The Europass exception looks well scoped, and keeping it off by default is a good choice. I’d request two changes before merging:

1. Fix repeated scanning of nested dictionaries. The new filename lookup repeatedly scans the same content when PDF dictionaries are nested. With a roughly 1 MB PDF containing 100 nested dictionaries, verification increased from 0.09s to 8.48s after qpdf processing. This affects the existing C2PA exception too and could let repeated uploads tie up server workers. Please collect filenames in one pass or cap the processing work, and add a regression test.

2. Run the security tests in CI. composer test doesn’t execute the three security harnesses, so GitHub can stay green even if attachment validation breaks. Please run them in CI with generated fixtures, qpdf, and the required PHP extensions.

[piqusy]

Reproduced both open findings locally (PHP 8.4.25, qpdf 12.4.1, xmlreader loaded). All three harnesses pass on this branch. Requesting changes on the same two points, with measurements.

1. Nested dictionaries re-scan the region per level (perf regression)

collectEmbeddedFileReferences() in src/Validation/FileSecurity/EmbeddedFileVerifier.php caches owner names by $ownerStart, so a body where every nesting level owns an /EF re-runs readDictionary() plus fileSpecName() (a mask() byte loop and two preg_match_all passes) over the remaining region for each level. The "read each owner once" comment only holds when owner dictionaries are small. The inline-filespecs case in the harness stays linear; this shape does not. It also affects C2PA-only opt-ins, because name reading happens regardless of which validators are enabled.

Measured on the same 0.95 MB body with 100 nested dictionaries and one embedded stream, identical verdict on both sides:

code	time
C2paManifestVerifier (release/10.6.0)	0.08s
EmbeddedFileVerifier (this branch)	7.41s

That is ~93x. Fix direction: record each << extent during the existing bracket walk and derive the name in one pass, or cap cumulative name-scan work and fail closed to name = null. The second keeps semantics intact: the C2PA validator ignores names, and the XML validator then rejects, which is the same treatment a readable-but-unverified name already gets. Please also add a timed nested-dictionary case to tests/security/verify-structured-xml.php; the cost section currently covers inline filespecs and many references to one stream, not nesting.

2. Security harnesses run nowhere in CI

.github/workflows/ci.yml runs composer lint and node lint only. composer test excludes tests/, and the pre-commit hook skips tests-only PHP commits (noted in the PR description). These harnesses are the only executable tests for this code, and the Playwright E2E never reaches the PDF verdicts. Please add a CI job that runs the three harnesses directly:

php tests/security/verify-c2pa.php
php tests/security/verify-structured-xml.php
php tests/security/verify-pdf-scanner.php

They need no vendor directory, they need dom, xmlreader and qpdf, and the qpdf-dependent checks skip cleanly when qpdf is absent, so a plain setup-php runner works.

Verified clean on this branch

Name pinning (one stream reached under two names rejects), /F + /UF disagree, duplicate and non-ASCII rejection, UTF-16BE hex names, XXE / DOCTYPE / SettingContent-ms / wrong-namespace rejection, DTD search on raw bytes before libxml, LIBXML_NONET with no LIBXML_NOENT, and the existing /RF, /ObjStm, /Filter and endstream checks. array_any is fine given "php": ">=8.4" in composer.json.

[piqusy]

Both review findings are addressed and I verified the fixes locally (PHP 8.4.25, qpdf 12.4.1, xmlreader loaded), so approving.

1. Name-reading cap (afb61859). Measured on the same 0.95 MB body with 100 nested dictionaries and one embedded stream that reproduced the original regression:

code	time	verdict
release/10.6.0	0.08s	accepted
f144724	7.41s	accepted
fa56125	0.27s	rejected, fail-closed

Cost is linear again. The new 100 nested Filespecs around 1 MB case in tests/security/verify-structured-xml.php passes in 0.27s against a 1.0s budget and pins the fail-closed verdict, so a future regression fails the harness. I also checked the edge where an exhausted budget makes the read limit drop below the owner start: readDictionary() returns null immediately, the capped path records an unnamed owner, and the $limit === strlen($region) guard still rejects a genuinely unreadable uncapped owner. One behavior change worth restating for the record: a stream reached from both a named owner and a capped owner now fails the one-stream, one-name rule, including for C2PA-only opt-ins. Fail-closed and deliberate, fine by me.

2. CI coverage (250ea3dd). The security job installs the right extensions and qpdf, generates fixtures through the existing tests/security/generate-test-files.sh, and fails on both harness failures (bash -e plus pipefail) and skips (the grep '^SKIP' guard). Verified the YAML parses and all three harnesses pass on this head.

Two non-blocking nits are filed in #659; happy either way, they can ride in a follow-up PR if you agree they are worth it.