ThomasRinsma
Re:Show HN: Doom (1993) in a PDF
on Monday January 13, 2025 @01:57AM (#42680801)
Author of "PDF Tetris" here.
Great work! We had the same idea at the same time, here's my version of PDF Doom:
Source: https://github.com/thomasRinsma/pdfdoom
Playable here: https://th0mas.nl/downloads/doom.pdf
Yours is neater in many ways though!
Re:Show HN: A playable game of Tetris inside a PDF
on Thursday January 09, 2025 @01:35PM (#42648535)
Oops, yeah :)
Re:Show HN: A playable game of Tetris inside a PDF
on Thursday January 09, 2025 @11:31AM (#42647251)
I barely looked at Adobe Reader so not sure about that one, it definitely does not work with this PDF though, likely because it's not compliant in several ways. Besides that I wouldn't be surprised if it supports all the required JS APIs and more, just possibly behind some permission prompts.
It might work in Foxit as I believe it supports some scripting. Most of the other native PDF renderers are more static, as far as I know. In either case, I was most interested in the browser-native engines, as I always thought of them as more "static"/limited.
As for documentation on specific features: to be honest, I just looked at the implementations of PDF.js and PDFium. Both only support a subset of the "standard" API, likely for security reasons. But PDF.js for example allows changing a field's background color (colored pixels!), and PDFium allows modifying their position/bounding box (I tried a high res color display by moving a row vertically as if it's a scanline, but things become quite laggy).
Show HN: A playable game of Tetris inside a PDF
https://th0mas.nl/downloads/pdftris.pdf
I realized that the PDF engines of modern desktop browsers (PDFium and PDF.js) support JavaScript with enough I/O primitives to make a basic game like Tetris.It was a bit tricky to find a union of features that work in both engines, but in the end it turns out that showing/hiding annotation "fields" works well to make monochrome pixels, and keyboard input can be achieved by typing in a text...
CVE-2024-29510 – Exploiting Ghostscript using format strings
Re:CVE-2024-4367 – Arbitrary JavaScript execution in PDF.js
on Monday May 20, 2024 @11:53AM (#40416846)
Original author here. This is indeed a bit confusing.
You are right for the case where Firefox's PDF.js is used (local or remote file in a tab or iframe). The XSS problem however is with web-applications that themselves use PDF.js. In that case, it does not run in a separate or special origin; that is a Firefox thing.
You are also right that the PDF format supports JavaScript, but that is something unrelated to this, and indeed highly sandboxed in all cases.