Update dependency PyPDF2 to v1.27.5 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
PyPDF2 (source, changelog)	==1.26.0 -> ==1.27.5

GitHub Vulnerability Alerts

CVE-2022-24859

Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop if the PyPDF2 user wrote the following code:

from PyPDF2 import PdfFileReader, PdfFileWriter
from PyPDF2.pdf import ContentStream

reader = PdfFileReader("malicious.pdf", strict=False)
for page in reader.pages:
    ContentStream(page.getContents(), reader)

Patches

PyPDF2==1.27.5 and later are patched.

Credits to Sebastian Krause for finding (issue) and fixing (PR) it.

---

Release Notes

py-pdf/PyPDF2

v1.27.5

Compare Source

Security (SEC):

• ContentStream_readInlineImage had potential infinite loop (#​740)

Bug fixes (BUG):

• Fix merging encrypted files (#​757)
• CCITTFaxDecode decodeParms can be an ArrayObject (#​756)

Robustness improvements (ROBUST):

• title sometimes None (#​744)

Documentation (DOC):

• Adjust short description of the package

Tests and Test setup (TST):

• Rewrite JS tests from unittest to pytest (#​746)
• Increase Test coverage, mainly with filters (#​756)
• Add test for inline images (#​758)

Developer Experience Improvements (DEV):

• Remove unused Travis-CI configuration (#​747)
• Show code coverage (#​754, #​755)
• Add mutmut (#​760)

Miscellaneous:

• STY: Closing file handles, explicit exports, ... (#​743)

All changes: py-pdf/pypdf@1.27.4...1.27.5

v1.27.4

Compare Source

Bug fixes (BUG):

• Guard formatting of init.doc string (#​738)

Packaging (PKG):

• Add more precise license field to setup (#​733)

Testing (TST):

• Add test for issue #​297

Miscellaneous:

• DOC: Miscallenious ➔ Miscellaneous (Typo)
• TST: Fix CI triggering (master ➔ main) (#​739)
• STY: Fix various style issues (#​742)

All changes: py-pdf/pypdf@1.27.3...1.27.4

v1.27.3

Compare Source

v1.27.2

Compare Source

v1.27.1

Compare Source

Bug Fixes (BUG):

• _rebuild_xref_table expects trailer to be a dict (#​857)

Documentation (DOC):

• Security Policy

Full Changelog: py-pdf/pypdf@1.27.11...1.27.12

v1.27.0

Compare Source

Features:

• Add alpha channel support for png files in Script (#​614)

Bug fixes (BUG):

• Fix formatWarning for filename without slash (#​612)
• Add whitespace between words for extractText() (#​569, #​334)
• "invalid escape sequence" SyntaxError (#​522)
• Avoid error when printing warning in pythonw (#​486)
• Stream operations can be List or Dict (#​665)

Documentation (DOC):

• Added Scripts/pdf-image-extractor.py
• Documentation improvements (#​550, #​538, #​324, #​426, #​394)

Tests and Test setup (TST):

• Add Github Action which automatically run unit tests via pytest and
  static code analysis with Flake8 (#​660)
• Add several unit tests (#​661, #​663)
• Add .coveragerc to create coverage reports

Developer Experience Improvements (DEV):

• Pre commit: Developers can now pre-commit install to avoid tiny issues
  like trailing whitespaces

Miscellaneous:

• Add the LICENSE file to the distributed packages (#​288)
• Use setuptools instead of distutils (#​599)
• Improvements for the PyPI page (#​644)
• Python 3 changes (#​504, #​366)

You can see the full changelog at: py-pdf/pypdf@1.26.0...1.27.0

Patch release 1.27.1, 2022-04-08

• Fixed project links on PyPI page after migration from mstamy2
  to MartinThoma to the py-pdf organization on GitHub
• Documentation is now at https://pypdf2.readthedocs.io/en/latest/

Patch release 1.27.2, 2022-04-09

• Add Scripts (including pdfcat), Resources, Tests, and Sample_Code back to
  PyPDF2. It was removed by accident in 1.27.0, but might get removed with 2.0.0
  https://github.com/py-pdf/PyPDF2/discussions/718ions/718 for discussion

Patch release 1.27.3, 2022-04-10

• PKG: Make Tests not a subpackage (#​728)
• BUG: Fix ASCII85Decode.decode assertion (#​729)
• BUG: Error in Chinese character encoding (#​463)
• BUG: Code duplication in Scripts/2-up.py
• ROBUST: Guard 'obj.writeToStream' with 'if obj is not None'
• ROBUST: Ignore a /Prev entry with the value 0 in the trailer
• MAINT: Remove Sample_Code (#​726)
• TST: Close file handle in test_writer (#​722)
• TST: Fix test_get_images (#​730)
• DEV: Make tox use pytest and add more Python versions (#​721)
• DOC: Many (#​720, #​723-725, #​469)

---

Configuration

📅 Schedule: "" (UTC).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, click this checkbox.

---

This PR has been generated by WhiteSource Renovate. View repository job log here.

[viezly]

Pull request by bot. No need to analyze