locally hosted web application that allows you to perform various operations on PDF files
Go to file
Ludy 81c14351ee
fix(common): 🛡️CWE-681 & CWE-197 eliminate tainted numeric casts in size parsing by using BigDecimal with range guards (#5521)
# Description of Changes

This pull request refactors and improves the logic for converting
human-readable size strings (like "10MB", "2.5GB") to bytes in the
`GeneralUtils` utility class. The main enhancement is switching from
imprecise floating-point arithmetic to `BigDecimal` for more accurate
and robust conversions, and centralizing the conversion logic to reduce
code duplication and improve maintainability.

**Improvements to size conversion logic:**

* Replaced all floating-point arithmetic in `convertSizeToBytes` with
`BigDecimal` operations to ensure precision and to handle large values
more safely.
* Introduced a new private method `toBytes(BigDecimal value, int
powerOf1024)` to centralize and standardize the conversion from size
units to bytes, including error handling for negative and excessively
large values.
* Added constants `KIB` and `LONG_MAX_DECIMAL` for improved readability
and maintainability of size calculations.
* Added a helper method `parseSizeValue(String value)` to consistently
parse size values as `BigDecimal`.
* Updated imports to include `BigDecimal` and `RoundingMode` for the new
conversion logic.

---

## Checklist

### General

- [ ] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
- [ ] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/DeveloperGuide.md)
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md)
(if applicable)
- [ ] I have performed a self-review of my own code
- [ ] My changes generate no new warnings

### Documentation

- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/)
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags)
(for new translation tags only)

### Translations (if applicable)

- [ ] I ran
[`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md)

### UI Changes (if applicable)

- [ ] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)

