Disable JavaScript embedded in PDF in browser (XSS attack)

user_3692178 0
Viewed 778

We are trying to load a PDF in an iframe using ExtJs. The PDF is embedded with JavaScript. When it is loaded in the browser, the alert is being displayed and it is considered as JS injection in penetration testing.

Any help to avoid the JS execution from PDF?

Edit 1

Tried using sandbox, html embed element.

sandbox doesn't display whole PDF when viewed in Chrome and Internet Explorer.

Below is the code

onResearchGridPanelDBItemClick: function(dataview, record, item, index, e, eOpts) {
        var pdf = record.get('path');
        var title = Encoder.htmlDecode(record.get('title'));
        var pdfPanel = null;
        var pdfTab = null;
        var p = Ext.getCmp('ResearchPanel');
        if(p){
            pdfPanel = p;   
        }else{
            pdfPanel = Ext.create('sample',{
                modal: true,        
                border:false,
                resizable: false
            });
        }
        console.log("RESEARCHCLICK: "+pdf+" launched by "+username);
        pdfPanel.show();
        if(pdfPanel.getEl()){
            pdfPanel.body.update('<b>'+title+'</b>'+ '<br><br>' + '<iframe style="height: 100%; width:100%; border: none" src="'+contextPath+'/resources/research/'+pdf+'"></iframe>');
        }
    },
extjs4 javascript-injection extjs html javascript
1 Answers

Maybe you should use embed instead of iframe like:

onResearchGridPanelDBItemClick: function(dataview, record, item, index, e, eOpts) {
        var pdf = record.get('path');
        var title = Encoder.htmlDecode(record.get('title'));
        var pdfPanel = null;
        var pdfTab = null;
        var p = Ext.getCmp('ResearchPanel');
        if(p){
            pdfPanel = p;   
        }else{
            pdfPanel = Ext.create('sample',{
                modal: true,        
                border:false,
                resizable: false
            });
        }
        console.log("RESEARCHCLICK: "+pdf+" launched by "+username);
        pdfPanel.show();
        if(pdfPanel.getEl()){
            pdfPanel.body.update('<b>'+title+'</b>'+ '<br><br>' + '<embed type="application/pdf" height="100%" width="100%" src="'+contextPath+'/resources/research/'+pdf+'">');
        }
    },
user_43409500
Related