Context

We're currently working on a way to support the Citoid service in retrieving metadata from PDF properties or content. Adding this functionality the citoid-service in NodeJS comes with some additional security considerations. On the one hand regarding the added node package dependencies and on the other regarding the need to put such a functionality into a separate sandboxed service.

Idea

We'll try to explore alternatives here that we would want to discuss with stackholders. The obvious one being the MediaWiki-extensions-PdfHandler that parses PDF properties using xpdf-utils and poppler-utils on the PHP backend side for uploaded PDF files.

The rough guess would be an API that

• takes a pdf link
• validates the content type and max size using the header
• downloads the pdf to a temp directory ( probably applying another layer of size restriction )
• uses the xpdf-utils and poppler-utils to extract metadata

Questions

• Could we use the PdfHandler and add an API to it that ( temporarily ) downloads PDF's files from external sources and analyzes them?
• Should we rather add such an API to the Citoid extension using the same tools in the background?