pdf-processor

The code appears to be legitimate OCR-to-searchable-PDF processing code and contains no clear malware indicators. If API payloads are attacker-controlled, output_pdf_url can cause SSRF or downloading arbitrary remote content, and output_pdf_path can copy arbitrary readable local files to the chosen output location. These risks depend on the surrounding API trust model and the implementation of http_get_bytes. The supplied fragment also appears syntactically invalid because TextLayerIntegrityError has no class body. Apply URL allowlisting, restrict local paths, enforce response and decoded-size limits, and correct the class definition before use.

The code appears to implement a legitimate remote OCR integration and contains no clear malware indicators, credential harvesting, persistence, or arbitrary code execution. It has a concrete archive path traversal vulnerability because remote ZIP entries are extracted without validation. It also trusts API-provided upload and download URLs, which could enable unintended data transfer if the configured API or its response is compromised. ZIP members should be validated to remain within the temporary directory, and outbound URLs should be restricted to expected hosts and schemes.