[Editor] Don't forget to encrypt image streams (see issue #16821)

and encrypt a compressed stream after having been compressed.

src/core/annotation.js

@@ -298,7 +298,13 @@ class AnnotationFactory {
             baseFont.set("Encoding", Name.get("WinAnsiEncoding"));
             const buffer = [];
             baseFontRef = xref.getNewTemporaryRef();
-            await writeObject(baseFontRef, baseFont, buffer, null);
+            const transform = xref.encrypt
+              ? xref.encrypt.createCipherTransform(
+                  baseFontRef.num,
+                  baseFontRef.gen
+                )
+              : null;
+            await writeObject(baseFontRef, baseFont, buffer, transform);
             dependencies.push({ ref: baseFontRef, data: buffer.join("") });
           }
           promises.push(
@@ -325,13 +331,19 @@ class AnnotationFactory {
             const buffer = [];
             if (smaskStream) {
               const smaskRef = xref.getNewTemporaryRef();
-              await writeObject(smaskRef, smaskStream, buffer, null);
+              const transform = xref.encrypt
+                ? xref.encrypt.createCipherTransform(smaskRef.num, smaskRef.gen)
+                : null;
+              await writeObject(smaskRef, smaskStream, buffer, transform);
               dependencies.push({ ref: smaskRef, data: buffer.join("") });
               imageStream.dict.set("SMask", smaskRef);
               buffer.length = 0;
             }
             const imageRef = (image.imageRef = xref.getNewTemporaryRef());
-            await writeObject(imageRef, imageStream, buffer, null);
+            const transform = xref.encrypt
+              ? xref.encrypt.createCipherTransform(imageRef.num, imageRef.gen)
+              : null;
+            await writeObject(imageRef, imageStream, buffer, transform);
             dependencies.push({ ref: imageRef, data: buffer.join("") });
             image.imageStream = image.smaskStream = null;
           }

src/core/writer.js

@@ -46,9 +46,6 @@ async function writeDict(dict, buffer, transform) {
 
 async function writeStream(stream, buffer, transform) {
   let string = stream.getString();
-  if (transform !== null) {
-    string = transform.encryptString(string);
-  }
   const { dict } = stream;
 
   const [filter, params] = await Promise.all([
@@ -106,6 +103,10 @@ async function writeStream(stream, buffer, transform) {
     }
   }
 
+  if (transform !== null) {
+    string = transform.encryptString(string);
+  }
+
   dict.set("Length", string.length);
   await writeDict(dict, buffer, transform);
   buffer.push(" stream\n", string, "\nendstream");

test/pdfs/.gitignore

@@ -609,3 +609,4 @@
 !annotation_hidden_print.pdf
 !annotation_hidden_noview.pdf
 !widget_hidden_print.pdf
+!empty_protected.pdf

test/test_manifest.json

@@ -8088,5 +8088,36 @@
       "rounds": 1,
       "link": true,
       "type": "other"
+   },
+   {
+      "id": "protected-stamp-editor-save-print",
+      "file": "pdfs/empty_protected.pdf",
+      "md5": "3a9e0ede729dceb1052bda48db47dca1",
+      "rounds": 1,
+      "type": "eq",
+      "save": true,
+      "print": true,
+      "annotationStorage": {
+        "pdfjs_internal_editor_0": {
+          "annotationType": 13,
+          "pageIndex": 0,
+          "bitmapName": "firefox_logo.png",
+          "bitmapId": "image_c29eaeb9-8839-4a09-bf7c-75a5785805cd_0",
+          "rect": [37.5, 32.406246185302734, 496.5000057220459, 519.1875],
+          "rotation": 0
+        },
+        "pdfjs_internal_editor_1": {
+          "annotationType": 13,
+          "bitmapId": "image_c29eaeb9-8839-4a09-bf7c-75a5785805cd_0",
+          "pageIndex": 0,
+          "rect": [
+           458.06250572204584,
+           473.04686737060547,
+           571.5000057220459,
+           582.7187461853027
+          ],
+          "rotation": 0
+       }
+     }
    }
 ]