,hC ddlZddlZddlZddlmZddlmZmZmZm Z m Z m Z ddl m Z ddlmZddlmZmZmZmZmZmZmZGdd ZGd d eZ dd lmZmZdd lmZGddeZGddeZ de!de!de!fdZ"de!de!de!fdZ#de!de!de!fdZ$de!de!de!fdZ%de!de!de!de!fdZ&de!de!de!de!fdZ'Gd$d%Z)e!gd&Z*de!de!fd'Z+Gd(d)Z,Gd*d+Z-Gd,d-eZ.Gd.d/Z/y#e($rYGddeZGddeZ de!de!de!fdZ"de!de!de!fdZ#de!de!de!fd Z$de!de!de!fd!Z%de!de!de!de!fd"Z&de!de!de!de!fd#Z'YwxYw)0N)IntEnum)AnyDictOptionalTupleUnioncast)logger_warningDependencyError) ArrayObjectByteStringObjectDictionaryObject PdfObject StreamObjectTextStringObjectcreate_string_objectc,eZdZdedefdZdedefdZy) CryptBasedatareturnc|SNselfrs T/var/www/html/Resume-Scraper/venv/lib/python3.12/site-packages/PyPDF2/_encryption.pyencryptzCryptBase.encrypt0 c|Srrrs rdecryptzCryptBase.decrypt3r r!N)__name__ __module__ __qualname__bytesrr#rr!rrr/s(EeEer!rc eZdZy) CryptIdentityN)r$r%r&rr!rr)r)7sr!r))AESARC4)padc<eZdZdeddfdZdedefdZdedefdZy)CryptRC4keyrNc||_yrr/rr/s r__init__zCryptRC4.__init__@ DHr!rc^tj|jj|Sr)r+ ARC4Cipherr/rrs rrzCryptRC4.encryptC ??488,44T: :r!c^tj|jj|Sr)r+r6r/r#rs rr#zCryptRC4.decryptFr7r!r$r%r&r'r3rr#rr!rr.r.?s;  $  ; ;% ; ; ;% ;r!r.c<eZdZdeddfdZdedefdZdedefdZy)CryptAESr/rNc||_yrr1r2s rr3zCryptAES.__init__Jr4r!rc FttdtdD}dt|dzz |ttfdtDz }t j |j tj|}||j|zS)Nc3HK|]}tjddyw)rN)randomrandint.0_s r z#CryptAES.encrypt..Ns KA3!7 K "c3"K|]}ywrr)rCrDps rrEz#CryptAES.encrypt..Ps#8!A#8s ) r' bytearrayrangelenr*newr/MODE_CBCr)rrivaesrIs @rrzCryptAES.encryptMszy Kr KKLBSY^#A E)#8uQx#889 9D''$((CLL"5C D)) )r!c|dd}|dd}tj|jtj|}t |dzr t |d}|j |}t |dk(r|S|d|d S)NrGr)r*rMr/rNrLr,r#)rrrOrPds rr#zCryptAES.decryptTsxcrB9D''$((CLL"5C4y2~4} D!A1v{AbE6{"r!r9rr!rr;r;Is;  $  * *% * # #% #r!r;r/rrcJtj|j|Sr)r+r6rr/rs r RC4_encryptrV`s#++D11r!cJtj|j|Sr)r+r6r#rUs r RC4_decryptrYcrWr!chtj|tjj|Sr)r*rMMODE_ECBrrUs rAES_ECB_encryptr\f"wwsCLL)11$77r!chtj|tjj|Sr)r*rMr[r#rUs rAES_ECB_decryptr_ir]r!rOcjtj|tj|j|Sr)r*rMrNrr/rOrs rAES_CBC_encryptrbl$wwsCLL"-55d;;r!cjtj|tj|j|Sr)r*rMrNr#ras rAES_CBC_decryptreorcr!c<eZdZdeddfdZdedefdZdedefdZy)r.r/rNcttd|_d}tdD]b}||j|z||t|zzdz}|j||j|c|j|<|j|<dy)Nr)listrKSrL)rr/jis rr3zCryptRC4.__init__us~%*%DFA3Z <]SSX%66#='+vvay$&&)$q 466!9 .~s3Qq3 )rrr rh)rirjrKrLr'rJ)rrrjoutrlrkkxs rrzCryptRC4.encrypt|sTVV A3%D "233CDAq3t9% %UcM1X$qT1Q4 !adqtad{c)*a1A  % 3( (r!c$|j|Sr)rrs rr#zCryptRC4.decrypts<<% %r!r9rr!rr.r.ts; < <$ < ) )% ) & &% &r!c<eZdZdeddfdZdedefdZdedefdZy)r;r/rNcyrrr2s rr3zCryptAES.__init__s r!rctdNz*PyCryptodome is required for AES algorithmr rs rrzCryptAES.encrypt!"NO Or!ctdrxr rs rr#zCryptAES.decryptryr!r9rr!rr;r;sA  $  P P% P P P% Pr!c6t|j|Sr)r.rrUs rrVrV}$$T**r!c6t|j|Sr)r.r#rUs rrYrYr|r!ctdrxr rUs rr\r\JKKr!ctdrxr rUs rr_r_rr!ctdrxr ras rrbrbrr!ctdrxr ras rrererr!cDeZdZdedededdfdZdedefdZdedefd Zy) CryptFilterstmCryptstrCryptefCryptrNc.||_||_||_yr)rrr)rrrrs rr3zCryptFilter.__init__s!    r!objctSr)NotImplemented)rrs rencrypt_objectzCryptFilter.encrypt_objectsr!ct|ttfr2|jj |j }t |}|St|tr,|jj |j|_ |St|tr7t|jD]\}}|j|||<|St|tr0tt!|D]}|j||||<|Sr) isinstancerrrr#original_bytesrrr_datarriitemsdecrypt_objectrrKrL)rrrdictkeyvaluerls rrzCryptFilter.decrypt_objects c,.