6 ms·
> PDF forms now support JavaScript embedded in PDF files. Some PDF forms use JavaScript for validation and other interactive features. The amount of complexity
by drewda 5y ago
> PDF forms now support JavaScript embedded in PDF files. Some PDF forms use JavaScript for validation and other interactive features.
The amount of complexity that one can put into a PDF is both surprising and a tad frightening.
- pornel 5y agoFirefox opens PDF via pdf.js. From security perspective it's merely yet another bloated web page.
- DyslexicAtheist 5y ago> The amount of complexity that one can put into a PDF is both surprising and a tad frightening. off-topic, but fwiw: the pocorgtfo16.pdf[1] is a polyglot that is valid PDF, a ZIP archive, and a Bash script that runs a Python webserver which hosts Kaitai Struct’s WebIDE which, allows you to view the file’s own annotated bytes. [1] https://www.alchemistowl.org/pocorgtfo/pocorgtfo16.pdf https://www.alchemistowl.org/pocorgtfo/pocorgtfo16.pdf
- agumonkey 5y agoCan't find the video but there was a sec talk where the host would demonstrate a few horrendous ones.
- tonyjstark 5y agomaybe that one? https://media.ccc.de/v/36c3-10832-how_to_break_pdfs https://media.ccc.de/v/36c3-10832-how_to_break_pdfs
- mrvenkman 5y agoI instantly thought to myself .. "what could possibly go wrong?"
- r00fus 5y agoIs this using the browser's own JS engine? Do things like NoScript allow one to turn off PDF JS? On the flip side, are there any examples of PDF JS being actually useful and not a vector for tracking/exploits?
- silon42 5y agoThis desperately needs an option to disable PDF js.
- mayama 5y agoI see pdfjs.enableScripting in about:config options. Have to check whether that option disables this scripting after I get the new version.
- deleted 5y ago[deleted]
- jmclnx 5y agoYou can create a Policy File on Linux named "/etc/firefox/policies/policies.json" to disable pdf through out the system, here is a snippet for just pdf: { "policies": { "PDFjs": { "Enabled": false }, "DisableBuiltinPDFViewer": true } } See: https://support.mozilla.org/en-US/kb/managing-policies-linux-desktops https://support.mozilla.org/en-US/kb/managing-policies-linux...
- deleted 5y ago[deleted]
- akvadrako 5y agoYou can't use plugins like NoScript with PDFs on Firefox: https://bugzilla.mozilla.org/show_bug.cgi?id=1454760 https://bugzilla.mozilla.org/show_bug.cgi?id=1454760
- kingsloi 5y agointeresting, could you embed a pdf into a webpage that has some JS which triggers automatically? Even if you have noscript?
- staticassertion 5y agoI don't want to say so authoritatively, but I don't believe so.
- thepangolino 5y agoI'm still waiting to see a port of Doom in one. PDFs natively support 3D models!
- IncRnd 5y agohttps://js-dos.com/DOOM/ https://js-dos.com/DOOM/ Just add a couple of lines of js for DOOM in the browser, now in js in a pdf in a browser!
- jimbob45 5y agoDisabled by default, right? Why would you open up such a stupid security hole?
- coliveira 5y agoLet me bring some news: all websites already use javascript. Loading javascript from PDFs will be just another source of javascript vulnerabilities.
- quesera 5y agoYou're both condescending and incorrect. Bad combination! Zero websites automatically get JavaScript access from me, and many other savvy web users. If PDFs are not subject to these same controls in Firefox, then this could be a security and privacy vulnerability.
- bobthebuilders 5y agoPDF is required for JS to run due to code generation in the PDF rendering pipeline facility.
- quesera 5y agoRight, so the question becomes: "What controls are in place?" Does the JS run in a true sandbox? Inside, outside, or beside the usual browser sandbox? Are network requests allowed? Filesystem access? Are granular permissions required/available?
- coliveira 5y agoYou can just block PDFs. It is easier than blocking js in web pages.
- quesera 5y agoI don't want to block PDFs. I want to block JS in PDFs, by default, like I do in web pages. I'd also be happy to hear that the JS runtime in PDFs is run in a tight document sandbox, operates only on a highly constrained DOM-equivalent, and has zero network or filesystem access. Seems reasonable.
- DangerousPie 5y agoTrue, but I don't see how it would be any worse than running JS on any other web page. Assuming it is implemented in a safe way, that is.
- em-bee 5y agopdf documents are usually not created by web developers but by other people and then uploaded to the website. all it takes is a way to have someones computer infect a pdf with malicious js code, which, (if such an infection is possible) is way more likely to slip through than an attacker embedding malicious js into the website itself.
