TechNote

Adobe Reader and Acrobat Changes to User Experience for JavaScript Execution

Because JavaScript execution could pose a security risk, Acrobat and Adobe Reader have always provided controls for managing JavaScript. Over time, these controls have become more rich in an effort to provide granular control over document behavior. The 9.2 release contains several improvements:

Support for blacklisting specific JavaScript API's
Removal of the warning dialog that only allows for the ability to globally turn JavaScript on and off
Addition of a Document Message Bar (Gold Bar) warning as well as options that provide the user with more granualar controls

For more details about this feature and how it interacts with other features, see Managing JavaScript Execution in the Acrobat Family of Products

Adobe Reader and Acrobat 9.2 and 8.1.7 and later

Adobe Reader and Acrobat 9.2 and 8.1.7 and later will behave as follows:

If the application has JavaScript enabled:
- Non-high privileged JavaScript runs
- High privileged JS will run if permitted to do so by other controls
If the application has JavaScript disabled, any JavaScript invokes the Document Message Bar which warns the users about the script. Users have two options:
- Enable JavaScript for this document one time only
- Enable JavaScript for this document always : This option stores a unique document ID in HKCU\Software\Adobe\(product name)\(version)\TrustManager\cTrustedFolders\cAlwaysTrustedForJavaScript

What happens when JavaScript is off (9.2 and 8.1.7 and later)

If JavaScript is enabled and a blacklisted JavaScript is encountered, the Document Message Bar warns the user about the script and no script is executed even if they are not blacklisted. A NotAllowedError exception is thrown on the JavaScript console.

Blacklisted JavaScript warning

Adobe Reader and Acrobat 9.1.3 and 8.1.6 and earlier

If the application has JavaScript enabled:
- Non-high privileged JavaScript runs
- Hign privileged JS will run if permitted to do so by other controls
If the application has JavaScript disabled:
- Non-high privileged JavaScript invokes a dialog stating that the document contains JavaScript. Users are asked whether they would like to enable JS from now on for all documents. If the user selects the Yes button, the JavaScript preference is enabled for the application from then on.
- High privileged JavaScript will not execute unless the user has established a prior trust relationship with the document via a trusted certificate or privileged location.