Embedpdf/feature/catalog metadata

core/fpdfapi/edit/cpdf_creator.cpp

@@ -256,7 +256,8 @@ bool CPDF_Creator::WriteIndirectObj(uint32_t objnum, const CPDF_Object* pObj) {
   }
 
   std::unique_ptr<CPDF_Encryptor> encryptor;
-  if (GetCryptoHandler() && pObj != encrypt_dict_) {
+  // EmbedPDF(bug-fix): see IsClearMetadata().
+  if (GetCryptoHandler() && pObj != encrypt_dict_ && !IsClearMetadata(objnum)) {
     encryptor = std::make_unique<CPDF_Encryptor>(GetCryptoHandler(), objnum,
                                                  generation);
   }
@@ -268,6 +269,19 @@ bool CPDF_Creator::WriteIndirectObj(uint32_t objnum, const CPDF_Object* pObj) {
   return archive_->WriteString("\r\nendobj\r\n");
 }
 
+// EmbedPDF(bug-fix): the document's metadata stream stays in the clear when
+// the encryption dictionary says /EncryptMetadata false, as the parser reads
+// it. Every other stream is encrypted, other metadata streams included.
+bool CPDF_Creator::IsClearMetadata(uint32_t objnum) const {
+  if (!security_handler_ || security_handler_->IsMetadataEncrypted()) {
+    return false;
+  }
+  const CPDF_Dictionary* root = document_->GetRoot();
+  RetainPtr<const CPDF_Reference> metadata =
+      root ? ToReference(root->GetObjectFor("Metadata")) : nullptr;
+  return metadata && metadata->GetRefObjNum() == objnum;
+}
+
 // EmbedPDF(save-generations): the generation an incremental save writes for an
 // object: the layer's version's, or the input file's. A full save writes 0.
 uint32_t CPDF_Creator::GetObjectGeneration(uint32_t object_number) const {

core/fpdfapi/edit/cpdf_creator.h

@@ -141,6 +141,9 @@ class CPDF_Creator final : public CPDF_WriteContext {
   std::vector<uint32_t> NewObjectNumbers() const;
   bool WriteNewObjs();
   bool WriteIndirectObj(uint32_t objnum, const CPDF_Object* pObj);
+  // EmbedPDF(bug-fix): whether |objnum| is the document's metadata stream,
+  // kept in the clear by /EncryptMetadata false.
+  bool IsClearMetadata(uint32_t objnum) const;
   // EmbedPDF(layer-save): refuses an offset an entry can't hold.
   bool CheckEmittedOffset(FX_FILESIZE offset);
   // EmbedPDF(save-generations): the creator as CPDF_WriteContext, and

core/fpdfapi/parser/cpdf_flateencoder.cpp

@@ -26,14 +26,25 @@ CPDF_FlateEncoder::CPDF_FlateEncoder(RetainPtr<const CPDF_Stream> pStream,
 
   bool bHasFilter = pStream->HasFilter();
   if (bHasFilter && !bFlateEncode) {
-    auto pDestAcc = pdfium::MakeRetain<CPDF_StreamAcc>(pStream);
-    pDestAcc->LoadAllDataFiltered();
-
-    data_ = acc_->GetSpan();
-    cloned_dict_ = ToDictionary(pStream->GetDict()->Clone());
-    cloned_dict_->RemoveFor("Filter");
-    DCHECK(!dict_);
-    return;
+    // EmbedPDF(bug-fix): a stream written unencoded (the metadata stream,
+    // which XMP readers look for in the file's bytes) is written decoded.
+    // Upstream decoded it, then wrote its encoded bytes without the filter
+    // that decodes them. Bytes that don't decode stay as they are, filter and
+    // all.
+    std::optional<DecoderArray> decoders = GetDecoderArray(pStream->GetDict());
+    std::optional<PDFDataDecodeResult> decoded;
+    if (decoders.has_value() && !decoders.value().empty()) {
+      decoded = PDF_DataDecode(acc_->GetSpan(), 0, false, decoders.value());
+    }
+    if (decoded.has_value() && decoded.value().image_encoding.IsEmpty() &&
+        !decoded.value().data.empty()) {
+      data_ = std::move(decoded.value().data);
+      cloned_dict_ = ToDictionary(pStream->GetDict()->Clone());
+      cloned_dict_->RemoveFor("Filter");
+      cloned_dict_->RemoveFor(pdfium::stream::kDecodeParms);
+      DCHECK(!dict_);
+      return;
+    }
   }
   if (bHasFilter || !bFlateEncode) {
     data_ = acc_->GetSpan();

core/fpdfapi/parser/cpdf_stream.cpp

@@ -297,7 +297,12 @@ bool CPDF_Stream::WriteTo(IFX_ArchiveStream* archive,
 
   std::optional<DataVector<uint8_t>> encrypted_data;
   pdfium::span<const uint8_t> data = encoder.GetSpan();
-  if (encryptor && !is_metadata) {
+  // EmbedPDF(bug-fix): a metadata stream is encrypted like any other stream;
+  // the creator gives the one a file keeps in the clear (/EncryptMetadata
+  // false) no encryptor. Upstream never encrypted one, so a save of an
+  // encrypted file wrote its XMP in the clear, and readers decrypted it into
+  // noise.
+  if (encryptor) {
     // EmbedPDF(save-security): a stream that can't be encrypted fails the save.
     encrypted_data = encryptor->Encrypt(data);
     if (!encrypted_data) {

