3 ms·
I find it extremely convenient. Also I know a lot of security issues in PDF viewers are effectively solved by running it in the browser's JS sandbox.
by snovv_crash 6y ago
I find it extremely convenient. Also I know a lot of security issues in PDF viewers are effectively solved by running it in the browser's JS sandbox.
- Mediterraneo10 6y agoYou could also disable Firefox's built-in PDF viewer and instead use an external PDF viewer that doesn't even support Javascript.
- detaro 6y agoYou misunderstand the argument the parent comment makes. It's not about Javscript in PDFs.
- nitrogen 6y agoNot all PDF vulnerabilities involve JS though.
- snovv_crash 6y agoNative PDF clients have had lots of security holes. In this case having the client written in JS means we can repurpose the battle hardened JS sandbox to also contain PDF exploits.
- zelly 6y agoFirefox's sandboxing incomplete or nonexistent (e.g. GPU process is not sandboxed on Linux).