4 ms·
I don't believe it's a risk, since you're not injecting arbitrary remote code into a document, you're more overlaying on top of it. Even if the reader wants to
by drannex 3y ago
I don't believe it's a risk, since you're not injecting arbitrary remote code into a document, you're more overlaying on top of it. Even if the reader wants to execute code, then it will, that's how you have a reader to begin with. As long as it's not the PDF itself (source document) deciding to execute inline code, you should be fine.
- wolverine876 3y agoWhat does it matter if it's displayed in the document or in an overlay window or if it's saved in the document or not? That code could try to do anything; many PDF readers have a security option to prevent opening any remote documents or links.
- joveian 3y agoWhy do you think there is remote code execution? Without being familiar with that code (or evince code, which does the same thing) I can almost guarantee there is no such thing (what even would they be executing and why?).
- wolverine876 3y agoHow is the remote reference rendered, other than by executing a renderer for that format in a window? Renderers for web pages, for example, are very powerful platforms with a long history of security issues.
- esquivalience 3y agoThe reference being discussed seems to be another part of the same pdf.
- hju22_-3 3y agoI think you've misunderstood the feature. It shows an overlay window of another part of the same PDF you're already in. It doesn't open another PDF or a website or anything, it's just a small preview of another page essentially. You could just as easily scroll to where the reference is placed in the PDF, but this lets you quickly preview the section without actually leaving your position in the document.
- wolverine876 3y agoI did misunderstand; you are correct. Thanks for explaining it. And that is indeed very useful!