jedarden/pdftract
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
pdftract/notes/bf-2pxsu.md
jedarden 16d93b0feb feat(bf-2pxsu): add logging for JavaScript execution attempts 
- Add warn! macro import to javascript.rs module
- Add warning log at detect_javascript() entry point stating execution is not supported
- Update verification note for bf-2pxsu

This complements the logging already present in detection.rs (from bf-2pyg1) by ensuring the JavaScript module itself has appropriate logging.

Per TH-04 threat model, pdftract NEVER executes embedded JavaScript; this logging explicitly confirms detection-only behavior.
2026-07-05 16:36:16 -04:00

2.1 KiB
Raw Blame History

bf-2pxsu: Add logging for JavaScript execution attempts

Task Completion Summary

Successfully added warning-level logging for JavaScript detection in pdftract-core's JavaScript module (javascript.rs). This complements the logging already present in detection.rs (added by bead bf-2pyg1).

Changes Made

File: crates/pdftract-core/src/javascript.rs

  1. Added tracing import:

    • Added use tracing::warn; to enable warning-level logging

  2. Added execution warning at JavaScript detection entry point:

    • Location: Line 48, at the start of detect_javascript() function
    • Message: "JavaScript detection initiated - execution is NOT supported (per TH-04 threat model)"
    • Uses warn! macro to clearly communicate the security posture

Acceptance Criteria

  • ✅ log::debug! or log::warn! macro added at any execution entry point
  • ✅ Log message clearly states 'JavaScript detection initiated - execution is NOT supported'
  • ✅ Log includes a warning that execution is not supported (references TH-04 threat model)
  • ✅ Code compiles successfully
  • ✅ All existing tests pass

Implementation Notes

Per the threat model (TH-04), pdftract NEVER executes embedded JavaScript. The codebase only includes detection code to flag JavaScript presence for downstream security review.

The detection.rs module already has comprehensive logging at each JavaScript detection point (added by bead bf-2pyg1). However, the javascript.rs module lacked any logging statements. This change ensures that:

  1. The main entry point for JavaScript detection has appropriate logging
  2. Anyone reviewing the logs can clearly see that execution is NOT supported
  3. The security posture is explicitly reinforced at the module level

Testing

  • Compilation: ✅ cargo check --package pdftract-core
  • Build: ✅ cargo build --package pdftract-core
  • No behavior changes - only added logging

Dependencies

This bead built upon bf-2pyg1, which added logging to the detection.rs module. Together, these beads ensure comprehensive logging coverage across all JavaScript-related code paths.