logoalt Hacker News

Thaxll • today at 4:42 PM • 2 replies • view on HN

Is it an exploit around the library that handles PDF parsing/opening? Can someone explain how files / attachement are open on a mobile device ( android/iPhone).

I don't understand how in 2026 this is still a thing, we have many safe languages to parse/deserialize data. Why is it complicated?


Replies

drum55 • today at 4:46 PM

PDFs are basically executables, that's why it's hard. They support running code, they support decoding images which themselves have their own custom compressors that are basically code. Anything to do with image formats is rife for bad decoders, insane compression algorithms from the 90s, and a PDF is basically 1000 formats inside many different container types with executable code plastered on everywhere. If you want to make a compatible PDF viewer you'll need to be able to implement an image decoder algorithm for a fax machine that was specific to Japan in the late 80s, which was somehow ratified into a standard and is used today by all the top legal firms, or something absurd like that. When you open a PDF on your computer, depending on how it is being parsed, it can even make outbound network connections without you knowing. To safely open a PDF you need one of those bomb proof suits, a disposable laptop, and even then you might be going home without eyebrows.

➕ show 4 replies
ethin • today at 5:58 PM

I'm pretty sure not even the safe languages would help you here. PDF allows you to pretty much run arbitrary code since it supports javascript, images, and a bunch of other things I'm forgetting, and you can't not implement javascript support or otherwise be selective about what you support with it because then all the end-users will complain when they get that one PDF that they need to fill out but it needs JS because... Nobody knows.