Skip to content

[Bug]: PDF.js wrongly prompts for a password on attachment-only encrypted PDFs. #20049

Open
@Aditi-1400

Description

@Aditi-1400

Attach (recommended) or Link to PDF file

encryption.pdf

Web browser and its version

140.0.2 (aarch64) (also tested in Chrome 137.0.7151.120)

Operating system and its version

MacOS 15.5

PDF.js version

v5.3.31

Is the bug present in the latest PDF.js version?

Yes

Is a browser extension

No

Steps to reproduce the problem

Open a PDF file with encrypted attachments

What is the expected behavior?

It should only ask for password when the attachments are accessed.

What went wrong?

When a PDF is secured using AES-256 but restricts encryption to only the attachments while leaving all page, image, and metadata streams in clear text, Adobe Acrobat and Chrome viewer open the file normally and only demand a password if an attachment is accessed.
PDF.js, however, treats the entire document as protected, so it displays the “This document is password-protected” dialog before rendering any pages. This results in it asking for passwords for documents that contain no attachments at all or whose attachments were removed, blocking users from viewing otherwise unencrypted content.

Link to a viewer

No response

Additional context

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions