FS#50740 - [mupdf] Disable form and javascript support

Attached to Project: Community Packages
Opened by sher (shedto) - Sunday, 11 September 2016, 17:13 GMT
Last edited by Christian Hesse (eworm) - Tuesday, 27 December 2016, 14:28 GMT
Task Type Bug Report
Category Packages
Status Closed
Assigned To Christian Hesse (eworm)
Architecture All
Severity Medium
Priority Normal
Reported Version
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Votes 1
Private No

Details

Description:

Using pdf forms with the current version of mupdf crashes the application.
Simply clicking on a form input in a pdf file will cause the application to be unresponsive.
When started from the console there will be a broken prompt for the input message.


Since the form functionality is clearly completely broken and also requires javascript support, it would be best to disable form and javascript support at compiletime both for stability, usability and security reasons.

Please note that Debian already does this. When using mupdf 1.9a+ds1-1.2 on debian testing the forms are ignored an javascript is completely disabled.

https://packages.debian.org/stretch/mupdf



Version: 1.9_a-5


Steps to reproduce:

Open a pdf file with forms from commandline and click on a textinput box.


Testfile attached
This task depends upon

Closed by  Christian Hesse (eworm)
Tuesday, 27 December 2016, 14:28 GMT
Reason for closing:  Not a bug
Additional comments about closing:  We will keep things as-is.
Comment by sher (shedto) - Sunday, 02 October 2016, 18:43 GMT
Found a way to solve this:

1. set HAVE_MUJS := no
(originates from Makethird file)

2. since disabling js has a bug apply this fix http://bugs.ghostscript.com/show_bug.cgi?id=697184

3. apply the attached patch from debian to disable the console prompt (info: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=830143)
Comment by Christian Hesse (eworm) - Monday, 21 November 2016, 21:05 GMT
I could not find a reference that Debian disabled JS support. Where did you see that?
Comment by sher (shedto) - Tuesday, 22 November 2016, 16:33 GMT Comment by Christian Hesse (eworm) - Tuesday, 22 November 2016, 16:55 GMT
These bugs were reported for mupdf 1.4, which is pretty old. Currently Debian's mupdf uses MUJS for js - as we do.
Comment by sher (shedto) - Tuesday, 22 November 2016, 17:51 GMT
I have yet to find a single function/programm that uses js in mupdf/libmupdf.
I still think having javascript in pdf is one of the most stupid things to do but as there is also a mupdf-nojs in AUR, I think this can be closed.

The form input has been disabled upstream already

Loading...