>? @==((););/ rSizc|tzddS)N )_PADDING)rs r_paddingrs 8OSb !!r!ceZdZededededededededefd Zed edededefd Zed ed ededefdZ ededededefdZ ed ededededededededefdZ ed ededededededededefdZ y)AlgV4passwordrevkey_sizeo_entryP id1_entrymetadata_encryptedrct|}tj|}|j||jt j d||j||dk\r|dur|jd|j } |dz} |dk\r6tdD](} tj| d| j } *| d| S) u Algorithm 2: Computing an encryption key. a) Pad or truncate the password string to exactly 32 bytes. If the password string is more than 32 bytes long, use only its first 32 bytes; if it is less than 32 bytes long, pad it by appending the required number of additional bytes from the beginning of the following padding string: < 28 BF 4E 5E 4E 75 8A 41 64 00 4E 56 FF FA 01 08 2E 2E 00 B6 D0 68 3E 80 2F 0C A9 FE 64 53 69 7A > That is, if the password string is n bytes long, append the first 32 - n bytes of the padding string to the end of the password string. If the password string is empty (zero-length), meaning there is no user password, substitute the entire padding string in its place. b) Initialize the MD5 hash function and pass the result of step (a) as input to this function. c) Pass the value of the encryption dictionary’s O entry to the MD5 hash function. ("Algorithm 3: Computing the encryption dictionary’s O (owner password) value" shows how the O value is computed.) d) Convert the integer value of the P entry to a 32-bit unsigned binary number and pass these bytes to the MD5 hash function, low-order byte first. e) Pass the first element of the file’s file identifier array (the value of the ID entry in the document’s trailer dictionary; see Table 15) to the MD5 hash function. f) (Security handlers of revision 4 or greater) If document metadata is not being encrypted, pass 4 bytes with the value 0xFFFFFFFF to the MD5 hash function. g) Finish the hash. h) (Security handlers of revision 3 or greater) Do the following 50 times: Take the output from the previous MD5 hash and pass the first n bytes of the output as input into a new MD5 hash, where n is the number of bytes of the encryption key as defined by the value of the encryption dictionary’s Length entry. i) Set the encryption key to the first n bytes of the output from the final MD5 hash, where n shall always be 5 for security handlers of revision 2 but, for security handlers of revision 3 or greater, shall depend on the value of the encryption dictionary’s Length entry. .d%=a!e%=)rrVrKr'rJ)rrrrrc4_encr/rls @rcompute_O_valuezAlgV4.compute_O_value]s_ ] #gq) !81b\ 4I%=W%==>%c73 4r!r/cF|dkrt|t}|S tjt}|j |t||j }t ddD]+ttfd|D}t||}-t|S)u] Algorithm 4: Computing the encryption dictionary’s U (user password) value. (Security handlers of revision 2) a) Create an encryption key based on the user password string, as described in "Algorithm 2: Computing an encryption key". b) Encrypt the 32-byte padding string shown in step (a) of "Algorithm 2: Computing an encryption key", using an RC4 encryption function with the encryption key from the preceding step. c) Store the result of step (b) as the value of the U entry in the encryption dictionary. r rc3(K|] }|z  ywrrrs