feat: downgrade RSC-004 (cannot decrypt resource) to INFO #1136
Conversation
A USAGE better describes EPUBCheck’s unability to decrypt or de-obfuscate a resource. - All the incomplete `EncryptionFilter` implementations now accurately report they cannot decrypt related content. - Validation will abort early for encrypted (or obfuscated) files, reporting RSC-004 as a USAGE message. Fixes 1077, caused by an attempt to parse an obfuscated SVG document which was falsely assumed decryptable by the lying `EncryptionFilter` (boo).
|
I'm kind of torn on this one. Issuing a warning sounds like the right thing to do, not because of anything the specification says, but because it can lead to content slipping by without being thoroughly checked. The usage message isn't going to show up unless you turn it on, right? It sort of seems like something the person validating should silence through a flag, so that it's a conscious decision to ignore the encrypted/obfuscated content and any problems that might exist in it. |
|
Maybe using |
|
@mattgarrish I updated the PR. Running it on the obfuscated SVG test will give the following output: |
Two changes to EPUBCheck were causing the tests to change: The first changes the error messages returned for validation of a non-EPUB: w3c/epubcheck#1134 The solution was to change the message count. The second downgrades the encrypted file message to INFO w3c/epubcheck#1136 The original implementation of the JHOVE EPUB module did not include INFO messages generated by EPUBCheck in the JHOVE report, but looking at the kinds of messages that might be listed as INFO messages I thought it might be useful to include them. The change to add INFO messages is reflected in this commit.
Unless I'm missing something, the spec doesn’t say that a reading system MUST or SHOULD support EPUB encryption.
EPUBCheck currently cannot decrypt encrypted or obfuscated resources. Previously, it reported any attempt to read an encrypted resource as an error, RSC-004. Internally, the code declared obfuscated resources as readable, even if it cannot practically read it, to not report obfuscated fonts as errors.
This is problematic for resources that EPUBCheck will try to parse deeper down the validation workflow (like SVG). The resource is declared as readable, so EPUBCheck tries to parse it, and fails with a
NullPointerException(issue #1077).The inability to read encrypted or obfuscated resources is a limitation of EPUBCheck. EPUBCheck should:
This PR tries to do that by downgrading the severity of RSC-004 to
USAGE. It also updates the de-encryption filters to accurately report that they cannot read the content. Validation of encrypted or obfuscated resource will then abort early, before trying to parse the content.Obfuscated fonts, which are likely the most common usage of obfuscation, will keep on not being reported as warnings (see issue #220). The only difference is that they will now trigger the RSC-004 usage message.
Fixes #1077