Portable Document Format (PDF)
PDF is the standard for invoices, reports, contracts, and printable documents. Object/stream structure, encryption, and embedded content matter for parsing, redaction, and security review.
What It Defines
Page-oriented document format: header (`%PDF-x.y`), body of numbered indirect objects, cross-reference table or stream, and trailer with `/Root` catalog. Supports fonts, images, forms, JavaScript (legacy), encryption, and digital signatures. MIME type: `application/pdf`.
Canonical (Normative)
Convenient (Practical)
Related References
Joint ISO/IEC technical committee (JTC 1) publishes many of the binary file formats the web depends on: JPEG, PDF, MP4/ISOBMFF, ZIP (ISO/IEC 21320), and office document containers. Specs are often available via national body mirrors; some are freely readable online.
Related Specs
Every upload, download, attachment, and asset pipeline crosses these layers. Misunderstanding header vs envelope causes MIME spoofing bugs, parser differentials, and broken file validation. Start here before diving into individual format specs.
Extension spoofing (`virus.exe` → `photo.jpg`) and MIME spoofing are common attack vectors. Magic-byte detection is the first line of defense in upload validation, antivirus, and content sniffing.
Correct Content-Type headers drive content negotiation, browser rendering, and API behavior. Wrong types cause security and parsing bugs.
ZIP is everywhere — downloads, backups, Java JARs, Office Open XML. Central-directory-at-end structure, path traversal (`../../`), and zip bombs are critical security concerns.