Uploaded image for project: 'Nuxeo Web UI'
  1. Nuxeo Web UI
  2. WEBUI-1587

Prevent PDF preview to run malicious javascript

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Open
    • Priority: Minor
    • Resolution: Unresolved
    • Affects Version/s: 3.0.0, 3.1.0
    • Fix Version/s: 3.0.x, 3.1.x
    • Component/s: Web UI

      Description

      Steps to reproduce :

      1. create a File document with the attached PDF : payload1.pdf
      2. observe that a javascript popup is displayed: it corresponds to an example of malicious script included in the PDF which is displayed by the previewer (pdf.js)

      Expected behavior: the malicious script included in a PDF are not executed during the preview

        Attachments

        1. payload1.pdf
          13 kB
          Thierry Martins

          Issue Links

          is related to

          Epic - Created by Jira Software - do not edit or delete. Issue type for a big user story that needs to be broken down. WEBUI-1532 [PDF.js] Analyze and fix CVE-2024-4367 with PDF.js

          • Major - Major loss of function.
          • Open

            Activity

              People

              • Votes:
                0 Vote for this issue
                Watchers:
                2 Start watching this issue

                Dates

                • Created:
                  Updated: