Repository navigation
fix(pdfengines): treat an empty stamp or watermark source as no entry - #1692
Merged
Merged
Conversation
Since 3de6932 an empty stampSource or watermarkSource fails the source check and the request returns 400. Before, an empty value meant no stamp, and WatermarkStub and StampStub still skip entries with no source. Skip it again; the other repeated fields keep their position.
hbjydev
pushed a commit
to hbjydev/phoebe
that referenced
this pull request
Oct 27, 2026
This PR contains the following updates: | Package | Update | Change | |---|---|---| | [gotenberg/gotenberg](https://github.com/gotenberg/gotenberg) | minor | `8.38.1` → `8.39.0` | --- ### Release Notes <details> <summary>gotenberg/gotenberg</summary> ### [`v8.39.0`](https://github.com/gotenberg/gotenberg/releases/tag/v8.39.0): 8.39.0 [Compare Source](gotenberg/gotenberg@v8.38.1...v8.39.0) ##### Security Fixes⚠️ - **Reject ExifTool's `j` option alias and stop loading ExifTool config files.** The metadata check blocked `json` but not its alias `j`. A metadata key could import a JSON file carrying a `HardLink` pseudo-tag, plant `~/.ExifTool_config`, and have the next ExifTool run execute it as Perl. The keys `j`, `addtagsfromfile`, and `alltagsfromfile` now return `400`, and Gotenberg always runs ExifTool with `-config ""`. - **Accept only `http://` and `https://` URLs on the URL routes.** The default deny-list only covered `file://`, so `devtools://devtools/bundled/devtools_app.html` loaded Chromium's privileged DevTools page, and `waitForExpression` ran there with access to local files. `/forms/chromium/convert/url` and `/forms/chromium/screenshot/url` now return `400` for any other scheme. - **Apply path and `wss://` deny rules to WebSocket handshakes.** The pinning proxy matched CONNECT tunnels against `https://host:port`, so a deny rule anchored on a path, such as `^https?://host/`, or on `wss://` refused the plain request but let the handshake through. The proxy now matches tunnels against each scheme's root URL, and a handshake whose full URL is denied fails the conversion with a generic `403`. - **Drop the compromised eMudhra roots** ([#​1699](gotenberg/gotenberg#1699)). The images trusted `emSign ECC Root CA - G3` and `AAA Certificate Services`, whose intermediates have recoverable private keys. The OS bundle now comes from `ca-certificates` `20250419+deb13u1`, the Java trust store used by PDFtk drops both roots, and Chromium 156 rejects them. Thanks [@​hrueger](https://github.com/hrueger). ##### New Features - **`failOnConsoleMessageTypes` for Chromium** ([#​1667](gotenberg/gotenberg#1667)). Fails the conversion with `409` when the page logs a console message of one of the given types (`log`, `debug`, `info`, `warning`, `error`, `assert`). The response lists the messages. Thanks [@​jschneider](https://github.com/jschneider). - **PDF/A-4** ([#​1703](gotenberg/gotenberg#1703)). The `pdfa` form field now accepts `PDF/A-4` on every route that supports it, through the LibreOffice PDF engine. Thanks [@​henningda](https://github.com/henningda). - **`Gotenberg-Version` response header** ([#​1693](gotenberg/gotenberg#1693)). Set on every authenticated route, error responses included, and on webhook deliveries. It is not set on `401` responses or `/health` ([#​1694](gotenberg/gotenberg#1694)). Thanks [@​fragkakis](https://github.com/fragkakis). ##### Behavior Changes - **The URL routes reject non-HTTP schemes.** `chrome://`, `devtools://`, `data:`, and any other scheme besides `http` and `https` now return `400`. - **ExifTool ignores `~/.ExifTool_config`.** The metadata keys `j`, `addtagsfromfile`, and `alltagsfromfile` now return `400`. Prefix them with a group, for example `XMP:j`, to write a tag of that name. - **The `XRECHNUNG` Factur-X profile embeds `xrechnung.xml`.