### Testing (if applicable)

- [ ] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/DeveloperGuide.md#6-testing)
for more details.
2026-01-22 19:48:49 +00:00
.devcontainer chore: update development configs, formatting tools, and CI enhancements (#4130) 2025-08-08 12:52:51 +01:00
.github Add sync-versions job to GitHub Actions workflow (#5228) 2026-01-22 19:23:52 +00:00
.vscode V2 Auto rename (#4244) 2025-09-05 17:12:52 +01:00
app fix(common): 🛡️CWE-681 & CWE-197 eliminate tainted numeric casts in size parsing by using BigDecimal with range guards (#5521) 2026-01-22 19:48:49 +00:00
devGuide refactor: remove legacy Thymeleaf web UI controllers and templates (#5406) 2026-01-21 21:58:29 +00:00
devTools build(deps-dev): bump stylelint-config-standard from 39.0.1 to 40.0.0 in /devTools (#5504) 2026-01-21 22:24:29 +00:00
docker Libre threads (#5303) 2026-01-15 19:14:45 +00:00
docs V1 merge (#5193) 2025-12-21 10:40:32 +00:00
frontend feat(frontend): enhance icon detection and update config navigation icon (#5524) 2026-01-22 19:37:37 +00:00
gradle/wrapper Upgrade Gradle to 8.14 in CI Workflows and Gradle Wrapper (#3425) 2025-04-27 16:17:07 +01:00
images Revert "[ImgBot] Optimize images" (#5293) 2025-12-22 22:10:23 +00:00
scripts Libre threads (#5303) 2026-01-15 19:14:45 +00:00
testing build(deps): bump reportlab from 4.4.5 to 4.4.9 in /testing/cucumber (#5505) 2026-01-21 22:24:58 +00:00
.dockerignore java frontend (#5097) 2025-12-02 17:15:29 +00:00
.editorconfig Add linting to frontend (#4341) 2025-09-04 14:08:28 +01:00
.git-blame-ignore-revs refactor: move modules under app/ directory and update file paths (#3938) 2025-07-14 20:53:11 +01:00
.gitattributes refactor: move modules under app/ directory and update file paths (#3938) 2025-07-14 20:53:11 +01:00
.gitignore refactor(security): clean up SSO handling, harden URL parsing, and bump dependencies (#5523) 2026-01-22 19:39:34 +00:00
.pre-commit-config.yaml deps(ci): update Dependabot, pre-commit tooling, and testing dependencies (#5170) 2025-12-27 23:56:57 +00:00
ADDING_TOOLS.md refactor: remove legacy Thymeleaf web UI controllers and templates (#5406) 2026-01-21 21:58:29 +00:00
build.gradle refactor(security): clean up SSO handling, harden URL parsing, and bump dependencies (#5523) 2026-01-22 19:39:34 +00:00
CLAUDE.md refactor: remove legacy Thymeleaf web UI controllers and templates (#5406) 2026-01-21 21:58:29 +00:00
CONTRIBUTING.md exception handling and exception improvements (#3858) 2025-07-02 16:51:45 +01:00
DATABASE.md feat(database): make backup schedule configurable via system keys (#4251) 2025-09-04 15:02:31 +01:00
DeveloperGuide.md refactor: remove legacy Thymeleaf web UI controllers and templates (#5406) 2026-01-21 21:58:29 +00:00
gradle.properties build(local): simplify writeVersion task with WriteProperties plugin and enable build caching (#4139) 2025-08-08 10:36:30 +01:00
gradlew Upgrade Gradle to 8.14 in CI Workflows and Gradle Wrapper (#3425) 2025-04-27 16:17:07 +01:00
gradlew.bat Upgrade Gradle to 8.14 in CI Workflows and Gradle Wrapper (#3425) 2025-04-27 16:17:07 +01:00
HowToUseOCR.md Improve Markdown documentation a bit 2024-12-22 17:37:58 +08:00
launch4jConfig.xml ci: enhance GitHub Actions workflows with Gradle setup, caching improvements, and Docker image testing (#3956) 2025-07-16 17:17:11 +01:00
LICENSE Update LICENSE with proprietary directory details 2025-11-27 11:11:53 +00:00
README.md Update wording for third-party services reference 2025-12-02 19:14:03 +00:00
SECURITY.md Improve Markdown documentation a bit 2024-12-22 17:37:58 +08:00
settings.gradle chore(ci): enable Gradle dependency caching across GitHub workflows (#5400) 2026-01-19 19:03:50 +00:00
test_globalsign.pdf V2 Validate PDF Signature tool (#4679) 2025-10-16 13:45:59 +01:00
test_irs_signed.pdf V2 Validate PDF Signature tool (#4679) 2025-10-16 13:45:59 +01:00
WINDOWS_SIGNING.md Add initial Windows signing infrastructure (#4945) 2025-11-20 12:21:42 +00:00

Stirling PDF logo

Stirling PDF - The Open-Source PDF Platform

Stirling PDF is a powerful, open-source PDF editing platform. Run it as a personal desktop app, in the browser, or deploy it on your own servers with a private API. Edit, sign, redact, convert, and automate PDFs without sending documents to external services.

Docker Pulls Discord OpenSSF Scorecard GitHub Repo stars

Stirling PDF - Dashboard

Key Capabilities

  • Everywhere you work - Desktop client, browser UI, and self-hosted server with a private API.
  • 50+ PDF tools - Edit, merge, split, sign, redact, convert, OCR, compress, and more.
  • Automation & workflows - No-code pipelines direct in UI with APIs to process millions of PDFs.
  • Enterprisegrade - SSO, auditing, and flexible onprem deployments.
  • Developer platform - REST APIs available for nearly all tools to integrate into your existing systems.
  • Global UI - Interface available in 40+ languages.

For a full feature list, see the docs: https://docs.stirlingpdf.com

Quick Start

docker run -p 8080:8080 docker.stirlingpdf.com/stirlingtools/stirling-pdf

Then open: http://localhost:8080

For full installation options (including desktop and Kubernetes), see our Documentation Guide.

Resources

Support

Contributing

We welcome contributions! Please see CONTRIBUTING.md for guidelines.

For development setup, see the Developer Guide.

For adding translations, see the Translation Guide.

License

Stirling PDF is open-core. See LICENSE for details.