fpdfsdk/BUILD.gn

@@ -22,6 +22,8 @@ source_set("fpdfsdk") {
     "epdf_base_document.cpp",
     # EmbedPDF: captures of what a layer write loses (EPDF*_Export*Raw).
     "epdf_capture.cpp",
+    # EmbedPDF: the catalog's metadata stream (public/epdf_catalog.h).
+    "epdf_catalog.cpp",
     # EmbedPDF: implements EPDFFont_* runtime font registration APIs.
     "epdf_font.cpp",
     # EmbedPDF: session-free AcroForm model snapshot (EPDFForm_* APIs).
@@ -253,6 +255,8 @@ pdfium_embeddertest_source_set("embeddertests") {
     "epdf_edit_test_util.h",
     # EmbedPDF: covers captures and their imports (EPDF*_Export*Raw).
     "epdf_capture_embeddertest.cpp",
+    # EmbedPDF: covers the catalog's metadata stream (EPDFCatalog_*Metadata).
+    "epdf_catalog_embeddertest.cpp",
     # EmbedPDF: covers appearance states and modes, widgets in page renders,
     # and the check box and radio button symbols.
     "epdf_appearance_state_embeddertest.cpp",

fpdfsdk/epdf_c_api_test.c

@@ -235,6 +235,8 @@ int CheckEmbedPDFCApi(void) {
 
   // epdf_catalog.h
   CHK(EPDFCatalog_GetLanguage);
+  CHK(EPDFCatalog_GetMetadata);
+  CHK(EPDFCatalog_SetMetadata);
 
   // epdf_digest.h
   CHK(EPDF_DigestBuffer);

fpdfsdk/epdf_catalog.cpp

@@ -0,0 +1,96 @@
+// Copyright 2026 CloudPDF LTD
+// SPDX-License-Identifier: Apache-2.0
+
+#include <stdint.h>
+
+#include <utility>
+
+#include "core/fpdfapi/parser/cpdf_dictionary.h"
+#include "core/fpdfapi/parser/cpdf_document.h"
+#include "core/fpdfapi/parser/cpdf_document_view_scope.h"
+#include "core/fpdfapi/parser/cpdf_name.h"
+#include "core/fpdfapi/parser/cpdf_reference.h"
+#include "core/fpdfapi/parser/cpdf_stream.h"
+#include "core/fxcrt/compiler_specific.h"
+#include "core/fxcrt/retain_ptr.h"
+#include "core/fxcrt/span.h"
+#include "fpdfsdk/cpdfsdk_helpers.h"
+#include "public/epdf_catalog.h"
+
+FPDF_EXPORT unsigned long FPDF_CALLCONV
+EPDFCatalog_GetMetadata(FPDF_DOCUMENT document,
+                        void* buffer,
+                        unsigned long length) {
+  CPDF_Document* doc = CPDFDocumentFromFPDFDocument(document);
+  if (!doc) {
+    return 0;
+  }
+  // References a base document's objects hold resolve through the layer.
+  CPDF_DocumentViewScope document_view(doc);
+  const CPDF_Dictionary* catalog = doc->GetRoot();
+  RetainPtr<const CPDF_Stream> stream =
+      catalog ? catalog->GetStreamFor("Metadata") : nullptr;
+  if (!stream) {
+    return 0;
+  }
+  if (!buffer) {
+    length = 0;
+  }
+  // SAFETY: required from caller.
+  return DecodeStreamMaybeCopyAndReturnLength(
+      std::move(stream),
+      UNSAFE_BUFFERS(pdfium::span(static_cast<uint8_t*>(buffer),
+                                  static_cast<size_t>(length))));
+}
+
+FPDF_EXPORT FPDF_BOOL FPDF_CALLCONV
+EPDFCatalog_SetMetadata(FPDF_DOCUMENT document,
+                        const void* data,
+                        unsigned long size) {
+  CPDF_Document* doc = CPDFDocumentFromFPDFDocument(document);
+  if (!doc || (!data && size > 0)) {
+    return false;
+  }
+  CPDF_DocumentViewScope document_view(doc);
+  const CPDF_Dictionary* catalog = doc->GetRoot();
+  if (!catalog) {
+    return false;
+  }
+  if (!data) {
+    if (!catalog->KeyExist("Metadata")) {
+      return true;
+    }
+    RetainPtr<CPDF_Dictionary> writable = doc->GetMutableRoot();
+    if (!writable) {
+      return false;
+    }
+    writable->RemoveFor("Metadata");
+    return true;
+  }
+
+  // The stream is written through its object number, so on a layer the
+  // write lands in the layer's copy and never in the base's.
+  RetainPtr<const CPDF_Reference> reference =
+      ToReference(catalog->GetObjectFor("Metadata"));
+  RetainPtr<CPDF_Stream> stream =
+      reference
+          ? ToStream(doc->GetMutableIndirectObject(reference->GetRefObjNum()))
+          : nullptr;
+  if (!stream) {
+    RetainPtr<CPDF_Dictionary> writable = doc->GetMutableRoot();
+    if (!writable) {
+      return false;
+    }
+    stream = doc->NewIndirect<CPDF_Stream>(
+        pdfium::MakeRetain<CPDF_Dictionary>());
+    writable->SetNewFor<CPDF_Reference>("Metadata", doc, stream->GetObjNum());
+  }
+  // SAFETY: required from caller.
+  stream->SetDataAndRemoveFilter(UNSAFE_BUFFERS(
+      pdfium::span(static_cast<const uint8_t*>(data),
+                   static_cast<size_t>(size))));
+  RetainPtr<CPDF_Dictionary> dict = stream->GetMutableDict();
+  dict->SetNewFor<CPDF_Name>("Type", "Metadata");
+  dict->SetNewFor<CPDF_Name>("Subtype", "XML");
+  return true;
+}