A PDF that plays a rendition can still carry a script past the gate

Open
#2,201 0 comments 0 reactions 1 assignee View on GitHub

@wintermeyer is already working on this.

Since Sep 11, 2026.

Assessment

This issue has not been assessed yet.

Description

Bug Security

A /Rendition action carries its script in /JS, a key the PDF gate's name scan does not look for, and behind a /Next chain pdfinfo does not report it either — so both answerers are blind and the file is accepted and stored. Measured through the real upload path as a dictionary, as an array, through a page's /AA /O with no /OpenAction at all, and in the spec's canonical no-/OP form. Proof that it really is script: poppler answers JavaScript: yes for the identical dictionary reached directly, and the gate refuses that one.

Treat /JS and /Rendition as script-bearing names, or refuse any /Next outright, since poppler cannot vouch for what lies past it. Nobody notices today because uploads are admin-only, but this has to be closed before ATTACHMENT_UPLOADERS opens to members. Two neighbours belong in the same pass: an /AF file whose stream omits /Type /EmbeddedFile, and XFA scripts, both accepted and both only documented. And no test covers poppler's JavaScript vote at all — disabling it leaves all 46 attachment tests green, so half the defence is unguarded.

Where: Vutuv.Uploads.PdfGate.

An AI agent wrote this text in my name. I know that is problematic.

Dominant language
Elixir
Stars
345
Forks
43
Avg merge
2h 58m
Merged PRs (30d)
391

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from wintermeyer/vutuv

All issues in wintermeyer/vutuv

Similar issues

More Elixir issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.