Obfuscated Content Issue for Aspose.Words.Pdf2Word.dll on Security Scans

Aspose.Words Product Family
1

One of our customers conducts security scans on our distributed product as part of their due diligence process. The following feedback was received:

By “obfuscated content,” we are specifically referencing ESRP (Extended Security Release Process) code-signing and security validation findings identified during the our internal Scan and Sign / ESRP analysis. Our internal ESRP tools flagged Aspose.Words.Pdf2Word.dll for containing obfuscated or protected IL, which inhibits standard binary inspection and static analysis required for ESRP compliance.

Is there an official statement available describing the obfuscation mechanism used, the rationale behind its implementation, and any relevant security review that could support a request for an ESRP exception?

2

@arascoleman It looks like an old version of Aspose.Words is used in your project. We do not ship Aspose.Words.Pdf2Word as a separate dll quite a long time. All code of Aspose.Words.Pdf2Word now is fully included into the main Aspose.Words dll. You can find Aspose.Words compliance reports here:
https://releases.aspose.com/words/net/compliance-reports/

As far as I remember ConfuserEx obfuscator was used to protect Aspose.Words.Pdf2Word.