Reputation: 97
I recently discovered that concatenating text to the end of a PDF file does not change properties of the PDF file. This may be a very silly question, but if a program were concatenated to the PDF file, could it somehow be executed?
For example, opening this PDF file would create a text file in the home directory with the words "hello world" in it.
*pdf contents*...
trailer^M
<</Size 219/Root 186 0 R/Info 177 0 R/ID[<5990BFFB4DF3DB26CE6A92829BB5C41B> <B35E036CA0E7BA4CBF39B3D74DCE4CAF>]/Prev 4494028 >>^M
startxref^M
4663747^M
%%EOF^M
#!/bin/bash
echo "hello world" > ~/hello.txt
Would this work with a different file format? Does the embedded code need to be a binary executable?
Upvotes: 1
Views: 4992
Reputation: 4855
As (fortunately), that's not part of the standard, you can't do that.
Unfortunately, the standard supports "launch actions", to execute arbitrary code with user confirmation. Those are now disabled by default and don't allow to execute embedded bulbs, but if enabled you could use that to execute arbitrary code that finds and executes the code embedded on the pdf.
The standard also supports javascript that excecutes sandboxed, but it a reader specific bug that allows may escaping the sandbox.
Upvotes: 2