rrEz(AlgV4.compute_U_value..s%9a!e%9r) rVrrrrrrKr'rJr)r/rrrrrrrls @rcompute_U_valuezAlgV4.compute_U_valuehs !8X.EL 2X& i c6==?3q" 4AI%9S%99:G!'73G 4  r!u_entryc tj|||||||}tj|||} |dk\r | dd} |dd}| |k7rd}|S)u Algorithm 6: Authenticating the user password. a) Perform all but the last step of "Algorithm 4: Computing the encryption dictionary’s U (user password) value (Security handlers of revision 2)" or "Algorithm 5: Computing the encryption dictionary’s U (user password) value (Security handlers of revision 3 or greater)" using the supplied password string. b) If the result of step (a) is equal to the value of the encryption dictionary’s U entry (comparing on the first 16 bytes in the case of security handlers of revision 3 or greater), the password supplied is the correct user password. The key obtained in step (a) (that is, in the first step of "Algorithm 4: Computing the encryption dictionary’s U (user password) value (Security handlers of revision 2)" or "Algorithm 5: Computing the encryption dictionary’s U (user password) value (Security handlers of revision 3 or greater)") shall be used to decrypt the document. rNrGr!)rrr) rrrrrrrrr/u_values rverify_user_passwordzAlgV4.verify_user_passwordsi0 3'1iAS ''S)< !8crlGcrlG g C r!c  tj|||}|dkr t||} n=|} tdddD]+ t t fd|D} t| | } -tj | |||||||S)u Algorithm 7: Authenticating the owner password. a) Compute an encryption key from the supplied password string, as described in steps (a) to (d) of "Algorithm 3: Computing the encryption dictionary’s O (owner password) value". b) (Security handlers of revision 2 only) Decrypt the value of the encryption dictionary’s O entry, using an RC4 encryption function with the encryption key computed in step (a). (Security handlers of revision 3 or greater) Do the following 20 times: Decrypt the value of the encryption dictionary’s O entry (first iteration) or the output from the previous iteration (all subsequent iterations), using an RC4 encryption function with a different encryption key at each iteration. The key shall be generated by taking the original key (obtained in step (a)) and performing an XOR (exclusive or) operation between each byte of the key and the single-byte value of the iteration counter (from 19 to 0). c) The result of step (b) purports to be the user password. Authenticate this user password using "Algorithm 6: Authenticating the user password". If it is correct, the password supplied is the correct owner password. rrRc3(K|] }|z  ywrrrs rrEz.AlgV4.verify_owner_password..rr)rrrYrKr'rJr) rrrrrrrrrrr/rls @rverify_owner_passwordzAlgV4.verify_owner_passwords4++NCJ !8'9M#M2r2& @I%=W%==> +C ?  @))         r!N) r$r%r& staticmethodr'intboolrrrrrrrr!rrrsA&A& A&A& A&  A&  A&!A& A&A&F(E((s(u((Tu351!U1!1!1!51!1!f           !    D+ + + +  +  +  + + !