Release/10.6.0

[iobrado]

Description

This adds an opt-in exemption so the PDF scanner stops rejecting Europass CVs, whose builder attaches a machine-readable XML copy of every CV it exports.

Why

• A real Europass export embeds attachment.xml, a <Candidate> document in the http://www.europass.eu/1.0 namespace.
• The file carries no /Subtype, /AFRelationship or /AF, so only the payload bytes can identify it.
• /EmbeddedFile was only exempt for C2PA manifests, so every Europass CV came back as validationFilePdfUnsafe.

Embedded-file verifier refactor

• Rename C2paManifestVerifier to EmbeddedFileVerifier, which keeps only the structural walk.
• Move the JUMBF/C2PA check unchanged into C2paPayloadValidator.
• Add EmbeddedPayloadValidatorInterface (maxBytes(), accepts($payload, $name)).
• Require every embedded stream to pass at least one enabled validator.
• Keep all existing defences: qpdf-only, /ObjStm, /RF, duplicate objects, /Filter, the endstream extent check and the backstop.

File specification names

• Read /F and /UF from the innermost dictionary that contains the /EF, with a single linear pass over the brackets.
• Treat the name as optional, since C2PA Filespecs often have none.
• Reject a name that is unreadable, duplicated, non-ASCII, or different between /F and /UF.
• Reject one stream reached under two different names, which closes "verified as attachment.xml, saved as payload.exe".

Structured XML exemption

• Add StructuredXmlPayloadValidator, which checks in this order:
  • An exact, case-sensitive name on the allowlist (attachment.xml, Europass-XML-Attachment.xml)
  • The 5 MB cap
  • Strict UTF-8 with no control bytes
  • No <!DOCTYPE or <!ENTITY in the raw bytes
  • A full XMLReader parse with LIBXML_NONET
  • The allowlisted root element and namespace
• Add Config::FILE_UPLOAD_PDF_STRUCTURED_XML_ALLOWLIST and FILE_UPLOAD_PDF_STRUCTURED_XML_MAX_BYTES.
• Add the fileSecurityPdfAllowStructuredXml filter, registered in Filters.php.
• The filter is off by default, needs exactly true and needs qpdf, the same as fileSecurityPdfAllowC2pa.
• Add an xmlreader row to the File security diagnostics tab.

add_filter('es_forms_validation_file_security_pdf_allow_structured_xml', '__return_true');

Deliberately not exempted

• LibreOffice hybrid PDFs (Original.odt), which are ZIPs that can carry macros.
• PDF Portfolios and LaTeX attachfile/embedfile.
• Factur-X, ZUGFeRD and XRechnung invoices. Adding them later only needs allowlist entries, once real samples confirm the details.

Accepted residual risk

• Base64 data inside the Europass XML (a photo, and legacy attached documents) passes through as inert text.
• No reader extracts or opens it. /JS, /Launch, /RichMedia and the other blocked keys still apply to the whole PDF.

Tests

• verify-c2pa.php and verify-pdf-scanner.php changed only in class names, and every existing case passes.
• The new tests/security/verify-structured-xml.php harness has 59 checks, and its synthetic fixtures mean no real CV is committed.
• I disabled each key defence in turn to confirm that at least one check fails without it.
• A real Europass export is accepted with the filter on, and rejected by default, with C2PA only, with a truthy 1, and without qpdf.
• composer test, bun run lintJs and bun run lintStyle all pass.

Changelog (for the release)

• Added fileSecurityPdfAllowStructuredXml filter. When enabled, the PDF scanner accepts Europass CVs, whose only dangerous key is the embedded machine-readable CV XML. The file name must be on an allowlist and the payload must parse as the expected Europass document with no DTD. Disabled by default and requires qpdf, like fileSecurityPdfAllowC2pa.

Known follow-ups

• Check the legacy SkillsPassport format against a real 2013–2020 export.
• The pre-commit hook fails on commits that contain only tests/ PHP files, because PHPStan excludes tests/.

🤖 Generated with Claude Code