I need a shell script to detect valid PDFs. That is, I need to retain only plain ASCII PDFs. Other PDFs which contain non-ASCII contents and malicious scripts need to be deleted. How could I go about doing that? Is there any script available to do it?

  • 3
    Clarifying question: if the PDF contains only pictures of puppies, do you want to count it as ASCII or not? Apr 8 '12 at 8:29
  • 1
    What are you trying to achieve, at a high level? A computer can't detect ‘malicious’ scripts. Malice is in intent, and computers can't parse human intent. E.g. deleting a file: did you mean to do it, or was it malicious? Ifa computer could tell what you meant, we'd be using it through mind control. ;)
    – Alexios
    Apr 8 '12 at 8:30
  • 1
    Did you look at this zeltser? Apr 8 '12 at 8:31
  • 1
    You mean 'text' or really ASCII? An ü or è would be OK?
    – Matteo
    Apr 8 '12 at 8:56
  • 1
    That a PDF has only text code points that fall in the ASCII range is completely unrelated to whether it has malicious content. A malicious script could be in ASCII, and there is nothing harmful about characters not in ASCII. Apr 9 '12 at 23:45

What you want is called a virus scanner. Eg. ClamAV

  • virus scanner scan and remove only known malicious scripts how to remove unknown scripts.is it virus scanner do this operation.
    – user512213
    Apr 9 '12 at 1:48
  • 1
    How will you differentiate between good or bad? You too will only scan for known attack vectors. Although very broad, in fact you described one of those vectors above 'non-ASCII contents'.
    – jippie
    Apr 9 '12 at 8:58

There are a few python scripts here. "The Malware Archives: PDF Files" also Bruce Schneier has mentioned this on his site.

pdf2ps is easy but much less sure. This is interesting PDF/A http://en.wikipedia.org/wiki/PDF/A disallows multimedia elements.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.