+  + + r!rcReZdZededededededef dZedededededef d Zededed ed edef d Zed ededede de f dZ ededed edede de e e ff dZ eded edeeeffdZeded ededeeeffdZed edede defdZy)AlgV5Rro_valueoe_valuerrc|dd}tj|||dd|dd|ddk7rytdtdD}tj|||dd|dd}t |||}|S) u Algorithm 3.2a Computing an encryption key. To understand the algorithm below, it is necessary to treat the O and U strings in the Encrypt dictionary as made up of three sections. The first 32 bytes are a hash value (explained below). The next 8 bytes are called the Validation Salt. The final 8 bytes are called the Key Salt. 1. The password string is generated from Unicode input by processing the input string with the SASLprep (IETF RFC 4013) profile of stringprep (IETF RFC 3454), and then converting to a UTF-8 representation. 2. Truncate the UTF-8 representation to 127 bytes if it is longer than 127 bytes. 3. Test the password against the owner key by computing the SHA-256 hash of the UTF-8 password concatenated with the 8 bytes of owner Validation Salt, concatenated with the 48-byte U string. If the 32-byte result matches the first 32 bytes of the O string, this is the owner password. Compute an intermediate owner key by computing the SHA-256 hash of the UTF-8 password concatenated with the 8 bytes of owner Key Salt, concatenated with the 48-byte U string. The 32-byte result is the key used to decrypt the 32-byte OE string using AES-256 in CBC mode with no padding and an initialization vector of zero. The 32-byte result is the file encryption key. 4. Test the password against the user key by computing the SHA-256 hash of the UTF-8 password concatenated with the 8 bytes of user Validation Salt. If the 32 byte result matches the first 32 bytes of the U string, this is the user password. Compute an intermediate user key by computing the SHA-256 hash of the UTF-8 password concatenated with the 8 bytes of user Key Salt. The 32-byte result is the key used to decrypt the 32-byte UE string using AES-256 in CBC mode with no padding and an initialization vector of zero. The 32-byte result is the file encryption key. 5. Decrypt the 16-byte Perms string using AES-256 in ECB mode with an initialization vector of zero and the file encryption key as the key. Verify that bytes 9-11 of the result are the characters ‘a’, ‘d’, ‘b’. Bytes 0-3 of the decrypted Perms entry, treated as a little-endian integer, are the user permissions. They should match the value in the P key. Nrr0r!c3 K|]}dywrorrBs rrEz.AlgV5.verify_owner_password..(1(rprGrcalculate_hashr'rKre)rrrrrrOtmp_keyr/s rrzAlgV5.verify_owner_passwordsBDS>  Hgbngcrl Ks|  (eBi( (&&q(GBrNGCRLQgr84 r!ue_valuec|dd}tj|||ddd|ddk7rytdtdD}tj|||ddd}t |||S) z"See :func:`verify_owner_password`.Nrrrr!c3 K|]}dywrorrBs rrEz-AlgV5.verify_user_password..#rrprGrr)rrrrrOrs rrzAlgV5.verify_user_passwordsv DS>   8WR^S AWSb\ Q (eBi( (&&q(GBrNCHwH55r!saltudatactj||z|zj}|dkr|Sd} |dz }||z|z}t|dd|dd|dz}tjtjtj ft |dddz}||j}|dk\r |d|dz krn|ddS) Nrr rGr@rrR)rsha256rrbsha384sha512sum) rrrrKcountK1Ehash_fns rrzAlgV5.calculate_hash's NN8d?U2 3 : : < q5H QJEA%B#2"R"r':A!CR&kAo G  !!#A{qu 2"v r!r/permsrIrct|rdnd}tjd|dz|zdz}t||}||ddk(S)zBSee :func:`verify_owner_password` and :func:`compute_Perms_value`.TFrradbNr)rrr_)r/rrIrb8p1p2s r verify_permszAlgV5.verify_perms<sI (TT [[q !