8.1.7 & 9.2
• JavaScript blacklist introduced thereby allowing selective blocking of vulnerable APIs.
Default lists are null.
• A non-intrusive Yellow Message Bar (YMB) that doesn't block workflows replaces
many of the modal dialogs. Depending on how the client is configured, the YMB
appears at the top of the document and offers the user to trust the document "once" or
"always."
•
cAlwaysTrustedForJavaScript
can override the global JS off preference for
specifically trusted documents.
• cJavaScript can override the high privileged JS restrictions for specifically trusted
documents.
8.2 & 9.3
None.
9.3.4
cJavaScriptURL
is introduced as part of enhanced security. An untrusted document that tries to invoke an URL via JS displays
the YMB.
10.1.1
• Changes to the global variable and user JavaScripts features are made more secure.
These changes require action by IT as described in
Migrating to 10.1.1+
.
• JavaScript Blacklist Framework Tool is introduced which provides IT with a GUI for
managing JS APIs.
11.0
bEnableCertificateBasedTrust
provides a way to make certified documents trusted as a privileged location.
5.4 Disabling JavaScript
Global JS configuration may occur via the user interface or the registry/plist.
1. Go to
Preferences > JavaScript
(The exact path varies by product and platform).
2. In the JavaScript panel, uncheck
Enable Acrobat JavaScript
. This preference sets:
[HKCU\Software\Adobe\<product name>\<version>\JSPrefs]
"bEnableJS"
=
dword:00000000
Note
If JS is disabled, the user experience when a document tries to execute JavaScript varies by product
version.
5.4.1 Trusted override
There are several ways to assign trust so that this feature works in a trusted context:
• Users can trust documents on-the-fly when the PDF opens: When the Yellow Message Bar appears,
choose the
Options
button and then trust the document
once
or
always
.
• Create a privileged location via the UI for the file, folder, or host.
• Create a privileged location via the registry/plist by placing a tID at:
[HKCU\Software\Adobe\<product name>\<version>\TrustManager\(cTrustedSites or TrustedFolders)\cAlwaysTrustedForJavaScript]
"t8"
=
"C:\\someTrustedPDF"
Section 5 JavaScript Controls
Application Security Guide
Page 32
Section 5 JavaScript Controls
