- Shipped
- September 2, 2026 at 5:40 PM UTC
- Author
- Kamo
- Commit
- ed8a332
A filled rectangle drawn over an account number hides it from the eye and from nothing else: the glyphs stay in the page's content stream, and a copy-paste or a text extractor hands them straight back. The esign designer is about to offer "remove the text underneath" on its rectangle tool, and this is what has to be true for that to mean anything. Every glyph a page paints is measured, and the ones a region covers are dropped from the token stream and replaced by a TJ advance of exactly the width they occupied — so the rest of the line does not move and everything else on the page is written back untouched. Text painted from inside a form XObject cannot be reached that way, because the page's own token stream does not contain it. So the work is verified afterwards by measuring the glyphs again, and a page that still paints text inside a region is re-rendered as an image. That page loses its searchable text, which is a poor outcome and is logged as one — but it is the only one of the two options that is not a silent leak. PDFBox is declared optional so it does not reach the twenty-odd services that never open a PDF; the two that do already declare 3.0.3 themselves.