PDFObject is vulnerable to PDFInjection

[Virgula0]

PDFObject is vulnerable to PDFInjection

[pipwerks]

Thanks for reporting. The latest dev branch has already been modified to only use iframe (no object), I will look into adding the sandbox attribute.

[Virgula0]

Please note that sanitization, for the purpose of the library, should occur at a lower level when a file is read. The Sandbox attribute can help but is not the final solution to achieve sanitization. Unfortunately, I have to warn you that this task can be quite challenging to achieve due to the fact that there are no external libraries that seem to support the PDF sanitization process.

[theodore-s-beers]

look into adding the sandbox attribute

In Chromium, at least, the PDF viewer is disabled completely in a sandboxed iframe. There is no workaround, nor afaik are there any plans to change this.

[pipwerks]

I've decided against adding sandbox for now, due to potential for breaking sites that use PDFObject. If a user wants to sandbox the iframe, the option is available via PDFObject's customAttribute option.

Thanks