{"action":"created","issue":{"url":"https://api.github.com/repos/dompdf/dompdf/issues/952","labels_url":"https://api.github.com/repos/dompdf/dompdf/issues/952/labels{/name}","comments_url":"https://api.github.com/repos/dompdf/dompdf/issues/952/comments","events_url":"https://api.github.com/repos/dompdf/dompdf/issues/952/events","html_url":"https://github.com/dompdf/dompdf/issues/952","id":82436515,"number":952,"title":"How can we avoid inadvertent virus flagging?","user":{"login":"bsweeney","id":485897,"avatar_url":"https://avatars.githubusercontent.com/u/485897?v=3","gravatar_id":"","url":"https://api.github.com/users/bsweeney","html_url":"https://github.com/bsweeney","followers_url":"https://api.github.com/users/bsweeney/followers","following_url":"https://api.github.com/users/bsweeney/following{/other_user}","gists_url":"https://api.github.com/users/bsweeney/gists{/gist_id}","starred_url":"https://api.github.com/users/bsweeney/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bsweeney/subscriptions","organizations_url":"https://api.github.com/users/bsweeney/orgs","repos_url":"https://api.github.com/users/bsweeney/repos","events_url":"https://api.github.com/users/bsweeney/events{/privacy}","received_events_url":"https://api.github.com/users/bsweeney/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/dompdf/dompdf/labels/Priority-High","name":"Priority-High","color":"FFFFFF"},{"url":"https://api.github.com/repos/dompdf/dompdf/labels/question","name":"question","color":"cc317c"}],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/dompdf/dompdf/milestones/3","html_url":"https://github.com/dompdf/dompdf/milestones/0.7.0","labels_url":"https://api.github.com/repos/dompdf/dompdf/milestones/3/labels","id":592841,"number":3,"title":"0.7.0","description":"","creator":{"login":"gabrielbull","id":671923,"avatar_url":"https://avatars.githubusercontent.com/u/671923?v=3","gravatar_id":"","url":"https://api.github.com/users/gabrielbull","html_url":"https://github.com/gabrielbull","followers_url":"https://api.github.com/users/gabrielbull/followers","following_url":"https://api.github.com/users/gabrielbull/following{/other_user}","gists_url":"https://api.github.com/users/gabrielbull/gists{/gist_id}","starred_url":"https://api.github.com/users/gabrielbull/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gabrielbull/subscriptions","organizations_url":"https://api.github.com/users/gabrielbull/orgs","repos_url":"https://api.github.com/users/gabrielbull/repos","events_url":"https://api.github.com/users/gabrielbull/events{/privacy}","received_events_url":"https://api.github.com/users/gabrielbull/received_events","type":"User","site_admin":false},"open_issues":4,"closed_issues":0,"state":"open","created_at":"2014-03-10T16:29:16Z","updated_at":"2015-05-29T13:55:47Z","due_on":null,"closed_at":null},"comments":2,"created_at":"2015-05-29T13:51:26Z","updated_at":"2015-05-31T11:51:44Z","closed_at":null,"body":"As [noted in the support forum](https://groups.google.com/d/topic/dompdf/7Agj_6uyxYI/discussion) and reported in PR #951 we have an anti-virus issue. Looks like some miscreants are using dompdf to generate PDF for use in phishing campaigns. Because the start of all PDFs produced by dompdf are going to be similar the signature used to catch these types of things is naturally going to gravitate to the less nefarious aspects of a PDF document (e.g. PDF spec used, creator, start-of-file hash). As I said in the support forum this could be potentially devastating to the project.\r\n\r\nSo the question: how do we prevent this?\r\n\r\nSome thoughts:\r\n - vary the \"creator\" field to avoid inadvertent anti-virus flagging\r\n - add additional fields identifying the origin server\r\n - randomize the order of object creation or object numbering (does it have to be sequential?)\r\n"},"comment":{"url":"https://api.github.com/repos/dompdf/dompdf/issues/comments/107161489","html_url":"https://github.com/dompdf/dompdf/issues/952#issuecomment-107161489","issue_url":"https://api.github.com/repos/dompdf/dompdf/issues/952","id":107161489,"user":{"login":"wakeless","id":224373,"avatar_url":"https://avatars.githubusercontent.com/u/224373?v=3","gravatar_id":"","url":"https://api.github.com/users/wakeless","html_url":"https://github.com/wakeless","followers_url":"https://api.github.com/users/wakeless/followers","following_url":"https://api.github.com/users/wakeless/following{/other_user}","gists_url":"https://api.github.com/users/wakeless/gists{/gist_id}","starred_url":"https://api.github.com/users/wakeless/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wakeless/subscriptions","organizations_url":"https://api.github.com/users/wakeless/orgs","repos_url":"https://api.github.com/users/wakeless/repos","events_url":"https://api.github.com/users/wakeless/events{/privacy}","received_events_url":"https://api.github.com/users/wakeless/received_events","type":"User","site_admin":false},"created_at":"2015-05-31T11:51:44Z","updated_at":"2015-05-31T11:51:44Z","body":"Changing the creator field was the first thing I did and as far as I can tell it is irrelevant, certainly didn't fix the actual issue I was having. \r\n\r\nAs far as I can tell the pdf is backwards compatible so just changing the version shouldnt break anything. It also resolved the issue I had, mainly with Sophos."}}