使用Java实现PDF文件安全检测功能

public class PDFSecurityUtil {

    private static final Logger log = LoggerFactory.getLogger(PDFSecurityUtil.class);
    
    // 定义恶意内容模式库
    private static final Pattern[] MALICIOUS_PATTERNS = {
            // HTML/JavaScript 注入模式
            Pattern.compile("<script.*?>", Pattern.CASE_INSENSITIVE),
            Pattern.compile("javascript:", Pattern.CASE_INSENSITIVE),
            Pattern.compile("vbscript:", Pattern.CASE_INSENSITIVE),
            
            // 事件处理函数
            Pattern.compile("onload\\s*=", Pattern.CASE_INSENSITIVE),
            Pattern.compile("onerror\\s*=", Pattern.CASE_INSENSITIVE),
            Pattern.compile("onclick\\s*=", Pattern.CASE_INSENSITIVE),
            
            // 危险JavaScript函数
            Pattern.compile("eval\\s*\\(", Pattern.CASE_INSENSITIVE),
            Pattern.compile("alert\\s*\\(", Pattern.CASE_INSENSITIVE),
            Pattern.compile("document\\.cookie", Pattern.CASE_INSENSITIVE),
            
            // PDF JavaScript对象
            Pattern.compile("<</JS", Pattern.CASE_INSENSITIVE),
            Pattern.compile("/JS\\b", Pattern.CASE_INSENSITIVE),
            Pattern.compile("/JavaScript\\b", Pattern.CASE_INSENSITIVE),
            Pattern.compile("/S\\s+/JavaScript", Pattern.CASE_INSENSITIVE),
            
            // Adobe Acrobat JavaScript方法
            Pattern.compile("app\\.alert\\s*\\(", Pattern.CASE_INSENSITIVE),
            Pattern.compile("app\\.execMenuItem\\s*\\(", Pattern.CASE_INSENSITIVE),
            
            // PDF动作类型
            Pattern.compile("/AA\\b", Pattern.CASE_INSENSITIVE),        // 附加动作
            Pattern.compile("/OpenAction\\b", Pattern.CASE_INSENSITIVE), // 打开动作
            Pattern.compile("/Launch\\b", Pattern.CASE_INSENSITIVE),     // 启动应用程序
            Pattern.compile("/URI\\b", Pattern.CASE_INSENSITIVE),        // URI动作
            Pattern.compile("/GoToR\\b", Pattern.CASE_INSENSITIVE),      // 远程跳转
            Pattern.compile("/SubmitForm\\b", Pattern.CASE_INSENSITIVE), // 表单提交
            
            // 系统命令执行
            Pattern.compile("cmd\\.exe", Pattern.CASE_INSENSITIVE),
            Pattern.compile("/bin/sh", Pattern.CASE_INSENSITIVE),
            Pattern.compile("powershell", Pattern.CASE_INSENSITIVE),
            
            // 外部资源链接
            Pattern.compile("mailto:", Pattern.CASE_INSENSITIVE),
            Pattern.compile("ftp://", Pattern.CASE_INSENSITIVE),
            Pattern.compile("http://", Pattern.CASE_INSENSITIVE)
    };

    /**
     * 通过文件路径验证PDF文件安全性
     *
     * @param filePath 文件路径
     * @return 验证结果
     */
    public static boolean validatePDF(String filePath) {
        try {
            Path path = Paths.get(filePath);
            byte[] fileData = Files.readAllBytes(path);
            return validatePDF(fileData);
        } catch (IOException e) {
            log.error("读取PDF文件失败: {}", filePath, e);
            return false;
        }
    }

    /**
     * 验证PDF文件安全性
     *
     * @param fileData 文件字节数据
     * @return 验证结果
     */
    public static boolean validatePDF(byte[] fileData) {
        String content = extractTextFromPDF(fileData);
        if (containsMaliciousContent(content)) {
            return false;
        }
        return true;
    }

    /**
     * 从PDF中提取文本内容
     * 注意：这是一个非常基础的实现，实际PDF解析要复杂得多
     */
    private static String extractTextFromPDF(byte[] fileData) {
        StringBuilder content = new StringBuilder();

        try (InputStream is = new ByteArrayInputStream(fileData);
             InputStreamReader isr = new InputStreamReader(is, StandardCharsets.ISO_8859_1);
             BufferedReader reader = new BufferedReader(isr)) {

            String line;
            while ((line = reader.readLine()) != null) {
                content.append(line).append("\n");
            }

        } catch (IOException e) {
            log.error("PDF文本提取失败", e);
            return "";
        }

        return content.toString();
    }

    /**
     * 检查是否包含恶意内容
     */
    private static boolean containsMaliciousContent(String content) {
        for (Pattern pattern : MALICIOUS_PATTERNS) {
            if (pattern.matcher(content).find()) {
                log.error("检测到恶意内容: {}", pattern.pattern());
                return true;
            }
        }
        return containsPDFMaliciousContent(content);
    }

    private static boolean containsPDFMaliciousContent(String content) {
        // 检查PDF JavaScript对象
        if (content.contains("/JS") || content.contains("/JavaScript")) {
            if (containsDangerousJSCode(content)) {
                return true;
            }
        }
        return false;
    }

    private static boolean containsDangerousJSCode(String content) {
        String[] dangerousJSPatterns = {
                "app.alert", "app.execMenuItem", "this.exportDataObject",
                "util.printd", "getURL", "submitForm", "eval(", "setInterval",
                "setTimeout", "XMLHttpRequest", "ActiveXObject", "WScript"
        };

        String lowerContent = content.toLowerCase();
        for (String pattern : dangerousJSPatterns) {
            if (lowerContent.contains(pattern.toLowerCase())) {
                log.error("检测到危险JS代码: {}", pattern);
                return true;
            }
        }
        return false;
    }

    // 使用示例
    public static void main(String[] args) {
        String filePath = "D:\\test\\file.pdf";
        boolean ret = validatePDF(filePath);

        if (ret) {
            System.out.println("PDF 文件安全: " + filePath);
        } else {
            System.out.println("PDF 文件不安全: " + filePath);
        }
    }
}