SaveAsSanitised - TPdf - PDFium Delphi Component

Component: TPdf · Unit: PDFium

Writes a clean single-revision copy through bounded catalog and trailer updates, then prunes unreachable objects so orphaned JavaScript, action, attachment, and metadata bodies disappear from the file body

Syntax

function SaveAsSanitised(Stream: TStream;
const Options: TPdfSanitiseOptions;
out Report: TPdfSanitiseReport): Boolean; overload;

function SaveAsSanitised(const FileName: string;
const Options: TPdfSanitiseOptions;
out Report: TPdfSanitiseReport): Boolean; overload;

Description

SaveAsSanitised produces a sanitised single-revision PDF copy that removes active content vectors from the document catalog and then optionally runs a reachability prune to eliminate orphaned objects from the file body

The two-stage pipeline first strips catalog entries (/OpenAction, /AA, /Names, /AF, /AcroForm, /Metadata) via StripDictionaryEntries as an incremental update, then runs PruneUnreachablePdfStream to rewrite the file as one clean classic revision

The catalog and trailer update uses sparse xref lookup, parser windows no larger than 1 MiB, and 64 KiB range copying on the normal xref path instead of materialising the complete saved PDF in one byte array

When pruning is enabled, the intermediate workspace is a TPdfRandomAccessStore governed by SaveMemoryLimit and SaveTemporaryDirectory Its peak memory and spill state are included in LastSaveLargestMemoryBuffer and LastSaveSpillCount

Every strip flag is independent TPdfSanitiseOptions.Default enables the full security profile: StripOpenAction, StripCatalogActions, StripNames, StripAssociatedFiles, plus RemoveUnreachable prune. StripAcroForm and StripMetadata default to False because they remove form fields and metadata that callers may want to keep

The output is always a single revision with no incremental history when RemoveUnreachable=True

Parameters

Options — TPdfSanitiseOptions record; use Default for the standard security profile
Report — receives stripped entry count, pruned object count, byte counts, and any error

Remarks

StripNames removes the entire /Names dictionary including /JavaScript, /EmbeddedFiles, /Dests, and /AP; this is intentionally aggressive for sanitisation
StripAssociatedFiles removes the catalog-level /AF entry and defaults to True
StripMetadata removes both catalog /Metadata (XMP) and trailer /Info
Malformed or unsupported xref layouts fall back to the compatibility parser so the bounded fast path does not narrow accepted input
Per-annotation /AA and /A actions are not stripped in this method; only catalog-level active content is removed
Encrypted documents are rejected by the underlying TryReadTrailerInfo guard
Signed documents should be sanitised with care because stripping /AcroForm removes signature fields and invalidates existing signatures

Example

var
  Options: TPdfSanitiseOptions;
  Report: TPdfSanitiseReport;
begin
  Pdf1.FileName := 'C:\Untrusted.pdf';
  Pdf1.Active := True;
  Options := TPdfSanitiseOptions.Default;
  Pdf1.SaveAsSanitised('C:\Sanitised.pdf', Options, Report);
end;

SaveAsSanitised method