- ravenstine 5y agoI have an idea. Why not allow embedding a full browser engine inside of a PDF, complete with tabs and extensions? I hate having to leave Adobe Acrobat in order to read my Gmail, so I think this feature could be really useful. Anyone who builds a PDF can include their own custom browser that their users will love.
- IncRnd 5y agoJust run Emacs :)
- contravariant 5y agoWell if you can run interactive javascript then you're mostly there, PDF is pretty much Turing complete so you can just crosscompile a browser into it using javascript to take care of the interactive parts, though you might need to rewrite the rendering logic.
- IncRnd 5y agoPDFs are definitely not Turing complete. [0] [0] https://www.cs.odu.edu/~zeil/cs390/latest/Public/turing-complete/index.html#from-postscript-to-pdf https://www.cs.odu.edu/~zeil/cs390/latest/Public/turing-comp...
- jsight 5y agoI'm assuming that predates the addition of JavaScript support, though.
- contravariant 5y agoAh I see I may have been thinking of Postscript. Though I'm not entirely convinced they haven't accidentally added Turing completeness back in at some point. I mean you don't really need all that much to write a basic lisp interpreter.
- IncRnd 5y agoWell, now that you mention it..... It's likely that PDFs in Firefox are Turing Complete, since JS is Turing Complete.
- dmos62 5y agoHere goes me opening PDFs in Firefox.
- lmkg 5y agoNote that this is a new feature for Firefox's PDF reader, but not a new feature of PDFs in general. Adobe had to update reader back in like... 2008?... to prompt before loading external resources. Because companies were embedding Google Analytics into PDFs.
- bassdropvroom 5y ago> Because companies were embedding Google Analytics into PDFs. Wow! This is daft. Thank the FLOSS gods for things like Pi-Hole because I never realised this. And if I hadn't blocked Google Analytics there, this would have been a sad state of affairs.
- bassdropvroom 5y ago> Thank the FLOSS gods for things like Pi-Hole Can't edit my comment any more, but I realise this is quite dismissive of the work the real maintainers have put in. So I'll thank them instead!
- djrogers 5y agoThat's not dismissive, you just called them gods!
- tjoff 5y agoI bet the real reason for that was because it could then compete with adobes own analytics built into the reader.
- tediousdemise 5y agoTwo age-old attack vectors united in perfect harmony. Certainly nothing will go wrong here.
- subjectsigma 5y agoIt's horrible for security but it can be really useful. This guy made an entire Dungeons & Dragons character sheet generator embedded into a PDF and I probably wouldn't have ever played D&D without it: https://www.flapkan.com/ https://www.flapkan.com/ I looked at the source code briefly and it's on the order of 10K lines of Javascript.
- cyberlab 5y ago> PDF forms now support JavaScript I thought they always required JS to be enabled. I have JS disabled by default in uBlock Origin, and the inbuilt Firefox PDF viewer doesn't work unless I whitelist and enable JS temporarily for the page. Only then can I read my PDF.
- danudey 5y agoBack when I started playing D&D again, some friends stumbled across a PDF of "MPMB's character sheet" or something. Basically, it was a PDF full of scripting and options and such, that let you: * Choose which content you wanted to use (i.e. content from which sources) * Choose which rules you wanted to use (in case you wanted to use optional rules) * Choose your class, race, and background, and handle them appropriately * Level up your character, prompting you to choose spells, feats, abilities, etc. from every option available to you based on your current character options * Manage your inventory * Import and export your character data * Import and export source data It was pretty insane. Granted, it was also insanely slow (presumably due to limitations of what data you can store in a PDF and how), but for a bunch of tech-savvy newbies to 5th edition D&D, it was vastly better than the other options and helped us discover a lot of character features that we'd missed when overwhelmed at first. I still wish they'd put it into literally anything more performant, like an electron app or something. Yes, it was that bad.
- jhauris 5y agoThe same capability is on the web at D&D Beyond: https://www.dndbeyond.com/ https://www.dndbeyond.com/
- jfb 5y agoOr at roll20.
- ansible 5y agoOne thing to be aware of is that just the super-basic stuff is included in a free account. For example a 3rd level Rogue can choose a specialty subclass, and only Thief is available for free, other subclasses like Arcane Trickster you have to pay a couple bucks for.
- jhauris 5y agoGood point, but if you're in a group setting only one person needs to "purchase" access to sources to make them available to the group.
- lousken 5y agoanyone figured out how to disable this?