Forcefully disable any Javascript

[lcl45]

Hi all!

I'm struggling with the pdfjsLib. What I'm trying to do is to forcefully disable any Javascript present inside a pdf: all the pdf I'm going to show in the application I'm working in must be some kind of read-only file, preventing any possible code execution, even if benign.
I know that this might sound strange because "this could break the pdf" or something like that, but this was requested.

In the application, we are using the default viewer found in web/viewer.html, calling it using an url similar to web/viewer.html?file=my.pdf. I've found that there is the enableScripting variable which might help with my issue, however I've found it here https://github.com/mozilla/pdf.js/wiki/Viewer-options that it is not a valid parameter.

In the main script of the application, I've added

document.addEventListener('DOMContentLoaded', function () {
    if (window.PDFViewerApplicationOptions) {
          PDFViewerApplicationOptions.set("disablePreferences", true);
          PDFViewerApplicationOptions.set("enableScripting", false);
          PDFViewerApplicationOptions.set("isEvalSupported", false);
          PDFViewerApplication.run();
    }
});

This doesn't seem to trigger the warning that should pop out (like discussed here #16158).
How can I achive my goal?

Many thanks!!

[bubakcz]

Hello.
I have a similar issue.
In our code base and repo, we have currently available version 4.4.168 of this library. With unchanged viewer js and slightly modified viewer html, even with same attributes as OP, test pdf is still running included javascript (<script>app.alert(1);</script>). Are there any changes required to default viewer script, or could be just some issue with that version and we should use a newer one?