Loaded annotation import policies

The modern Windows THotPDF facade checks the authenticated original revision and current edited graph before committing an annotation import through ImportLoadedAnnotationsFromXFDF or an annotation-bearing ImportLoadedInterchangeFromFDF transaction

Ordinary authenticated loading

An ordinary LoadFromFile or LoadFromStream call with a valid password retains a private credential context bound to the document's authenticated encryption dictionary and permanent identifier

Later annotation imports can prepare the current dirty graph without requiring a second password or exposing a raw key through a public API

The context is replaced on a new load and cleared when the document is released; AES-256 R5/R6 permissions are checked against the authenticated Perms block rather than a rounded public numeric value

Standard-handler user authentication requires annotation permission for an actual annotation change; owner authentication retains its usual permission exemption

For a user lacking general modification permission, the candidate graph may contain permitted writable text, choice and button values and annotation changes, but unrelated catalog, page, content and resource changes are rejected

A zero-annotation import can remain a no-op without requiring annotation permission

Signed revisions

Existing signatures must remain reachable and retain their signed value and CMS bytes

Signature integrity and CAdES signing-certificate binding are verified before a signed annotation revision is accepted

DocMDP P1 and P2 prevent annotation additions; P3 permits them only when the complete current revision also satisfies the original certification and FieldMDP locks

Changing an unlocked writable field can remain permitted, whilst changing a locked value, default appearance or signed value is rejected

The integrity check does not silently impose a new business trust-root policy on documents whose certification allows the operation

Preservation and rollback

Signed or encrypted caller-owned input streams are copied into independently owned bounded storage before their lifetime or contents can diverge from the loaded document

Freeing, replacing or appending to the caller's stream after loading does not substitute a different authenticated source for an annotation transaction

The candidate retains the original signed and encrypted byte prefix and preserves existing dirty field values when the applicable policy permits them

Legacy RC4 serialisation detaches shared string storage before encryption, preserving the authored field value and other aliases to that value

Rejection, budget exhaustion or cooperative cancellation rolls back the import's own graph changes and preserves earlier caller edits and an existing output file; a subsequent operation can retry on the same document

Exact PDF decimal tokens survive cloned and restored numeric objects, so permission comparisons distinguish neighbouring decimals even when the public Single values are equal

Equivalent decimal spellings compare by their exact numeric value; default appearance strings compare their decoded PDF string bytes without reinterpreting or reformatting content operators

Bounds and scope

The current document's decode budgets and operation cancellation token also apply to authenticated candidate preparation and graph comparison

Comparison bounds graph depth, visited object pairs and work; encrypted stream data is compared after the applicable authenticated decryption step

This policy path is available in the modern Windows facade and does not claim that the ordinary THotPDF class builds on native Linux

Native headless annotation transactions have their own existing authenticated permission checks

This stage does not add public-key security-handler credential reuse, arbitrary new AcroForm font resources, action execution or a separate field-only FDF permission model

Remote GoToR interchange · Exact signature range information