-
Notifications
You must be signed in to change notification settings - Fork 257
The preview of v7 at least shows it version number, which is not really needed I would think. It would even open up the possibility of unwanted attention would this library ever have a vulnerability. I'm fine with not being able to set it to any string, but just a name should be enough.
All reactions
Replies: 1 comment 2 replies
What a "vulnerability" could that be? It would be a vulnerability of the PDF file.
If such a "vulnerability" could exist, what good would it do if PDF files only showed "Producer XYZ"? Seeing "Producer XYZ" in the file would give no hint whether the "vulnerability" could apply.
Producer can be faked anyway. Some apps modify PDF files without updating the Producer.
All reactions
In the sense when running some service that creates a pdf. A malicious party could then manipulate the input to trigger a potential vulnerable path in the code.
All reactions
What a "vulnerability" could that be? It would be a vulnerability of the PDF file.
Attackers try to use any known vulnerabilities on any service.
I don't see that dropping the version number would make anything better.
Applying your reasoning, one would have to drop "PDFsharp" completely and use a fake name. Back to "security by obscurity".
PDFsharp is not a web service., it is 100 % managed C# code.
Well, yes, if a web shop uses PDFsharp to create invoices, an attacker could try to manipulate the input data. There is no way that uninitialized memory blocks will be copied to the PDF, exposing secrets from other processes.