[Bug]: Error Code 141 When Signing PDF - `/api/app/functions/signPdf`

[AndrewPaglusch]

Issue Description

On the receiving side of a signature request, when singing a PDF with a single "signature" field, I get the following error modal displayed when attempting to finish a document:

Error
something went wrong.

The raw request (curl) - taken from my browser dev tools:

curl 'https://sign.redacted.com/api/app/functions/signPdf' \
  -X POST \
  -H 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:144.0) Gecko/20100101 Firefox/144.0' \
  -H 'Accept: */*' \
  -H 'Accept-Language: en-US,en;q=0.5' \
  -H 'Accept-Encoding: gzip, deflate, br, zstd' \
  -H 'Referer: https://sign.redacted.com/load/recipientSignPdf/DGD6FZpkDG/zqbbUxdz56' \
  -H 'Content-Type: text/plain' \
  -H 'Origin: https://sign.redacted.com' \
  -H 'DNT: 1' \
  -H 'Connection: keep-alive' \
  -H 'Sec-Fetch-Dest: empty' \
  -H 'Sec-Fetch-Mode: cors' \
  -H 'Sec-Fetch-Site: same-origin' \
  -H 'Pragma: no-cache' \
  -H 'Cache-Control: no-cache' \
  -H 'TE: trailers' \
  --data-raw '{"pdfFile":"BASE64REMOVED","_ApplicationId":"opensign","_ClientVersion":"js6.1.1","_InstallationId":"85efc72a-daad-4cf4-80b6-b11b11b07441"}'

Result of that call:

{
  "code": 141,
  "error": "The first argument must be of type string or an instance of Buffer, ArrayBuffer, or Array or an Array-like Object. Received undefined"
}

Server logs:

Err in signpdf TypeError [ERR_INVALID_ARG_TYPE]: The first argument must be of type string or an instance of Buffer, ArrayBuffer, or Array or an Array-like Object. Received undefined
    at Function.from (node:buffer:325:9)
    at PDF (file:///usr/src/app/cloud/parsefunction/pdf/PDF.js:399:32)
    at process.processTicksAndRejections (node:internal/process/task_queues:105:5) {
  code: 'ERR_INVALID_ARG_TYPE'
}

Expected Behavior

The signature will be submitted

Current Behavior

The submission of the signed document fails with a generic error shown to the user

Steps to reproduce

1. Deploy the staging tag of the docker image.
2. Create a PDF document and add a single signature field
3. Sent to recipient
4. Open email in recipient inbox and click link
5. Fill out signature
6. Attempt to submit the document by clicking "Finish"
7. FAIL

NOTE: I am running the staging tag to work around the SMPT bug reported here #1324. I received the same failure while running on the main tag as well

Screenshots of the issue(optional)

Operating System [e.g. MacOS Sonoma 14.1, Windows 11]

AlmaLinux 9.6, running in Docker

What browsers are you seeing the problem on?

Firefox and Chromium

What version of OpenSign™ are you seeing this issue on? [e.g. 1.0.6]

staging - sha256:041ce83720081ca47d0600bb9eb7c387e11d28d8ffb2c8f2e997926459a8fcf9

What environment are you seeing the problem on?

Hosted (app.yourdomain.com)

Please check the boxes that apply to this issue report.

• I have searched the existing issues & discussions to make sure that this is not a duplicate.

Code of Conduct

• I agree to follow this project's Code of Conduct
• I have searched the existing issues & discussions to make sure that this is not a duplicate.

[igcompdocgmail]

Hey, not sure if you were able to resolve this, but I ran into the same issue and was able to get everything working.

Make sure you define the PFX_BASE64 and PASS_PHRASE environment variables. The passphrase is the one you set when exporting your private key + certificate into the .pfx file.

Once the document is ready to be signed, the application loads the base64-encoded PFX from the environment variable. This PFX contains both your private key and public certificate. The passphrase is used to decrypt the PFX and access those values.

The app then hashes the unsigned portion of the PDF (the PDF content excluding the signature field) and signs that hash with the private key. The resulting signature, along with the public certificate, is embedded into the PDF.

This allows any recipient’s PDF viewer to verify who signed the document and also detect whether the PDF was modified after signing, since the signature will only validate if the content matches the original hash.

Additionally, I had to adjust some headers for the parse-s3-adapter - keep in mind I am doing external cloud storage - but in a slightly more secure fashion that the provided documentation recommends.
`export async function parseUploadFile(fileName, fileData, mimeType) {
try {
const payload = {
base64: fileData.toString('base64'),
fileData: { metadata: {}, tags: {} },
_ApplicationId: serverAppId,
_ContentType: mimeType,
_InstallationId: "<your_id>"
};

const res = await axios.post(`${cloudServerUrl}/files/${fileName}`, payload, {
  headers: {
    'Content-Type': 'text/plain',
    'X-Parse-Master-Key': process.env.MASTER_KEY,
  },
});

return res.data;

} catch (err) {
const errorMessage = err?.message || 'Unknown error';
console.log('Err in parseUploadFile', errorMessage);
throw { message: errorMessage, code: 400 };
}
}`

I think that maybe pass phrase and pfx can be pulled from mongo.

You will want to check out:
OpenSign/apps/OpenSignServer/utils/fileUtils.js
OpenSign/apps/OpenSignServer/cloud/parsefunction/pdf/PDF.js
OpenSign/apps/OpenSignServer/index.js

Thanks,
-Ian G
AI Engineer - Velatura Public Benefit Corporation