Input validation
Magic-byte checks cover PDF, PNG, JPEG, DOCX, XLSX, and PPTX; empty, oversized, truncated, and unsupported inputs are rejected.
Protego Research
Document Sanitizer methodology and validation
A transparent account of what Protego's rasterize-and-rebuild pipeline does, what its automated tests establish, and what the tool cannot guarantee.
51
Service tests passed
Six test files passed on August 23, 2026. The suite covers validation, authentication, conversion orchestration, rasterization, rebuild cleanup, and HTTP behavior.
6
Accepted input formats
PDF, DOCX, XLSX, PPTX, PNG, and JPEG are identified from their file signatures rather than their names.
2
Harmless public fixtures
A reproducible script creates synthetic PDFs containing a JavaScript action and an example.com link. It never opens or executes either original file.
Security model
The sanitizer does not try to decide whether the original file is malicious. It renders visible pages to pixels and constructs a new PDF from those images. Macros, PDF JavaScript, OLE objects, form logic, embedded files, and clickable link annotations are structural objects; they are not copied into the rebuilt document.
Authentication
The web application signs short-lived HMAC tokens before it calls the isolated conversion service. Tampered, expired, malformed, and wrong-secret tokens are rejected.
Rasterization
PDF pages are rendered to numbered PNG images. Office files are first converted to PDF; images are re-encoded with metadata stripping.
Rebuild and cleanup
Only rendered page images are passed to the PDF rebuild step. The temporary working directory is removed after output is read.
Failure controls
The service enforces file-size, page-count, output-size, concurrency, and conversion-time limits.
How to reproduce the active-content check
- Run the repository script to generate two small synthetic PDFs. One contains a harmless
/OpenActionJavaScript marker; the other contains a clickable/URIaction to example.com. - Submit each fixture through the Document Sanitizer. Do not open the originals; generation and byte inspection do not require execution.
- Confirm the response is a PDF and that the original action tokens and unique markers are absent from the rebuilt bytes.
This is a narrow structural test, not a malware-detection benchmark. The public method intentionally avoids weaponized files and does not claim coverage of every parser exploit or document feature.
View the reproducible fixture scriptWhat the 51 tests do and do not prove
They establish
- Expected format and size validation behavior
- Short-lived request authentication behavior
- The intended rasterize, rebuild, cleanup, and limit-control flow
- HTTP responses for health, authorization, invalid files, oversized bodies, and concurrency limits
They do not establish
- That every malformed or targeted document is safe
- That visible URLs, QR codes, or social-engineering content disappear
- That pixel-perfect layout, accessibility tags, forms, animations, or signatures survive
- That an online service offers the same isolation as an offline sandbox
Use the right tool for the risk
Use Protego for convenient flattening of routine suspicious attachments. Keep endpoint protection enabled. For a targeted, sensitive, or high-value file, prefer an offline isolated tool such as Dangerzone and involve a security analyst.