$7 7" .fI!V--a5IrFrGNrc3 K|]}dywrorrBs rrEz(AlgV5.compute_U_value..lrrpr'rKrrrrb) rr/ random_bytesval_saltkey_saltrrrOrs rrzAlgV5.compute_U_valueYsIuRyII ##..H!45<<>IHT..H!45<<> (eBi( ("7B4  r!cTtdtdD}|dd}|dd}tj||z|zj |z|z}tj||z|zj }tdtdD}t |||} || fS)u+ Algorithm 3.9 Computing the encryption dictionary’s O (owner password) and OE (owner encryption key) values. 1. Generate 16 random bytes of data using a strong random number generator. The first 8 bytes are the Owner Validation Salt. The second 8 bytes are the Owner Key Salt. Compute the 32-byte SHA-256 hash of the password concatenated with the Owner Validation Salt and then concatenated with the 48-byte U string as generated in Algorithm 3.8. The 48-byte string consisting of the 32-byte hash followed by the Owner Validation Salt followed by the Owner Key Salt is stored as the O key. 2. Compute the 32-byte SHA-256 hash of the password concatenated with the Owner Key Salt and then concatenated with the 48-byte U string as generated in Algorithm 3.8. Using this hash as the key, encrypt the file encryption key using AES-256 in CBC mode with no padding and an initialization vector of zero. The resulting 32-byte string is stored as the OE key. c3HK|]}tjddywrrrBs rrEz(AlgV5.compute_O_value..rrFrGNrc3 K|]}dywrorrBs rrEz(AlgV5.compute_O_value..rrpr) rr/rrr r!rrrOrs rrzAlgV5.compute_O_valueps"IuRyII ## NN8h.8 9 @ @ BX MPX X ..H!4w!>?FFH (eBi( ("7B4  r!c|rdnd}tdtdD}tjd|dz|zdz|z}t ||}|S)u Algorithm 3.10 Computing the encryption dictionary’s Perms (permissions) value 1. Extend the permissions (contents of the P integer) to 64 bits by setting the upper 32 bits to all 1’s. (This allows for future extension without changing the format.) 2. Record the 8 bytes of permission in the bytes 0-7 of the block, low order byte first. 3. Set byte 8 to the ASCII value ' T ' or ' F ' according to the EncryptMetadata Boolean. 4. Set bytes 9-11 to the ASCII characters ' a ', ' d ', ' b '. 5. Set bytes 12-15 to 4 bytes of random data, which will be ignored. 6. Encrypt the 16-byte block using AES-256 in ECB mode with an initialization vector of zero, using the file encryption key as the key. The result (16 bytes) is stored as the Perms string, and checked for validity when the file is opened. rr c3HK|]}tjddywrrrBs rrEz,AlgV5.compute_Perms_value..s>6##As+>rFrrrr )r'rKrrr\)r/rIrr rrrrs rrzAlgV5.compute_Perms_valuesW(TT >U1X> >{{4#&99B>G"LT* r!N)r$r%r&rrr'rrrrrrrrrrrrrr!rrrs) ))*/);@)KP) ))V 6  6 6*/ 6;@ 6  6 6#eEe(  %(>B        !  c3h   $!%!e!eUl8K!!,!!#!.3! ue| !!83DUr!rceZdZdZdZdZy) PasswordTyperr rN)r$r%r& NOT_DECRYPTED USER_PASSWORDOWNER_PASSWORDrr!rr)r)sMMNr!r)ceZdZdedededededededd fd Zdefd Z d e d edede fdZ e dedededede f dZdeeefdefdZdedeeeffdZdedeeeffdZe dededdfdZy ) EncryptionalgValgRentryfirst_id_entryStmFStrFEFFrNc||_||_||_|jdd|_||_||_||_||_tj|_ d|_ y)Nz/Lengthr) r/r0r1getrrr3r4r5r)r*_password_type_key)rr/r0r1r2r3r4r5s rr3zEncryption.