Loaded Document Sanitisation

SanitiseLoadedDocument applies a selected security policy to the complete loaded object graph and prepares a compact full rewrite

Profiles

Profile	Removed content
`spJavaScriptOnly`	Document JavaScript name trees and JavaScript actions
`spActiveContent`	JavaScript plus launch, remote navigation, URI, submission, import, multimedia, rendition, XFA, and related active-content entries
`spJavaScriptOnly`	Document JavaScript name trees and JavaScript actions
`spActiveContent`	JavaScript plus launch, remote navigation, URI, submission, import, multimedia, rendition, XFA, and related active-content entries
`spUntrustedDocument`	All active content plus embedded files, associated files, file-attachment annotations, rich-media payload structures, and unknown action types found in action-bearing slots

Declaration

function SanitiseLoadedDocument(Profile: THPDFSanitiseProfile;
  out Report: THPDFSanitiseReport): Boolean; overload;
function SanitiseLoadedDocument(
  out Report: THPDFSanitiseReport): Boolean; overload;

The overload without a profile uses spUntrustedDocument

Result report

THPDFSanitiseReport counts removed actions, JavaScript entries, embedded files, risky annotations, XFA entries, payload streams, detached references, unreachable objects, and visited objects

Changed indicates whether the object graph changed, whilst LimitExceeded and InvalidObjectGraph explain a rejected preflight

Safety and performance

The operation indexes indirect objects and resolves references in near-linear time instead of repeatedly scanning the object list
A cycle-safe preflight visits the complete candidate graph before any mutation and rejects graphs above two million unique nodes
The untrusted profile fails closed for unrecognised action dictionaries attached to action-bearing keys whilst retaining recognised local GoTo navigation
The full rewrite marks unreachable indirect objects as deleted and compacts live object numbers to remove orphan payload bytes and avoid sparse cross-reference allocation
Saving back to the loaded source path writes a sibling temporary file and atomically replaces the source only after the rewrite succeeds
Saving back to the loaded source path writes a sibling temporary file and atomically replaces the source only after the rewrite succeeds

Example

var
  Report: THPDFSanitiseReport;
begin
  PDF.LoadFromFile('untrusted.pdf');
  if not PDF.SanitiseLoadedDocument(spUntrustedDocument, Report) then
    raise Exception.Create('Document sanitisation was rejected');
  PDF.SaveLoadedDocument('sanitised.pdf');
end;

Usage notes

Call the method only after LoadFromFile or another loaded-document workflow succeeds
A successful call forces a full rewrite and exits incremental-update mode because removed bytes must not remain in an earlier revision
The method removes active structures and payload reachability but does not execute or interpret embedded scripts