New PDF upload security validation setting

Administration Security
1

As of versions 9.6.1 (v9) and 10.3.1 (v10), WorkflowGen can validate PDF files uploaded through forms to detect potentially unsafe active content and malformed document structures.

You can set the PDF security profile using either:

  • The ApplicationDefaultFileUploadPdfSecurityProfile parameter in the WorkflowGen web.config file (values: Off, Compatibility, or Strict)
  • The PDF upload security profile setting in the Security section on the Configuration panel General tab.

Available security profiles

Off

This is the default setting. No additional PDF-specific security validation is performed.

Compatibility

Rejects:

  • PDFs with detected active content
  • Malformed or structurally invalid PDFs

Allows:

  • Encrypted PDFs
  • XFA forms
  • PDFs containing object streams

This profile provides additional protection while maintaining compatibility with most business documents.

Strict

Applies all Compatibility setting checks above and also rejects:

  • Encrypted PDFs
  • XFA forms
  • PDFs containing object streams

Before enabling Strict mode, you should test it with the PDFs normally used by your organization, since valid encrypted documents, XFA forms, and PDFs containing object streams will be rejected.

Uploads affected

The setting applies to PDFs uploaded through WorkflowGen forms, including:

  • New file uploads
  • Postback attachments
  • Files replacing an existing attachment with the same name

It does not affect uploads made through:

  • The WorkflowGen API
  • Remote launch
  • Administration process data uploads

About XFA forms and object streams

XFA, or XML Forms Architecture, is an Adobe technology used to create dynamic and interactive PDF forms. XFA forms can change their layout, perform calculations, validate entered data, and run form logic. Because they contain more complex structures than standard PDF forms, they can be blocked in environments that require stricter document validation.

Object streams are compressed structures used internally by some PDFs to store document objects. They are valid PDF features, but Strict mode rejects them because they can make the document’s contents more difficult to inspect.