** See the bug fix below. ##### Bug Fixes - **Sporadic `502` on uploads behind HTTP/2 proxies** ([#​1112](gotenberg/gotenberg#1112)). Behind Cloud Run with an `h2c` port, the proxy sent large DATA frames, Go answered with a flood of WINDOW_UPDATE frames, and the proxy dropped the connection mid-upload. Gotenberg now advertises the 16 KiB HTTP/2 default frame size ([#​1700](gotenberg/gotenberg#1700)). Thanks [@​TessilimiTheo](https://github.com/TessilimiTheo) and [@​geoherna](https://github.com/geoherna). - **No listener with absolute TLS paths** ([#​1690](gotenberg/gotenberg#1690)). Since 8.38.0, `--api-tls-cert-file` and `--api-tls-key-file` with absolute paths left Gotenberg running without accepting connections. Both paths work again, and a missing or unreadable file now fails the startup ([#​1691](gotenberg/gotenberg#1691)). Thanks [@​n-rodriguez](https://github.com/n-rodriguez). - **Empty `stampSource` or `watermarkSource` returned `400`** ([#​1692](gotenberg/gotenberg#1692)). Since 8.36.0, a blank source failed the merge, split, Chromium, and LibreOffice routes. An empty source is skipped again. Thanks [@​APX403](https://github.com/APX403). - **OIDC rejected `bearer` in lower case** ([#​1696](gotenberg/gotenberg#1696)). The Authorization scheme is now matched case-insensitively, as RFC 9110 requires. Thanks [@​MaxFreedomPollard](https://github.com/MaxFreedomPollard). - **The `XRECHNUNG` Factur-X profile embedded `factur-x.xml`** ([#​1701](gotenberg/gotenberg#1701)). The spec requires `xrechnung.xml` for this profile, both as the embedded file and in `fx:DocumentFileName`. Other levels keep `factur-x.xml`. Thanks [@​nhh](https://github.com/nhh). ##### Chore - Updated Chromium to `156.0.8078.47`. - Updated pdfcpu to `v0.16.3` and bumped Go to `1.27.3`, which fix several HIGH CVEs in the Go standard library and `golang.org/x` modules ([#​1695](gotenberg/gotenberg#1695)). Thanks [@​sergeykad](https://github.com/sergeykad). - Updated the AWS Lambda Web Adapter to `1.1.0`, which supports Lambda SnapStart ([#​1704](gotenberg/gotenberg#1704)). Thanks [@​michael-follmann](https://github.com/michael-follmann). - Bumped golangci-lint to `v2.15.0`. - Updated Go dependencies. </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/London) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xODEuNyIsInVwZGF0ZWRJblZlciI6IjQ0LjE4MS43IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZS9jb250YWluZXIiLCJ0eXBlL21pbm9yIl19--> Reviewed-on: https://git.hayden.moe/hayden/phoebe/pulls/1021
eleboucher
pushed a commit
to eleboucher/homelab
that referenced
this pull request
Oct 31, 2026
… 8.39.0) (#2479) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [docker.io/gotenberg/gotenberg](https://github.com/gotenberg/gotenberg) | minor | `8.38.1` → `8.39.0` | --- ### Release Notes <details> <summary>gotenberg/gotenberg (docker.io/gotenberg/gotenberg)</summary> ### [`v8.39.0`](https://github.com/gotenberg/gotenberg/releases/tag/v8.39.0): 8.39.0 [Compare Source](gotenberg/gotenberg@v8.38.1...v8.39.0) ##### Security Fixes⚠️ - **Reject ExifTool's `j` option alias and stop loading ExifTool config files.** The metadata check blocked `json` but not its alias `j`. A metadata key could import a JSON file carrying a `HardLink` pseudo-tag, plant `~/.ExifTool_config`, and have the next ExifTool run execute it as Perl. The keys `j`, `addtagsfromfile`, and `alltagsfromfile` now return `400`, and Gotenberg always runs ExifTool with `-config ""`. - **Accept only `http://` and `https://` URLs on the URL routes.** The default deny-list only covered `file://`, so `devtools://devtools/bundled/devtools_app.html` loaded Chromium's privileged DevTools page, and `waitForExpression` ran there with access to local files. `/forms/chromium/convert/url` and `/forms/chromium/screenshot/url` now return `400` for any other scheme. - **Apply path and `wss://` deny rules to WebSocket handshakes.** The pinning proxy matched CONNECT tunnels against `https://host:port`, so a deny rule anchored on a path, such as `^https?://host/`, or on `wss://` refused the plain request but let the handshake through. The proxy now matches tunnels against each scheme's root URL, and a handshake whose full URL is denied fails the conversion with a generic `403`. - **Drop the compromised eMudhra roots** ([#​1699](gotenberg/gotenberg#1699)). The images trusted `emSign ECC Root CA - G3` and `AAA Certificate Services`, whose intermediates have recoverable private keys. The OS bundle now comes from `ca-certificates` `20250419+deb13u1`, the Java trust store used by PDFtk drops both roots, and Chromium 156 rejects them. Thanks [@​hrueger](https://github.com/hrueger). ##### New Features - **`failOnConsoleMessageTypes` for Chromium** ([#​1667](gotenberg/gotenberg#1667)). Fails the conversion with `409` when the page logs a console message of one of the given types (`log`, `debug`, `info`, `warning`, `error`, `assert`). The response lists the messages. Thanks [@​jschneider](https://github.com/jschneider). - **PDF/A-4** ([#​1703](gotenberg/gotenberg#1703)). The `pdfa` form field now accepts `PDF/A-4` on every route that supports it, through the LibreOffice PDF engine. Thanks [@​henningda](https://github.com/henningda). - **`Gotenberg-Version` response header** ([#​1693](gotenberg/gotenberg#1693)). Set on every authenticated route, error responses included, and on webhook deliveries. It is not set on `401` responses or `/health` ([#​1694](gotenberg/gotenberg#1694)). Thanks [@​fragkakis](https://github.com/fragkakis). ##### Behavior Changes - **The URL routes reject non-HTTP schemes.