I have a project where I would like to allow a user to view a document (PDF) in their browser by clicking on a link or thumbnail of the file. They would be able to download said file. Ive just begun to research the vulnerabilities associated with PDF files but here is what I can gather so far:
PDFs can contain executable code that could create exploits or identify other exploits. PDFs are not unique in this regard.
To protect against any malicious PDF action occurring, browsers now open all PDF files in a sandbox. These sandboxes can be more secure than local viewers. Browsers that open PDF files in a sandbox:
- Chrome : yes
- Firefox : yes
- Edge : ?
- IE : ?
- Safari : ?
I plan to store the PDF files on the file system outside of web root. The files meta data will be indexed inside a database.
Communication will be over SSL.
- Does opening a PDF file in a browser sandbox eliminate risks with displaying PDF in browser?
- Are there more ideal file formats (from a security standpoint) to use over PDF for the use case described?
- What types of server side validation could/should I perform when displaying a PDF document?