<html> <head> <base href="https://bugs.freedesktop.org/"> </head> <body> <div> <a class="bz_bug_link bz_status_NEW " title="NEW - Allow to set the pdf metadata producer" href="https://bugs.freedesktop.org/show_bug.cgi?id=99514#c3">Comment # 3</a> on <a class="bz_bug_link bz_status_NEW " title="NEW - Allow to set the pdf metadata producer" href="https://bugs.freedesktop.org/show_bug.cgi?id=99514">bug 99514</a> from <a class="email" href="mailto:ajohnson@redneon.com" title="Adrian Johnson <ajohnson@redneon.com>"> Adrian Johnson</a> <pre>(In reply to Paolo Borelli from <a href="show_bug.cgi?id=99514#c2">comment #2</a>) > There are two reasons why we would like to be able to set this metadata: > > > 1) There are libraries that use cairo internally: one example is libgxps > which is used to convert xps to pdf and internally uses cairo: I think it > would be more accurate to be able to set producer to gxps in that case In this case you set the creator to gxps. The creator is the code that generated the PDF content. The producer is the code that generated the PDF structure. > 2) As Ignacio mentioned, there are cases where it would be better to not > include any metadata at all. This was reported to us as a security concern, > if you have a server application that generates a pdf an attacker can know > that the server is using cairo for that specific function and explot known > vulerabilities This is not a valid security concern. It is easy to determine the producer by comparing the PDF structure with sample output from various PDF producers.</pre> </div> <hr> You are receiving this mail because: <ul> <li>You are the QA Contact for the bug.</li> </ul> </body> </html>