That’s really impressive but has massive security implications.
the PDF file format supports Javascript with its own separate standard library. Modern browsers (Chromium, Firefox) implement this as part of their PDF engines.
This is something that really shouldn’t exist. I can’t imagine the legitimate uses for this outweigh the ways to abuse it.
Documents shouldn’t be allowed to run code. Ever.
Incidentally, anyone know which Firefox flag to set to disable running JS in PDFs entirely?
Incidentally, anyone know which Firefox flag to set to disable running JS in PDFs entirely?
It’s pdfjs.enableScripting in about:config. Note that Firefox is more strict with PDF scripts to begin with, and the linked Linux PDF only works in Chromium-based browsers.
While a small subset of JS’s capabilities are implemented within browsers due to security concerns; its full functionality exists in some PDF readers, notably Acrobat.
That’s really impressive but has massive security implications.
This is something that really shouldn’t exist. I can’t imagine the legitimate uses for this outweigh the ways to abuse it.
Documents shouldn’t be allowed to run code. Ever.
Incidentally, anyone know which Firefox flag to set to disable running JS in PDFs entirely?
Indeed, any time you have a Turing complete language baked into a document that’s a recipe for exploits.
It’s
pdfjs.enableScriptingin about:config. Note that Firefox is more strict with PDF scripts to begin with, and the linked Linux PDF only works in Chromium-based browsers.While a small subset of JS’s capabilities are implemented within browsers due to security concerns; its full functionality exists in some PDF readers, notably Acrobat.