5 ms·
Should documents be Turing complete?
by meaty 14y ago
Should documents be Turing complete?
- Cthulhu_ 14y agoThey don't need to be in order to have weaknesses; just look at all the security problems coming from Adobe's PDF reader, which afaik can't execute code, but where the input (PDF documents), if cleverly crafted, can create buffer overflows allowing for arbitrary code execution.
- meaty 14y agoPDF files are code. They are a variant of postscript which is a Turing complete language. People have written web servers in postscript I understand. The issue you state is a property of three things: 1. The underlying language/vm allows code and data to be interchanged (c++). 2. The underlying vm allows memory to be overwritten and buffer lengths to be exceeded to start with. 3. Pdf allows arbitrary code to execute on your computer. My point demonstrated.
- ygra 14y agoPDF is a very small subset of PostScript as a programming language, centered around objects that are usually in a compressed stream. Pages, text, images, drawings, etc. are all objects and appropriately linked¹. The language itself cannot really do more than creating objects and dictionaries; no programming is left. Embedded JavaScript is another matter, but it's not needed to be executed for parsing the document. _____________ ¹ This gives rise to interesting applications, e.g. you can remove pages or images by just removing a link in the PDF. Yet the object would then still be there. There are some PDFs out there where sensitive information is buried in unlinked objects that still exist within the file. But that's obviously besides the point.
- pcwalton 14y agoPDF files actually can execute code [1]. In fact, there are not one but two JavaScript engines inside Adobe Reader! [1]: http://stackoverflow.com/questions/9219807/using-javascript-inside-a-pdf http://stackoverflow.com/questions/9219807/using-javascript-...
- Jacobi 14y agoThe PDF document format is incredibly complex. It can incorporate JavaScript actions !
- ygra 14y agoThey are not needed to parse the file. PDFs can also contain Flash content or movies or 3D models or any number of other objects. It's just a blob in the file, same as OLE. Few applications beyond Adobe Reader care about implementing those parts, though.
- lmm 14y agoNo, but even if we switched tomorrow, there are millions of legacy documents in Turing-complete formats that users want to access.
- sukuriant 14y agopostscript is turing complete: http://www.tjhsst.edu/~edanaher/pslife/ http://www.tjhsst.edu/~edanaher/pslife/