71–80 of 116 posts
Using JS for this feels like cheating... I wonder if similar things would be possible with PostScript?
I would really appreciate if someone could put a decent PDF reader, like Sumatra, into a PDF so I could have a portable and good PDF reader on locked down computers.
PDF, the true universal app platform. Please don't tell Microsoft.
Finally, I can `rm -rf /` in a PDF.
Using JS for this feels like cheating... I wonder if similar things would be possible with PostScript?
It's possible, but not in a PDF. PDFs support only a turing incomplete subset of PostScript, because PDF's designers thought that having a turing complete language in your document format would have performance implications. (Later, they changed their mind and added JavaScript support.)
I would really appreciate if someone could put a decent PDF reader, like Sumatra, into a PDF so I could have a portable and good PDF reader on locked down computers.
1. Linux Running in a PDF (doompdf.dev) 114 points by theden 4 hours ago | flag | hide | 37 comments 2. Ingesting PDFs and why Gemini 2.0 changes everything (sergey.fyi) 978 points by serjester 17 hours ago | flag | hide | 323 comments As people start bolting various kinds of PDF parsers and evaluators to LLMs, there's got to be some interesting hack potential.
Does anyone know if running PDFs through the following filter (as in [0]) prevent malicious actors? gs \ -dNOPAUSE \ -sDEVICE=pdfwrite \ -sOUTPUTFILE=clean.pdf \ -dBATCH \ dirty.pdf [0]: https://tex.stackexchange.com/a/481609/29430
It can make things worse: Ghostscript is not particularly safe to run on untrusted/potentially malicious input. It has a giant attack surface and no proper mitigations, unlike the PDF reader in your browser. At a minimum, you'd have to sandbox it using something like gVisor.
How would you structure your workflow to protect from potentially malicious PDFs?
I had originally thought of setting up an inotifywait watcher that would look for downloaded PDFs to swap downloaded files (while leaving a *_with-risky-active-contents.pdf copy).
After thinking for a bit about your comment, I thought about creating a .desktop file that first cleans the PDF via `docker run --runtime=runsc -it ubuntu gs ...` that then proceeds to launch the viewer, and is associated as the main reader of PDF documents...
But now I am wondering if this should be integrated into clamav and other antivirus clients (and unblocking on a case-by-case basis).