1898195 - PDF draw feature cannot hide texts behind it

Status: RESOLVED WONTFIX

(Firefox :: PDF Viewer, defect)

Description

[Renato S. Yamane]

Attachment: PDF_edited_firefox.pdf

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko/20100101 Firefox/126.0

Steps to reproduce:

1. Open a PDF file on Firefox 126.0 (Windows 11);

2. Use the draw feature to edit the PDF, hidden a text;

3. Save it;

4. Open it again, use CTRL+A to select the content of the PDF, then copy the text and paste it in somewhere (for example: notepad).

You will notice the text, supposed to be hidden, can be revealed when you paste the content.

Use the PDF attached to reproduce the problem.

Actual results:

If you use the draw feature to hide a sensitive information, the user can still now the text by just using the "copy and paste".

Expected results:

The text behind the draw/brush should not be revealed.
This is a security issue, because users can have sensitive informations revealed.

Comment 2

[:Gijs (he/him)]

Comment from OP from the dupe suggests:

Firefox should MERGE all layers before saving the PDF.

Comment 3

[:Gijs (he/him)]

Adding bounty flag per comment on the dupe.

Comment 4

[Renato S. Yamane]

I received 2 emails from this bug report at 12.39pm (GMT +1) and 1.34pm (GMT +1) but I can't see the content because it says:

"... This email would have contained sensitive information, but you have not set a PGP/GPG key or SMIME certificate in the "Secure Mail" section of your user preferences ..."

If it's something for me, please sent again because I added the PGP/GPG key just a few minutes ago.

Comment 5

[Calixte Denizet (:calixte)]

The email you received doesn't contain any sensitive information which could leak (it's a security bug). But if you want to receive the encrypted message it's possible in changing a pref.
That said, I agree with you that people mustn't redact a pdf in using a tool for drawing on it, but what can we do when the users misuse a tool ?
Did you see something in Firefox which could let the user thinks that this drawing tool is a redact one ?

Comment 6

[Renato S. Yamane]

Hi, If users encounter a brush tool that visually indicates they can hide a content, they should expect the text beneath the brushed area to be permanently concealed.

A solution for this can be merging all layers before saving the PDF, so we cannot have access to the content underneath the brushed area.

Comment 7

[Daniel Veditz [:dveditz]]

Might be good to make clearer, but is not a security vulnerability that needs to be hidden to protect users. In fact, the more users know about this the safer they will be.

Comment 8

[Marco Castelluccio [:marco]]

We are planning to work on a redact feature in the future. Having a specific redact feature will help make it clearer for users that they can't just "draw" on top of text in order to hide it.

I'm not sure there are ways to fix this bug, so I'm going to close it as WONTFIX.

Comment 9

[Renato S. Yamane]

(In reply to Marco Castelluccio [:marco] from comment #8)

[...]they can't just "draw" on top of text in order to hide it.

Yes, but they are doing.
The common sense is when we draw something over a text, nobody will expect that the text behind the draw can be revealed.

Thanks

Comment 10

[Marco Castelluccio [:marco]]

(In reply to Renato S. Yamane from comment #9)

(In reply to Marco Castelluccio [:marco] from comment #8)

[...]they can't just "draw" on top of text in order to hide it.

Yes, but they are doing.
The common sense is when we draw something over a text, nobody will expect that the text behind the draw can be revealed.

Thanks

Unfortunately that's a common misconception and it is the same behavior across all PDF editors, I'm not sure there's anything we can do to improve the situation other than implementing a specific redact tool.