161–170 of 238 posts
Earlier quoted context omitted.
Wait, did Acrobat actually end support for Linux? Od you just didn't want that particular machine to catch... capitalism?
There is no recent version of Acrobat Reader for Linux, and old (was it 5.x beta?) versions rarely work on modern distros.
This Tetris game makes it crash though.
Not just web browsers, Acrobat (and probably other PDF readers) have supported executing Javascript in PDFs for decades.
I was joking in 2007, when I was working at Siemens, to my boss, that an Excel cell can contain God and the Multiverse when I put an ActiveX inside that was basically a program I made which would draw a 3D animation based on parameters contained on other cells. Let's say the boss was impressed though for me was just basic OLE. I see from time to time that younger generations reinvent/rediscover the wheel and I chuckl…
This is horrifying, PDFs should not be able to execute code.
Postscript is code (it's a stack machine), and PDFs are Postscript
This is horrifying, PDFs should not be able to execute code.
In Microsoft Windows (~2000/ME), you used to be able embed JavaScript and ActiveX into ANY folder by replacing the folder view with your own HTML. Your customization would persist on shared network folders so others would see your HTML.
So naturally, a bunch of us 14 year olds in like 2002, between playing Runescape and Neopets in computer lab and library time, found this out and started screwing with the shared network Z: drive used by both teachers and students across every elementary, middle and high school in the school district.
There were dumb things you could do with all that power like open people’s CD-ROM reader trays by abusing the Windows Media ActiveX control. It had an eject() method on the object.
It ended up breaking in an edit war of the shared drive. There were some generic AD accounts used district-wide so you could avoid getting caught. We found out you could prefix the username with the domain and login with accounts from other schools. At one point, someone crossed the line, but I don’t think anyone got caught.
Earlier quoted context omitted.
The "code execution" in PDF parsing is what enabled this legendary zero-click, zero-day exploit of iOS devices: https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i...
That exploit is indeed legendary but the code execution involved is not JavaScript. In fact the iOS PDF renderer does not have JavaScript enabled.
didn't work in safari's embedded reader. no text either, just a blank page. or did i not wait long enough?
You glorious bastard, what a cool project! This is already a contender for most hacker project of the year :-) (below is not serious) I would advise people against using this in production though because it's still missing some critical features. For example: 1. The Javascript stops working when printed to physical paper. The resulting paper just has a static image and the controls no longer work. 2. It doesn't work…