Forcefully disable any Javascript

[lcl45]

Hi all!

I'm struggling with the pdfjsLib. What I'm trying to do is to forcefully disable any Javascript present inside a pdf: all the pdf I'm going to show in the application I'm working in must be some kind of read-only file, preventing any possible code execution, even if benign.
I know that this might sound strange because "this could break the pdf" or something like that, but this was requested.

In the application, we are using the default viewer found in web/viewer.html, calling it using an url similar to web/viewer.html?file=my.pdf. I've found that there is the enableScripting variable which might help with my issue, however I've found it here https://github.com/mozilla/pdf.js/wiki/Viewer-options that it is not a valid parameter.

In the main script of the application, I've added

document.addEventListener('DOMContentLoaded', function () {
    if (window.PDFViewerApplicationOptions) {
          PDFViewerApplicationOptions.set("disablePreferences", true);
          PDFViewerApplicationOptions.set("enableScripting", false);
          PDFViewerApplicationOptions.set("isEvalSupported", false);
          PDFViewerApplication.run();
    }
});

This doesn't seem to trigger the warning that should pop out (like discussed here #16158).
How can I achive my goal?

Many thanks!!

[bubakcz]

Hello.
I have a similar issue.
In our code base and repo, we have currently available version 4.4.168 of this library. With unchanged viewer js and slightly modified viewer html, even with same attributes as OP, test pdf is still running included javascript (<script>app.alert(1);</script>). Are there any changes required to default viewer script, or could be just some issue with that version and we should use a newer one?

[bubakcz]

Tried it also with recent version of library, and javascript is still being executed. This happens both with PDF displayed via "file" parameter, and PDFViewerApplication.open method for Uint8Array approach.
Any ideas?

[calixteman]

You should set the options you want enable/disable before the setting the different components, please read:

pdf.js/web/viewer.js

Lines 299 to 323 in 9138473

	if (typeof PDFJSDev !== "undefined" && PDFJSDev.test("GENERIC")) {
	// Give custom implementations of the default viewer a simpler way to
	// set various `AppOptions`, by dispatching an event once all viewer
	// files are loaded but *before* the viewer initialization has run.
	const event = new CustomEvent("webviewerloaded", {
	bubbles: true,
	cancelable: true,
	detail: {
	source: window,
	},
	});
	try {
	// Attempt to dispatch the event at the embedding `document`,
	// in order to support cases where the viewer is embedded in
	// a *dynamically* created <iframe> element.
	parent.document.dispatchEvent(event);
	} catch (ex) {
	// The viewer could be in e.g. a cross-origin <iframe> element,
	// fallback to dispatching the event at the current `document`.
	console.error("webviewerloaded:", ex);
	document.dispatchEvent(event);
	}
	}
	PDFViewerApplication.run(config);
	}