__init__s^    )R0 '  +88%) r!c<|jtjk7Sr)r8r)r*)rs r is_decryptedzEncryption.is_decrypteds""l&@&@@@r!ridnum generationctjd|dd}tjd|dd}|jsJ|j}|jdk(rdn|jdz}|d||z|z}t j |} | jdt|dzd} | jd | jdt|dzd} |} |j|j| | | } |j|j| | | }|j|j| | | }t| ||}|j|S) u{ Algorithm 1: Encryption of data using the RC4 or AES algorithms. a) Obtain the object number and generation number from the object identifier of the string or stream to be encrypted (see 7.3.10, "Indirect Objects"). If the string is a direct object, use the identifier of the indirect object containing it. b) For all strings and streams without crypt filter specifier; treating the object number and generation number as binary integers, extend the original n-byte encryption key to n + 5 bytes by appending the low-order 3 bytes of the object number and the low-order 2 bytes of the generation number in that order, low-order byte first. (n is 5 unless the value of V in the encryption dictionary is greater than 1, in which case n is the value of Length divided by 8.) If using the AES algorithm, extend the encryption key an additional 4 bytes by adding the value “sAlT”, which corresponds to the hexadecimal values 0x73, 0x41, 0x6C, 0x54. (This addition is done for backward compatibility and is not intended to provide additional security.) c) Initialize the MD5 hash function and pass the result of step (b) as input to this function. d) Use the first (n + 5) bytes, up to a maximum of 16, of the output from the MD5 hash as the key for the RC4 or AES symmetric key algorithms, along with the string or stream data to be encrypted. If using the AES algorithm, the Cipher Block Chaining (CBC) mode, which requires an initialization vector, is used. The block size parameter is set to 16 bytes, and the initialization vector is a 16-byte random number that is stored as the first 16 bytes of the encrypted stream or string. Algorithm 3.1a Encryption of data using the AES algorithm 1. Use the 32-byte file encryption key for the AES-256 symmetric key algorithm, along with the string or stream data to be encrypted. Use the AES algorithm in Cipher Block Chaining (CBC) mode, which requires an initialization vector. The block size parameter is set to 16 bytes, and the initialization vector is a 16-byte random number that is stored as the first 16 bytes of the encrypted stream or string. The output is the encrypted data to be stored in the PDF file. zE!!#ua1CD :H EBwr!encryption_entryc <|jd}|dk7r tdd|vr tdd}d}d}|jdd}|d vrtd |d |d k\r|d }|jdd}|jdd}|jd|}|dk7r||d}|dk7r||d}|dk7r||d}d}||vr td||vrtd|d||vrtd|dtt|d} t || |||||S)Nz/Filterz /Standardz1only Standard PDF encryption handler is availablez /SubFilterz/SubFilter NOT supported/V2z/Vr)r rrrr?z Encryption V=z NOT supportedrz/CFz/StmFrOz/StrFz/EFFz/CFM)rOrerNrMz!StmF Method {StmF} NOT supported!z StrF Method z NOT supported!z EFF Method rZ)r7NotImplementedErrorr rr.) rcr2filterr3r4r5Vfiltersallowed_methodsrs rreadzEncryption.readWs!%%i0 [ %C  + +%&@A A  q ) O #% aS&GH H 6&u-G#''=D#''=D"&&vt4C{"t}V,{"t}V,k!cl6*FO?*)*MNN?*)Lo*NOO/))KuO*LMM &t, -!Q 0.$cRRr!)r$r%r&rrr'rQr3rr;rrrrrArr)rXrrTrUrkrr!rr.r.sG*** *  *  *** *2AdA3&)3&C3&S3&Y3&j % %# %16 %DI %  % % uUCZ0 \ #/%#/E%2E,F#/J%E%2E,F6'S/'S'S<'S'Sr!r.)0rr@renumrtypingrrrrrr _utilsr errorsr genericrrrrrrrrr) Crypto.Cipherr*r+Crypto.Util.Paddingr,r.r;r'rVrYr\r_rbre ImportErrorrrrrrr)r.rr!rrtsb8 ::"# I jL'';9;#9#.22e2222e228U8%8E88U8%8E8