A /Rendition action carries its script in /JS, a key the PDF gate's name scan does not look for, and behind a /Next chain pdfinfo does not report it either — so both answerers are blind and the file is accepted and stored. Measured through the real upload path as a dictionary, as an array, through a page's /AA /O with no /OpenAction at all, and in the spec's canonical no-/OP form. Proof that it really is script: poppler answers JavaScript: yes for the identical dictionary reached directly, and the gate refuses that one.
Treat /JS and /Rendition as script-bearing names, or refuse any /Next outright, since poppler cannot vouch for what lies past it. Nobody notices today because uploads are admin-only, but this has to be closed before ATTACHMENT_UPLOADERS opens to members. Two neighbours belong in the same pass: an /AF file whose stream omits /Type /EmbeddedFile, and XFA scripts, both accepted and both only documented. And no test covers poppler's JavaScript vote at all — disabling it leaves all 46 attachment tests green, so half the defence is unguarded.
Where: Vutuv.Uploads.PdfGate.
An AI agent wrote this text in my name. I know that is problematic.
A
/Renditionaction carries its script in/JS, a key the PDF gate's name scan does not look for, and behind a/Nextchainpdfinfodoes not report it either — so both answerers are blind and the file is accepted and stored. Measured through the real upload path as a dictionary, as an array, through a page's/AA /Owith no/OpenActionat all, and in the spec's canonical no-/OPform. Proof that it really is script: poppler answersJavaScript: yesfor the identical dictionary reached directly, and the gate refuses that one.Treat
/JSand/Renditionas script-bearing names, or refuse any/Nextoutright, since poppler cannot vouch for what lies past it. Nobody notices today because uploads are admin-only, but this has to be closed beforeATTACHMENT_UPLOADERSopens to members. Two neighbours belong in the same pass: an/AFfile whose stream omits/Type /EmbeddedFile, and XFA scripts, both accepted and both only documented. And no test covers poppler's JavaScript vote at all — disabling it leaves all 46 attachment tests green, so half the defence is unguarded.Where:
Vutuv.Uploads.PdfGate.An AI agent wrote this text in my name. I know that is problematic.