Redaction geometry helpers with resource limits

FPdfRedaction supplies conservative source checks and geometric operations for TPdf.SaveAsRedacted; that higher-level method handles the transaction, annotations, opaque overlays, regenerated content, sanitisation and resource pruning

The helpers alter native objects only in the caller's isolated transaction copy, raising EPdfRedactionGeometry for unsupported geometry or exhausted allowances; using them alone does not constitute a complete secure export

Public declarations

type
  EPdfRedactionGeometry = class(Exception);
  TPdfRedactionGeometryOptions = record
    MaxFormDepth, MaxObjects, MaxPathSegments, MaxFragments: Integer;
    MaxImagePixels, MaxGeometryOperations: Int64;
    CurveTolerance: Double;
    class function Default: TPdfRedactionGeometryOptions; static;
  end;
  TPdfRedactionGeometryReport = record
    ExpandedFormCount, ScannedChildCount, ClippedPathCount: Integer;
    FlattenedCurveCount, GeneratedPointCount, FragmentCount: Integer;
    MaskedImageCount: Integer;
    ScannedPixelCount, MaskedPixelCount, PixelIntersectionTestCount: Int64;
    GeometryOperationCount: Int64;
  end;

procedure ValidateDetailedRedactionSource(Source: TStream);
procedure ValidateDetailedRedactionText(PageObject: FPDF_PAGEOBJECT);
procedure ExpandRedactionForms(Page: FPDF_PAGE;
  const Options: TPdfRedactionGeometryOptions;
  var Report: TPdfRedactionGeometryReport);
procedure ClipRedactionPath(Page: FPDF_PAGE; PageObject: FPDF_PAGEOBJECT;
  ObjectIndex: Integer; const Redactions: array of FS_RECTF;
  const Options: TPdfRedactionGeometryOptions;
  var Report: TPdfRedactionGeometryReport);
procedure MaskRedactionImage(Document: FPDF_DOCUMENT; Page: FPDF_PAGE;
  PageObject: FPDF_PAGEOBJECT; ObjectIndex: Integer;
  const Redactions: array of FS_RECTF;
  const Options: TPdfRedactionGeometryOptions;
  var Report: TPdfRedactionGeometryReport);

Coordinates and supported shapes

Redaction rectangles and curve tolerances are expressed in PDF user-space points; paths are transformed into page space before clipping, and ObjectIndex is the original zero-based native page-object index that maintains painting order

• ExpandRedactionForms recursively detaches text, path and image children, combines nonsingular instance transforms with native clips, and places expanded objects at the Form's original position; expanding shared instances separately avoids altering their original shared Form stream in place
• ClipRedactionPath accepts a solid-filled, unstroked path, flattens cubic segments within a subdivision-depth limit, subtracts rectangular cuts and retains the winding or even-odd rule across surviving contours
• Cuts expand by CurveTolerance + 0.001 PDF points; this tolerance limits the curve approximation but may remove a little extra content outside the requested rectangle
• MaskRedactionImage handles nonsingular affine transforms, including rotation, reflection and skew, with supported decoded Gray, BGR, BGRx or BGRA samples; it keeps decoded resolution and produces a new replacement image
• A pixel loses both colour and alpha bytes if its transformed quadrilateral touches a redaction rectangle expanded by 0.001 PDF points; surviving pixels retain their decoded colour samples
• Partial text retention through ValidateDetailedRedactionText requires ordinary filled text; the higher-level method still handles character mapping and fragment reconstruction

Expansion and partial geometry refuse transparency, blend states, unsupported children, singular matrices, patterned fills and complex or nonredundant clipping paths; an accepted redundant rectangular clip must enclose the entire object

Options and accumulated reporting

Option	Default	Purpose
MaxFormDepth	32	Depth allowed for nested Form expansion
MaxObjects	1000000	Limits for page enumeration and accumulated expanded children
MaxPathSegments	262144	Segments in each input path and accumulated generated path points
MaxFragments	1000000	Retained rectangular regions and accumulated replacement fragments
MaxImagePixels	16777216	Total decoded image pixels processed
MaxGeometryOperations	67108864	Total geometry work and pixel intersection tests
CurveTolerance	0.01	Tolerance in PDF points for flattening cubic curves

Start with TPdfRedactionGeometryOptions.Default and clear the report once before the transaction; reuse that report for all helper calls so points, pixels, fragments and operation allowances accumulate

Expansion is described by ExpandedFormCount and ScannedChildCount, counting root Form instances as well as children; path work uses ClippedPathCount, FlattenedCurveCount and GeneratedPointCount, including intermediate clipping points; image work uses MaskedImageCount, ScannedPixelCount, MaskedPixelCount and PixelIntersectionTestCount

FragmentCount counts replacement objects, not contours or pixels; GeometryOperationCount accumulates resource-limited helper work, and a report retained after an exception may describe unfinished work on the discarded copy

Source checks and export responsibilities

Before modifying objects, ValidateDetailedRedactionSource checks active objects and decoded content; TPdf.SaveAsRedacted runs it for every profile, including whole-object removal and simpler partial retention

• Input is refused if it is signed or carries Tagged PDF structure, /ActualText or /Alt replacement data, XFA, or optional-content semantics such as /OCProperties, /OCG and /OCMD
• Other refused features are image masks, soft masks, transfer functions, halftone and overprint states, inline images, text clipping, unknown Tr operands, and scn/SCN pattern or special-colour-space painting
• Checked content streams must have no filter or one named /FlateDecode filter; decoding permits 32 MiB per stream and 64 MiB altogether
• The active-object reader retains its default source, object-body, object-stream expansion and object-count allowances; geometry options cannot bypass these separate checks

This profile does not reconstruct Tagged PDF structure, retain arbitrary transparency, handle arbitrary strokes or clipping, or guarantee lossless encoded-image retention; secure export needs the original streams and unused resources removed after regeneration, as TPdf.SaveAsRedacted does

Direct callers must isolate a document copy, check native capabilities and finite positive allowances, discard failed copies, regenerate changed page content, then finish sanitisation and resource pruning before export

See Also

TPdf.SaveAsRedacted, TPdf.SaveAsSanitised, FPdfCompress