31–40 of 209 posts
Earlier quoted context omitted.
Is this using the browser's own JS engine? Do things like NoScript allow one to turn off PDF JS? On the flip side, are there any examples of PDF JS being actually useful and not a vector for tracking/exploits?
This desperately needs an option to disable PDF js.
> PDF forms now support JavaScript embedded in PDF files. Some PDF forms use JavaScript for validation and other interactive features. The amount of complexity that one can put into a PDF is both surprising and a tad frightening.
Adobe had to update reader back in like... 2008?... to prompt before loading external resources. Because companies were embedding Google Analytics into PDFs.
Earlier quoted context omitted.
Is this using the browser's own JS engine? Do things like NoScript allow one to turn off PDF JS? On the flip side, are there any examples of PDF JS being actually useful and not a vector for tracking/exploits?
This desperately needs an option to disable PDF js.
Macbook Air M1
>The ‘Take a Screenshot’ feature was removed from the Page Actions menu in the url bar. Odd, this is the only place I accessed it from. Not a big deal as it's still on the context menu and also can be added as a tool bar item but I am curious the rationalization behind this change. That seemed like a great place to have it to me.
Earlier quoted context omitted.
Well if you can run interactive javascript then you're mostly there, PDF is pretty much Turing complete so you can just crosscompile a browser into it using javascript to take care of the interactive parts, though you might need to rewrite the rendering logic.
PDFs are definitely not Turing complete. [0] [0] https://www.cs.odu.edu/~zeil/cs390/latest/Public/turing-comp...
Though I'm not entirely convinced they haven't accidentally added Turing completeness back in at some point.
I mean you don't really need all that much to write a basic lisp interpreter.
> PDF forms now support JavaScript embedded in PDF files. Some PDF forms use JavaScript for validation and other interactive features. The amount of complexity that one can put into a PDF is both surprising and a tad frightening.
Is this using the browser's own JS engine? Do things like NoScript allow one to turn off PDF JS? On the flip side, are there any examples of PDF JS being actually useful and not a vector for tracking/exploits?
I can see why they are doing it but I'll really miss FTP support. A lot of public data continuous to be distributed through FTPs and for a long time Firefox has been the easiest way to browse them.
Edit: this might be a small opportunity for some of the native FTP apps to jump in and handle the links. Click an FTP link in the browser and launch my FTP client with the details passed through.
> PDF forms now support JavaScript embedded in PDF files. Some PDF forms use JavaScript for validation and other interactive features. The amount of complexity that one can put into a PDF is both surprising and a tad frightening.
Is this using the browser's own JS engine? Do things like NoScript allow one to turn off PDF JS? On the flip side, are there any examples of PDF JS being actually useful and not a vector for tracking/exploits?
This issue makes it seem that Components.utils.Sandbox is used when included in firefox, which would be the browser's own JS engine (but confined to a sandbox), and quickjs in other settings (say a website). https://github.com/mozilla/pdf.js/issues/12487
But I can't find Components.utils.Sandbox being referenced in the code on github. So maybe they decided to use quickjs for all use cases? The issue with quickjs is that it's written in C which is an unsafe language. wasm has bad binary security [0] so exploits are easier to create given some memory safety violation. The environment that calls the wasm is extremely privileged compared to random websites, so if a wasm exploit could convince the environment to do something, it would be major trouble.
[0]: https://www.usenix.org/conference/usenixsecurity20/presentat...