setjSignPdfJarPath() is inconsistently treated as both directory and jar file, causing open_basedir warning and failure in debug mode

[vkywalker]

Thanks for maintaining this library and for the work you’ve put into it. It’s been very useful for us, and I appreciate you taking the time to review this issue.

Description

The PDF signing process fails when application debug mode is enabled due to a PHP warning raised inside the JSignPDF PHP wrapper.

Warning: file_exists(): open_basedir restriction in effect.
File(/var/www/vhosts/somedomain.com/jsignpdf/JSignPdf.jar/.jsignpdf_version_jsignpdf-2.3.0.zip)
is not within the allowed path(s): (/var/www/vhosts/somedomain.com/:/tmp/)

This warning causes the signing process to fail when PHP is in a strict mode.

According to the README, the following configuration is documented:
$param->setjSignPdfJarPath('/path/to/jsignpdf');
This suggests that a directory should be provided.

But, in practice:

Passing a directory (e.g. /var/www/vhosts/somedomain.com/jsignpdf) results in:
Error: Invalid or corrupt jarfile /var/www/vhosts/somedomain.com/jsignpdf

This indicates that the value passed to setjSignPdfJarPath() must point to the JAR file itself.

Passing the JAR file path works correctly but only when debug mode is disabled.

$param->setjSignPdfJarPath('/var/www/vhosts/somedomain.com/jsignpdf/JSignPdf.jar');

While investigating, I found that in
src/Runtime/JSignPdfRuntimeService.php, method validateVersion(), the value returned by getJSignPdfPath() is treated as a directory:
$versionCacheFile = $jsignPdfPath . '/.jsignpdf_version_' . basename($params->getJSignPdfDownloadUrl());
When $jsignPdfPath is a JAR file path, this produces an invalid filesystem path such as:

/path/to/JSignPdf.jar/.jsignpdf_version_...

PHP triggers a file_exists() warning, which breaks execution when strict error handling is enabled.

Working fix

Proof fix, which works for me
Changing the above line to use the parent directory resolves the issue completely:
$versionCacheFile = \dirname($jsignPdfPath) . '/.jsignpdf_version_' . basename($params->getJSignPdfDownloadUrl());

Please clarify or enforce whether setjSignPdfJarPath() expects a directory or a JAR file, and handle runtime/cache paths accordingly.

[jeidison]

Thanks a lot for the detailed investigation and for taking the time to propose a fix.

At the moment, I’m no longer actively working on.

That said, I’m currently working on a new approach: a native PDF signing library written in PHP, without relying on Java wrappers. The project is available here: signer-php

If you’re interested, you’re very welcome to test it. The library is still under development, so there may be bugs, missing features, or breaking changes. Contributions, feedback, and issue reports are more than welcome.

Thanks again for your contribution and for sharing your findings — I hope the new library can be useful for your use case going forward.

[vitormattos]

@vkywalker I will look this, if you wish to send a PR with the fix, will be nice.

I'll update this package as a soon to have support to JSignPdf 3.x

[vitormattos]

I use this package at https://github.com/LibreSign/libresign/ project. If you want to talk more about LibreSign and JSignPDF, we have a community group at Telegram, don't worry about Portuguese, you can talk in English too at our community:

https://t.me/LibreSign