0

I've downloaded a book but by default its considered malicious by me.

I thought of converting that PDF to JPG here: https://smallpdf.com/pl/pdf-do-jpg

Then backwards: https://smallpdf.com/pl/jpg-to-pdf

Is converting PDF to JPG then backwards via web services considered a method for obtaining a safe PDF?

Improve this question
3
  • 1
    Do you care about useful features like searching for text, small file size, and legibility? – user Nov 9 '20 at 18:13
  • Mostly I care here to obtain secure PDF, ofcourse legibility should not make the PDF unreadable. Searching for text is important but we can skip it if neccessary. – noone Nov 9 '20 at 19:22
  • I'd convert to and fro XPS. This yields better compression, and the underlying architectures are different enough that malicious code shouldn't survive (not so, for example, with PostScript). Otherwise, PNG followed by OCR yields back the best quality text, probably still searchable. Chances are that decompressing and recompressing with pdftk/iText is enough. I had done something like this once, for other reasons, using pdf2json. – LSerni Nov 9 '20 at 19:54
2

JPEG is an inert format which doesn't support complex extensions, embedded executable code and most other things that make PDF potentially risky. By converting to JPEG and back, you eliminate all potential vulnerabilities except for the ones in JPEG decompression. Popular image decompression libraries got a lot of security attention in the early 2010s so they should be pretty safe these days.

JPEG is bad at compressing text (its techniques are good with color gradients, and not so good with the kind of sharp contrast that text needs between background and text). So the result will be large and may be hard to read. And of course the text won't be selectable or searchable. Sanitizing the book as a PDF (or converting it to epub) while keeping the text as text would give a result that's a lot more usable.

Of course, if the PDF is malicious, it can attack the conversion service. But the conversion service is the one that takes the risk, rather than your PDF reader.

Improve this answer
7
  • You take some risks too, when the web service is attacked, then the malware will have access to your browser, guaranteeing itself an immense attack surface. Clearly it is a very complex attack though, which requires the attacker to know a lot of info. – J. Doe Nov 9 '20 at 20:10
  • What do You mean by "Sanitizing the book as a PDF"? – noone Nov 9 '20 at 20:11
  • @noone I mean using a sanitization process that transforms a PDF into a PDF, rather than going via JPEG. – Gilles 'SO- stop being evil' Nov 9 '20 at 20:38
  • 1
    "But the conversion service is the one that takes the risk, rather than your PDF reader." - If the server takes the risk and is compromised, then anything produced by the server might be compromised too. Specifically the newly created PDF might be compromised. Insofar it might be better to use one service for creating images from the PDF and a completely different service (which is not affected if the first one is compromised) to create a PDF from images. – Steffen Ullrich Nov 9 '20 at 23:11
  • 1
    @Gilles'SO-stopbeingevil': correct. The risk might be mitigated by the service or it might not. All I wanted to point out is that the risk does not magically vanish because "the conversion service is the one that takes the risk, rather than your PDF reader", but that it might also be propagated to the PDF reader if the service is not able to properly cope with the risk. – Steffen Ullrich Nov 10 '20 at 13:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.