Loaded Document Sanitization

SanitiseLoadedDocument applies a selected security policy to the complete loaded object graph and prepares a compact full rewrite

Profiles

Profile	Removed content
`spJavaScriptOnly`	Document JavaScript name trees and JavaScript actions
`spActiveContent`	JavaScript plus launch, remote navigation, URI, submission, import, multimedia, rendition, XFA, and related active-content entries
`spUntrustedDocument`	All active content plus embedded files, associated files, file-attachment annotations, rich-media payload structures, and unknown action types found in action-bearing slots
`spRichMediaOnly`	Rich-media annotations and their detached payload streams
`spRedactionCleanup`	Redact and file-attachment annotations, document information, metadata, associated and embedded files, and every object made unreachable by those removals

Declaration

function SanitiseLoadedDocument(Profile: THPDFSanitiseProfile;
  out Report: THPDFSanitiseReport): Boolean; overload;
function SanitiseLoadedDocument(
  out Report: THPDFSanitiseReport): Boolean; overload;
function ScrubLoadedRedactionRemnants(
  out Report: THPDFSanitiseReport): Boolean;

The overload without a profile uses spUntrustedDocument

Result report

THPDFSanitiseReport counts removed actions, JavaScript entries, embedded files, risky annotations, XFA entries, payload streams, detached references, unreachable objects, metadata entries, Redact annotations, discarded prior-revision bytes, and visited objects

Changed indicates whether the object graph changed, while LimitExceeded and InvalidObjectGraph explain a rejected preflight

Safety and performance

The operation indexes indirect objects and resolves references in near-linear time instead of repeatedly scanning the object list
A cycle-safe preflight visits the complete candidate graph before any mutation and rejects graphs above two million unique nodes
The untrusted profile fails closed for unrecognised action dictionaries attached to action-bearing keys while retaining recognized local GoTo navigation
The full rewrite marks unreachable indirect objects as deleted and compacts live object numbers to remove orphan payload bytes and avoid sparse cross-reference allocation
Redaction cleanup deliberately preserves unrelated actions and page behavior while removing all unreachable font, image, payload, and metadata objects
Saving back to the loaded source path writes a sibling temporary file and atomically replaces the source only after the rewrite succeeds

Example

var
  Report: THPDFSanitiseReport;
begin
  PDF.LoadFromFile('untrusted.pdf');
  if not PDF.SanitiseLoadedDocument(spUntrustedDocument, Report) then
    raise Exception.Create('Document sanitisation was rejected');
  PDF.SaveLoadedDocument('sanitised.pdf');
end;

Usage notes

Call the method only after LoadFromFile or another loaded-document workflow succeeds
A successful call forces a full rewrite and exits incremental-update mode because removed bytes must not remain in an earlier revision
The method removes active structures and payload reachability but does not execute or interpret embedded scripts