On a 64 bit Windows system, the path is
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Adobe
.
5.5.2 Blacklist configuration
The manual steps described below require administrator privileges on a machine and should only be
undertaken by someone experienced in registry-level configuration. In most cases, configuration occurs
via the Customization Wizard prior to client deployment or via a scripting mechanism post-deployment.
To manually configure a blacklist:
1. Open the registry editor.
2. Go to
HKLM\SOFTWARE\Policies\Adobe\<product>\<version>\FeatureLockDown\cJavaScriptPerms\
.
3. Create
cJavaScriptPerms
if it does not exist by right clicking and choosing
New Key
.
4. Create
tBlackList
: right click in the right hand panel and choose
New > String value
.
5. Enter
tBlackList
.
6. Right click on
tBlackList
and choose
Modify
.
7. Add the APIs to block as a pipe-separated list in for the format of
<some Object Name>.<Some API Name>
. For example:
Util
.
CharToByte
|
App
.
alert
|
Collab
.
getIcon
8. Exit and restart the application.
cJavaScriptPerms: Registry configuration
5.5.3 Trusted override
There are several ways to assign trust so that the APIs continue to function in a trusted context:
• Create a privileged location via the UI for the file, folder, or host.
• Create a privileged location via the registry/plist by placing a
tID
at:
[HKCU\Software\Adobe\<product name>\<version>\TrustManager\<cTrustedSites or TrustedFolders>\]
"cUnsafeJavaScript"
Section 5 JavaScript Controls
Application Security Guide
Page 34
Section 5 JavaScript Controls
