8 ms·
what's a good tool to check if a pdf is not tampered with eg. as a tool to check before loading a pdf from a public bucket to your backend application?
by geekodour 2y ago
what's a good tool to check if a pdf is not tampered with eg. as a tool to check before loading a pdf from a public bucket to your backend application?
- criddell 2y agoIf you sign the file, you should be able to verify that the signature still matches the file.
- remram 2y agoHow could a PDF be tampered with in your own bucket?
- verdverm 2y agoSounds like they amay be accepting user PDFs, saving them to a bucket, and then doing processing after.
- remram 2y agoThey trust their AWS EC2 instance doing the processing but not their AWS S3 bucket doing the storing? I don't really understand the threat model here. And what's "public bucket"?
- geekodour 2y agoah apologies again, for this specific one i meant where users from the internet are allowed to upload to. (i am using presigned urls)
- geekodour 2y agoSo the model here is, first it gets uploaded to a staging bucket, a lambda/callback checks the validity of the file and then puts it into a safe bucket of which content I trust to put in my server(backend)
- remram 2y agoI think maybe you are using the word "tampered" in an unusual way? To mean unsafe?
- geekodour 2y agoapologies my bad. I mean someone uploading a malicious pdf as user input. I am talking beyond calmav and flietype checking, to check if its a valid pdf.