Suggsted javascript add-on import system

[MedBooster]

It would be easier if there were some sort of menu inside PDF-XCE itself, similar to how a game can let you load a mod from a file on your PC, or adding an extension on your browser...
1)
I would then suggest there being an "import/load javascript"-button, and if you click it you could choose a javascript to import from file explorer (still through PDF-XCE).
2)
Then, most importantly, it would be great to get feedback, about whether it was imported successfully, if possible... (this is where I mess up when copying them over to the folder....)
3)
Previously in another thread we have discussed having a button to open the javascript folder itself through the settings or having a custom button, but this here is a more complicated "solution" I am suggesting, to making it easier to load the javascripts.
4)
If you could have some menu which would show the active ones in PDF-XCE as well, it would help a lot, maybe with replace or delete buttons as well for example.

[Daniel - PDF-XChange]

Hello, MedBooster

The trouble with adding any functions of that ilk are that "app-level scripts" usually need to be loaded during startup, in order to work properly. Adding them while the software is running will not make them immediately usable, without some massive under-the-hood changes to accommodate that use.

That said, the option to open the JS folder directly is already present, hiding inside the JavaScript window itself (Ctrl_j).

Kind regards,

[Mathew]

Hi MedBooster,

I've thought a bit about this and think it is possible to make a javascript tool that will allow scripts to be added through a UI. I think it would still require some type of copy/paste or selecting the individual javascript files, but it's possible. Because the code would be contained within the script's saved global variables, it could add/remove/replace them through the UI. It's another one for my list; not any time soon though.

(tldr: In case someone wants to take a go at it: I'd use built-in javascript new Function() and the tool would load menus at startup. It could be a bit messy because if documents are open, then any added menus will be associated with that document and get disabled/deleted as soon as that document closes, so as Daniel pointed out, it would probably require a restart of the application to make changes to the menus. In a forum post a while back I'd asked if there's a limit to the size of saved global variables - thinking about this use case - I think there is not a practical limit, so this could work. I've not written any of the code, it's just in my list of ideas right now.)

BTW: There is already a non-yet-working skeleton of a system built-in for javascript code snippets that's been hibernating for quite a while now. It's probably quite far down on PXCE developers' to-do list. If this were fleshed-out with the option to add a menu item to the snippet, it's basically what I'm thinking of for the above javascript tool:

image.png

[Mathew]

I just wanted to add to this string based on a recent post by Daniel here: viewtopic.php?p=195965#p195965

however, there always exists a level of "you should understand the risks involved", which leaves us hesitant to make scripts "too easy" to install, even if it is possible.

I very much agree with Daniel on this: I can see that many users (maybe most users) would not want this to be too easy. If people have gone through the effort of unzipping and manually copying files, they will be pretty aware that if something goes awry it may be related to what they just did. However, if just picking an option in a menu within PDF-XChange one would have different expectations.

It could be a bit of a nightmare for sysadmins - and even Tracker support: Each added script adds another opportunity for bugs (or something malicious) that come from the script, not from the software itself. But the sysadmins and probably PDF-XChange would get the brunt of the support calls. If all scripts had to be vetted by someone before they could be installed, that would both add a huge amount of work for them, and probably stifle the opportunity for someone like me to make the scripts. I'm thinking of the apple app store, for example.

I feel pretty lucky that PDF-XChange tolerate me posting scripts on this forum and often help by making the software integrate better with scripts (all the ribbon modification options are just one example).

[Daniel - PDF-XChange]

[MedBooster]

ps excellent explanation here on how to currently install the javascripts


viewtopic.php?t=42190

Thanks to Mathew


PS:
regarding the privacy/safety concern of JavaScript "add-ons" in PDF-XCE,
what can they be?

Are there not any privacy firewalls in the program that would stop a javascript from for example forwarding files on an external source? Or in terms of any malicious intent?

What were the risks you were thinking about?

Maybe you could consider having some setting in PDF-XCE to block the malicious actions you are referring to which you could disable or enable?

[Mathew]

PS:
regarding the privacy/safety concern of JavaScript "add-ons" in PDF-XCE,
what can they be?

Are there not any privacy firewalls in the program that would stop a javascript from for example forwarding files on an external source? Or in terms of any malicious intent?

What were the risks you were thinking about?

Maybe you could consider having some setting in PDF-XCE to block the malicious actions you are referring to which you could disable or enable?

In general PDF-XC tries to block potentially malicious actions by scripts. Blocking everything, though makes scripts not work at all! Importantly, when scripts are copied to the Javascripts folder, that enables them to bypass many of the blocks - and that is necessary for much of the functionality in most of the scripts I've written, for example.

I don't want to get into specifics of what a script could do maliciously, but think of this: A script can add to/change/insert annotations, links,bookmarks,form elements in any open document. It can read or change form values or attach scripts to form elements. It can move/insert/delete pages. It can insert scripts into documents that will then run when the document is opened/saved/pages changed. Other things scripts can do include opening/saving files (it can open pdf's in the background so users don't even see them) and can communicate over HTTP; these actions will generate separate alerts every time unless a user disables them, though.

I think it's more likely that a script is buggy than malicious. But these bugs could prevent PXCE from operating properly until the script is deleted.

[Daniel - PDF-XChange]

Hello, Mathew

indeed, buggy scripts are far more common than malicious ones, especially on these forums.
But yes, without disabling JS entirely, it is not really possible to offer options to "prevent" these kinds of issues.

Kind regards,