3 ms·
Let me bring some news: all websites already use javascript. Loading javascript from PDFs will be just another source of javascript vulnerabilities.
by coliveira 6y ago
Let me bring some news: all websites already use javascript. Loading javascript from PDFs will be just another source of javascript vulnerabilities.
- quesera 6y agoYou're both condescending and incorrect. Bad combination! Zero websites automatically get JavaScript access from me, and many other savvy web users. If PDFs are not subject to these same controls in Firefox, then this could be a security and privacy vulnerability.
- bobthebuilders 6y agoPDF is required for JS to run due to code generation in the PDF rendering pipeline facility.
- quesera 6y agoRight, so the question becomes: "What controls are in place?" Does the JS run in a true sandbox? Inside, outside, or beside the usual browser sandbox? Are network requests allowed? Filesystem access? Are granular permissions required/available?
- coliveira 6y agoYou can just block PDFs. It is easier than blocking js in web pages.
- quesera 6y agoI don't want to block PDFs. I want to block JS in PDFs, by default, like I do in web pages. I'd also be happy to hear that the JS runtime in PDFs is run in a tight document sandbox, operates only on a highly constrained DOM-equivalent, and has zero network or filesystem access. Seems reasonable.
- bscphil 6y ago> Zero websites automatically get JavaScript access from me, and many other savvy web users. Even if this weren't true, it would still be false that "all websites already use JavaScript".