Fix DocumentRevisionsValidator producing false negative result because of Tabs entry modification

DEVSIX-8818

Author: Eugene Bochilo

sign/src/main/java/com/itextpdf/signatures/validation/DocumentRevisionsValidator.java

@@ -117,6 +117,7 @@ public class DocumentRevisionsValidator {
     static final String PAGES_MODIFIED = "Pages structure was unexpectedly modified.";
     static final String PAGE_ANNOTATIONS_MODIFIED = "Page annotations were unexpectedly modified.";
     static final String PAGE_MODIFIED = "Page was unexpectedly modified.";
+    static final String TABS_MODIFIED = "Tabs entry in a page dictionary was unexpectedly modified.";
     static final String PERMISSIONS_REMOVED = "Permissions dictionary was removed from the catalog.";
     static final String PERMISSIONS_TYPE = "Permissions must be a dictionary.";
     static final String PERMISSION_REMOVED = "Permission \"{0}\" dictionary was removed or unexpectedly modified.";
@@ -1310,17 +1311,24 @@ private boolean comparePages(PdfDictionary prevPages, PdfDictionary currPages, V
                 previousPageCopy.remove(PdfName.Annots);
                 previousPageCopy.remove(PdfName.Parent);
                 previousPageCopy.remove(PdfName.StructParents);
+                previousPageCopy.remove(PdfName.Tabs);
                 PdfDictionary currentPageCopy = new PdfDictionary(currentKid);
                 currentPageCopy.remove(PdfName.Annots);
                 currentPageCopy.remove(PdfName.Parent);
                 currentPageCopy.remove(PdfName.StructParents);
+                currentPageCopy.remove(PdfName.Tabs);
                 if (!comparePdfObjects(previousPageCopy, currentPageCopy, usuallyModifiedObjects) ||
                         !compareIndirectReferencesObjNums(previousKid.get(PdfName.Parent),
                                 currentKid.get(PdfName.Parent), report, "Page parent")) {
                     report.addReportItem(new ReportItem(DOC_MDP_CHECK, PAGE_MODIFIED, ReportItemStatus.INVALID));
                     return false;
                 }
 
+                if (!compareTabs(previousKid.getAsName(PdfName.Tabs), currentKid.getAsName(PdfName.Tabs))) {
+                    report.addReportItem(new ReportItem(DOC_MDP_CHECK, TABS_MODIFIED, ReportItemStatus.INVALID));
+                    return false;
+                }
+
                 PdfArray prevNotModifiableAnnots = getAnnotsNotAllowedToBeModified(previousKid);
                 PdfArray currNotModifiableAnnots = getAnnotsNotAllowedToBeModified(currentKid);
                 if (!comparePageAnnotations(prevNotModifiableAnnots, currNotModifiableAnnots, report)) {
@@ -1335,6 +1343,13 @@ private boolean comparePages(PdfDictionary prevPages, PdfDictionary currPages, V
         return true;
     }
 
+    private boolean compareTabs(PdfName previousTabs, PdfName currentTabs) {
+        if (getAccessPermissions() == AccessPermissions.ANNOTATION_MODIFICATION) {
+            return true;
+        }
+        return Objects.equals(previousTabs, currentTabs) || (previousTabs == null && currentTabs.equals(PdfName.S));
+    }
+
     private void collectRemovedAndAddedAnnotations(PdfArray previousAnnotations, PdfArray currentAnnotations) {
         ValidationReport dummyReport = new ValidationReport();
         List<PdfDictionary> prevAnnots = new ArrayList<>();

sign/src/test/java/com/itextpdf/signatures/validation/DocumentRevisionsValidatorIntegrationTest.java

@@ -550,6 +550,46 @@ public void taggedDocRemoveStructTreeElementTest(boolean continueValidationAfter
         }
     }
 
+    @ParameterizedTest(name = "Continue validation after failure: {0}")
+    @MethodSource("createParameters")
+    public void annotationModificationAllowedTabsChangesTest(boolean continueValidationAfterFail) throws IOException {
+        setUp(continueValidationAfterFail);
+        try (PdfDocument document = new PdfDocument(new PdfReader(SOURCE_FOLDER + "annotationModificationAllowedTabsChangesTest.pdf"))) {
+            DocumentRevisionsValidator validator = builder.buildDocumentRevisionsValidator();
+            ValidationReport report = validator.validateAllDocumentRevisions(validationContext, document);
+
+            AssertValidationReport.assertThat(report, a -> a.hasStatus(ValidationResult.VALID).hasNumberOfLogs(0));
+        }
+    }
+
+    @ParameterizedTest(name = "Continue validation after failure: {0}")
+    @MethodSource("createParameters")
+    public void annotationModificationNotAllowedTabsChangesTest(boolean continueValidationAfterFail) throws IOException {
+        setUp(continueValidationAfterFail);
+        try (PdfDocument document = new PdfDocument(new PdfReader(SOURCE_FOLDER + "annotationModificationNotAllowedTabsChangesTest.pdf"))) {
+            DocumentRevisionsValidator validator = builder.buildDocumentRevisionsValidator();
+            ValidationReport report = validator.validateAllDocumentRevisions(validationContext, document);
+
+            AssertValidationReport.assertThat(report, a -> a.hasStatus(ValidationResult.INVALID)
+                    .hasNumberOfFailures(1)
+                    .hasLogItem(l -> l.withCheckName(DocumentRevisionsValidator.DOC_MDP_CHECK)
+                            .withMessage(DocumentRevisionsValidator.TABS_MODIFIED)
+                            .withStatus(ReportItemStatus.INVALID)));
+        }
+    }
+
+    @ParameterizedTest(name = "Continue validation after failure: {0}")
+    @MethodSource("createParameters")
+    public void annotationModificationNotAllowedTabsSetToDefaultTest(boolean continueValidationAfterFail) throws IOException {
+        setUp(continueValidationAfterFail);
+        try (PdfDocument document = new PdfDocument(new PdfReader(SOURCE_FOLDER + "annotationModificationNotAllowedTabsSetToDefaultTest.pdf"))) {
+            DocumentRevisionsValidator validator = builder.buildDocumentRevisionsValidator();
+            ValidationReport report = validator.validateAllDocumentRevisions(validationContext, document);
+
+            AssertValidationReport.assertThat(report, a -> a.hasStatus(ValidationResult.VALID).hasNumberOfLogs(0));
+        }
+    }
+
     @ParameterizedTest(name = "Continue validation after failure: {0}")
     @MethodSource("createParameters")
     public void outlinesNotModifiedTest(boolean continueValidationAfterFail) throws IOException {