News for hackers. Stuff that matters.

A comment on Security Flaws in Adobe Acrobat Reader Allow Gaining Root on macOS Silently. Parent comment

Re:Security Flaws in Adobe Acrobat Reader Allow Gaining Root... by crazygringo on Thursday May 14, 2020 @04:22PM (#23184876)
Is that a real thing?

I've encountered JavaScript-heavy PDF's before, but which were obviously so. (Automatically calculating values for one form field based on another, generating QR codes, etc.)

I've never come across a seemingly "normal" form PDF but which secretly used JavaScript for normal things like form filling, so that normal form-filling tools didn't work. I don't understand why the normal PDF type-in-a-text-box tool wouldn't work.

Have you actually come across this? Can you point to any examples?

[ Parent | on HN ]
Re:Security Flaws in Adobe Acrobat Reader Allow Gaining Root... by dathinab on Thursday May 14, 2020 @05:46PM (#23185949)
While (like it can be seen in the EDIT) the forms I found where not affected with JS. Other forms from my uni where.

For example I found following:

`/JS (if \(this.getField\("inst1"\).value == "bitte auswählen"\){\r\nthis.getField\("Hinweis"\).display = 2\r\n} else\r\n{\r\nthis.getField\("Hinweis"\).display = 1\r\n}\r\n)$ /S /JavaScript`

This (in the given PDF) causes a "notice" overlapped on top of other form fields to disappear once the first multiple choice field was selected.

So if you try to fill it out without JS some form fields are not visible (but selectable by tab). Luckily it's not included in prints.

[ Parent | on HN ]
Re:Security Flaws in Adobe Acrobat Reader Allow Gaining Root... by hn_throwaway_99 on Thursday May 14, 2020 @05:41PM (#23185881)
Yes, as another commenter pointed out, Canadian govt citizenship forms, e.g. https://www.canada.ca/en/immigration-refugees-citizenship/se...
[ Parent | on HN ]
Re:Security Flaws in Adobe Acrobat Reader Allow Gaining Root... by dathinab on Thursday May 14, 2020 @05:09PM (#23185477)
I have run into this with regard to basic, but "slightly" more advanced features then text fields on forms in my university.

You can be sure that even Adobe won't add JS for forms with plain text fields. ;=)

EDIT: I looked into some of the PDFs again and it seems I had been wrong. Not sure what they use but it doesn't seem to be js.

Sorry about this.

[ Parent | on HN ]