** `chrome://`, `devtools://`, `data:`, and any other scheme besides `http` and `https` now return `400`. - **ExifTool ignores `~/.ExifTool_config`.** The metadata keys `j`, `addtagsfromfile`, and `alltagsfromfile` now return `400`. Prefix them with a group, for example `XMP:j`, to write a tag of that name. - **The `XRECHNUNG` Factur-X profile embeds `xrechnung.xml`.** See the bug fix below. ##### Bug Fixes - **Sporadic `502` on uploads behind HTTP/2 proxies** ([#​1112](gotenberg/gotenberg#1112)). Behind Cloud Run with an `h2c` port, the proxy sent large DATA frames, Go answered with a flood of WINDOW_UPDATE frames, and the proxy dropped the connection mid-upload. Gotenberg now advertises the 16 KiB HTTP/2 default frame size ([#​1700](gotenberg/gotenberg#1700)). Thanks [@​TessilimiTheo](https://github.com/TessilimiTheo) and [@​geoherna](https://github.com/geoherna). - **No listener with absolute TLS paths** ([#​1690](gotenberg/gotenberg#1690)). Since 8.38.0, `--api-tls-cert-file` and `--api-tls-key-file` with absolute paths left Gotenberg running without accepting connections. Both paths work again, and a missing or unreadable file now fails the startup ([#​1691](gotenberg/gotenberg#1691)). Thanks [@​n-rodriguez](https://github.com/n-rodriguez). - **Empty `stampSource` or `watermarkSource` returned `400`** ([#​1692](gotenberg/gotenberg#1692)). Since 8.36.0, a blank source failed the merge, split, Chromium, and LibreOffice routes. An empty source is skipped again. Thanks [@​APX403](https://github.com/APX403). - **OIDC rejected `bearer` in lower case** ([#​1696](gotenberg/gotenberg#1696)). The Authorization scheme is now matched case-insensitively, as RFC 9110 requires. Thanks [@​MaxFreedomPollard](https://github.com/MaxFreedomPollard). - **The `XRECHNUNG` Factur-X profile embedded `factur-x.xml`** ([#​1701](gotenberg/gotenberg#1701)). The spec requires `xrechnung.xml` for this profile, both as the embedded file and in `fx:DocumentFileName`. Other levels keep `factur-x.xml`. Thanks [@​nhh](https://github.com/nhh). ##### Chore - Updated Chromium to `156.0.8078.47`. - Updated pdfcpu to `v0.16.3` and bumped Go to `1.27.3`, which fix several HIGH CVEs in the Go standard library and `golang.org/x` modules ([#​1695](gotenberg/gotenberg#1695)). Thanks [@​sergeykad](https://github.com/sergeykad). - Updated the AWS Lambda Web Adapter to `1.1.0`, which supports Lambda SnapStart ([#​1704](gotenberg/gotenberg#1704)). Thanks [@​michael-follmann](https://github.com/michael-follmann). - Bumped golangci-lint to `v2.15.0`. - Updated Go dependencies. </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xODEuOSIsInVwZGF0ZWRJblZlciI6IjQ0LjE4MS45IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://git.erwanleboucher.dev/eleboucher/homelab/pulls/2479
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Since 8.36.0, an empty
watermarkSourceorstampSourcefails the request. Mergingpage_1.pdfandpage_2.pdfwithwatermarkSource=andstampSource=returns 200 on 8.35.0, and this on 8.38.1:Split fails the same way, the Chromium and LibreOffice routes read these fields through the same parser, and
/forms/pdfengines/stampnow calls an emptystampSourceinvalid where 8.35.0 said it was required. Clients that always send every field, with blank values for the ones they don't use, break on upgrade.The multi-stamp change in 3de6932 dropped the
value != ""guard of the old parser, so an empty entry reaches the source check at routes.go#L881-L882.WatermarkStubandStampStubstill document that entries with no source are skipped (L956-L957, L982-L983).An empty source is skipped again, and the other repeated fields keep their position. Merge and split return 200 with blank sources, and the stamp route answers
form field 'stampSource' is requiredas it did on 8.35.0.TestFormDataPdfStampsgets two cases for it.