Return to Answer

edited body

Source Link

edited Feb 10, 2020 at 2:02

PDF in browsers

Assuming the browser makes things safe for you, you shouldn't have anything to do on your end (more or less). Unless you are yourself implementing a browser.

One thing I've seen, though, are processors that will remove scripts from such file formats (especially in MS-Word/Execl files). Then you know that at least they won't execute anything on the client's machine. Of course, as a result the file may not display as expected by the author.
other formats

On the Internet, I'd just use HTML. However, if your clients need printing your data, it's better to have a PDF file (as it is more likely to appear as expected on the printer).

Otherwise, pretty much all file formats may include a script. Maybe RTF is limited in that arena, but I've not checked that format in ages.
PDF validation

For sure, you should make sure that the file is a PDF file, if not so, it can be refused. For that test, make sure you use a mechanism similar to what the file command line does:
```
 file <your-file>.pfdpdf
```
Just checking that a file has a given extension (.pdf) would not help one bit.

The best technique is for the server to read the entire file. Maybe run it through a PDF parser which spits out the text in a .txt file. If that works, then you can assume the file is a PDF and not some other random format.

PDF in browsers

Assuming the browser makes things safe for you, you shouldn't have anything to do on your end (more or less). Unless you are yourself implementing a browser.

One thing I've seen, though, are processors that will remove scripts from such file formats (especially in MS-Word/Execl files). Then you know that at least they won't execute anything on the client's machine. Of course, as a result the file may not display as expected by the author.
other formats

On the Internet, I'd just use HTML. However, if your clients need printing your data, it's better to have a PDF file (as it is more likely to appear as expected on the printer).

Otherwise, pretty much all file formats may include a script. Maybe RTF is limited in that arena, but I've not checked that format in ages.
PDF validation

For sure, you should make sure that the file is a PDF file, if not so, it can be refused. For that test, make sure you use a mechanism similar to what the file command line does:
```
 file <your-file>.pfd
```
Just checking that a file has a given extension (.pdf) would not help one bit.

The best technique is for the server to read the entire file. Maybe run it through a PDF parser which spits out the text in a .txt file. If that works, then you can assume the file is a PDF and not some other random format.

PDF in browsers

Assuming the browser makes things safe for you, you shouldn't have anything to do on your end (more or less). Unless you are yourself implementing a browser.

One thing I've seen, though, are processors that will remove scripts from such file formats (especially in MS-Word/Execl files). Then you know that at least they won't execute anything on the client's machine. Of course, as a result the file may not display as expected by the author.
other formats

On the Internet, I'd just use HTML. However, if your clients need printing your data, it's better to have a PDF file (as it is more likely to appear as expected on the printer).

Otherwise, pretty much all file formats may include a script. Maybe RTF is limited in that arena, but I've not checked that format in ages.
PDF validation

For sure, you should make sure that the file is a PDF file, if not so, it can be refused. For that test, make sure you use a mechanism similar to what the file command line does:
```
 file <your-file>.pdf
```
Just checking that a file has a given extension (.pdf) would not help one bit.

The best technique is for the server to read the entire file. Maybe run it through a PDF parser which spits out the text in a .txt file. If that works, then you can assume the file is a PDF and not some other random format.

Source Link

created Feb 9, 2020 at 23:53

PDF in browsers

Assuming the browser makes things safe for you, you shouldn't have anything to do on your end (more or less). Unless you are yourself implementing a browser.

One thing I've seen, though, are processors that will remove scripts from such file formats (especially in MS-Word/Execl files). Then you know that at least they won't execute anything on the client's machine. Of course, as a result the file may not display as expected by the author.
other formats

On the Internet, I'd just use HTML. However, if your clients need printing your data, it's better to have a PDF file (as it is more likely to appear as expected on the printer).

Otherwise, pretty much all file formats may include a script. Maybe RTF is limited in that arena, but I've not checked that format in ages.
PDF validation

For sure, you should make sure that the file is a PDF file, if not so, it can be refused. For that test, make sure you use a mechanism similar to what the file command line does:
```
 file <your-file>.pfd
```
Just checking that a file has a given extension (.pdf) would not help one bit.

The best technique is for the server to read the entire file. Maybe run it through a PDF parser which spits out the text in a .txt file. If that works, then you can assume the file is a PDF and not some other random format.