- cross-posted to:
- riscv
- hackernews@lemmy.bestiver.se
- cross-posted to:
- riscv
- hackernews@lemmy.bestiver.se
You must log in or register to comment.
Portable Distribution Format
That’s really impressive but has massive security implications.
the PDF file format supports Javascript with its own separate standard library. Modern browsers (Chromium, Firefox) implement this as part of their PDF engines.
This is something that really shouldn’t exist. I can’t imagine the legitimate uses for this outweigh the ways to abuse it.
Documents shouldn’t be allowed to run code. Ever.
Incidentally, anyone know which Firefox flag to set to disable running JS in PDFs entirely?
While a small subset of JS’s capabilities are implemented within browsers due to security concerns; its full functionality exists in some PDF readers, notably Acrobat.
Indeed, any time you have a Turing complete language baked into a document that’s a recipe for exploits.
Incidentally, anyone know which Firefox flag to set to disable running JS in PDFs entirely?
It’s
pdfjs.enableScriptingin about:config. Note that Firefox is more strict with PDF scripts to begin with, and the linked Linux PDF only works in Chromium-based browsers.
But will it run Doom?
What we really need is to get it to run a pdf engine and then run doompdf inside it https://github.com/ading2210/doompdf
