gercoop.blogg.se

Of course, this is not a serious risk analysis of Foxit Reader. You can make this patch permanently by editing the Foxit Reader executable with an hex editor, or do it temporarily by patching in memory with my bpmtk utility. Actually, this patch will not disable the JavaScript interpreter for Foxit Reader, but it will prevent Foxit Reader from recognizing the /JavaScript name in a PDF document, effectively making it to ignore JavaScript instructions (names are case-sensitive).

Search for the ASCII string JavaScript (preceded and terminated by byte 00) in the Foxit Reader executable (you should find only one occurrence), and replace it with javascript, for example. If you absolutely want to disable JavaScript in Foxit Reader 2.3, there’s a quick and dirty trick. Many Foxit Reader users have requested this feature. But since version 2.2, JavaScript is embedded in the main executable and there is no configuration switch to disable it. Omitting the plugin was a simple way to disable JavaScript. Until recently, Foxit Reader required a JavaScript plugin for JavaScript support. I submitted these files to Foxit Software.Īdobe Acrobat Reader allows you to disable JavaScript. It was also trivial to assemble some simple malformed PDF files that cause problems for Foxit Reader, but not for Adobe Reader. But in a corporate environment, you can also set the appropriate registry keys to block all these actions by default.

Of course, these warnings will only help a user that is aware of the potential risks. Adobe Acrobat Reader will warn you for spoofing attacks and ask for your permission to switch to full screen, while Foxit Reader does this immediately. I submitted a feature request to Foxit Software for this.Īnother example is a JavaScript inside a PDF file that switches the reader to full screen mode.

While playing with the PDF file format, I created several PDF files that uncovered potential security issues with Foxit Reader.Ī PDF file with an OpenAction triggering an URI action causes Adobe Acrobat to prompt the user for approval, before accessing the URI:īut Foxit Reader opens Internet Explorer and visits the site without confirmation prompt. Foxit Reader has been my default PDF reader for more than a year now, as an alternative to the Adobe Acrobat Reader that stalled too often when starting up.