Hacker News Reader

Comment by rolandog | Hacker News Reader

Does anyone know if running PDFs through the following filter (as in [0]) prevent malicious actors?

    gs \
        -dNOPAUSE \
        -sDEVICE=pdfwrite \
        -sOUTPUTFILE=clean.pdf \
        -dBATCH \
        dirty.pdf

[0]: https://tex.stackexchange.com/a/481609/29430

View on HN

It can make things worse: Ghostscript is not particularly safe to run on untrusted/potentially malicious input. It has a giant attack surface and no proper mitigations, unlike the PDF reader in your browser.

At a minimum, you'd have to sandbox it using something like gVisor.

Ahh, interesting...

How would you structure your workflow to protect from potentially malicious PDFs?

I had originally thought of setting up an inotifywait watcher that would look for downloaded PDFs to swap downloaded files (while leaving a *_with-risky-active-contents.pdf copy).

After thinking for a bit about your comment, I thought about creating a .desktop file that first cleans the PDF via `docker run --runtime=runsc -it ubuntu gs ...` that then proceeds to launch the viewer, and is associated as the main reader of PDF documents...

But now I am wondering if this should be integrated into clamav and other antivirus clients (and unblocking on a case-by-case basis).

GhostScript has -dSAFER as default since decades. If any, you can always use pdf2djvu to convert that PDF into a DJVU file. On the PDF in your browser... if it runs JS, you can get p0wned twice, even if it's sandboxes. Vuls in browsers are like segfaults with dubious codecs.

Reply on news.ycombinator.com