[tool] JavaScript Snippets menu items

Forum for the PDF-XChange Editor - Free and Licensed Versions

Moderators: PDF-XChange Support, Daniel - PDF-XChange, Chris - PDF-XChange, Sean - PDF-XChange, Paul - PDF-XChange, Vasyl - PDF-XChange, Ivan - Tracker Software, Stefan - PDF-XChange

User avatar
Mathew
User
Posts: 835
Joined: Thu Jun 19, 2014 7:30 pm

[tool] JavaScript Snippets menu items

Post by Mathew »

This tool makes it easier to save snippets (short pieces) of javascript code, and run them from menu items. It removes the need to handle adding menu items, and saving .js files to the JavaScripts folder (once you have saved this script to that folder, that is ;) ).

Installation
Download and extract the zip file, and save the files into the JavaScripts folder. Then restart PDF-XChange.
snippetMenus v1.1.zip
More detailed installation instructions here: viewtopic.php?p=196006#p196006



Usage
When installed it will add a new menu (or ribbon) named "JS":
image.png
When you run the tool, it opens a dialog to enter script snippets:
image(1).png

On the left is a list of your saved snippets, with buttons to
  • [ + ] add a new snippet,
    [▲] [▼] move the selected snippet up or down the list, or
    [ - ] delete it.
Import… and Export… allow you to import/export the scripts and the associated menu data to text files.

On the top right is:
  • The name of the currently selected script (as displayed in menus);
  • a button to run the current script and
  • an area to enter the javascript:
  • The tool runs each script inside its own function, with this = current pdf document. All the variables are contained in this scope: If a script needs to create variables in the global scope, try setting globalThis.yourGlobalVariable = "in global scope". The variable scriptID has the id number that this script has been assigned.
On the bottom right there are options for where and if a button or menu item is added for this script. The small [?] buttons open help for that item.
  • Run Function at application startup will run the script when the program first starts. This is useful if you want to set up some functions or properties that your menu will later use. If you want to have a menu item, then this script must return a script/function; that function will be run by the menu item.
    Add button/menu item allows one to just save a snippet without having a button or menu assigned to it. Scripts can be run from the button in the top right of the dialog.
    Mark as Trusted Function Generally scripts are prevented from doing things that could damage documents. This option removes that restriction, so if the script is getting error "NotAllowedError: Security settings prevent access to this property or method." then the script probably needs this box checked.
    If you are concerned about this script running arbitrary trusted functions, one can completely disable that functionality by changing line 20 of snippetMenus.js:

    Code: Select all

      const ALLOW_TRUSTEDFUNCTION = false; // set false to prevent running trusted functions
    Ribbon UI and Classic UI are the language-independent names of the parent menu items for the button. The dropdown has some typical locations, but I've included Tracker Software's script "Show Classic/Ribbon UI menu structure" that will output the names for all menu items to the console.
    Position is the position within the submenu to locate the new menu item. Specifying -1 appends it to the end of the submenu. Specifying 0 adds it to the top of the submenu. The value of nPos can also be the language-independent name of a menu item.
    Keyboard is keyboard shortcut for this menu item.
    Icon [Select] opens another dialog to specify the icon for the menu:
    image(3).png
    • cIconID string is a special unique ID for an existing vector icon in Editor. I've put a dropdown with the full list of icon IDs. It's the same id as shows up under Customize > Command Properties > ID. There's a button to filter the list: Enter text to search for, and press "Filter List" to reduce the list to just the items that have the entered text.
      Image File Select an image file to use as the icon. This tool will save the path to that file, so it will be loaded from that location every time the menu is loaded. If you delete or move it, the tool will no longer be able to find it until you update this.
      ARGB data Paste the hex encoded data into this box.

When you first install the tool it comes with four snippets:
One that sets the zoom level to 175%.
  • Code: Select all

    this.zoom = 175;
    It adds a button to the Add-on Tools:
    image(2).png
Show Active Documents is an example of a tool that needs to be marked as a trusted function (because app.activeDocs is only available to trusted functions).

Startup Function is an example of a script that could run at startup, and has a private variable "counter".

Show Classic/Ribbon UI menu structure is the following script. It has no menu button assigned to it and outputs the Classic/Ribbon UI structure to the console:

Code: Select all

/************************************************************************
	To see the actual Classic/Ribbon UI structure you may use the 
	following script:
************************************************************************/

	function FancyMenuList(m, nLevel) {
	     var s = "";
	     for (var i = 0; i < nLevel; i++) s += "  ";
	     var n = m.cName;  
	     if (n == "") n = "-----"
	     console.println(s + n);
	     if (m.oChildren != null)
	         for (var i = 0; i < m.oChildren.length; i++)
	             FancyMenuList(m.oChildren[i], nLevel + 1);
	}
	var m = app.listMenuItems(); 	//to get list of items inside ClassicUI.MenuBar or inside the RibbonUI, 
	                             	//  also the optional cName parameter can be used to get items-list of certain menu/toolbar/tab
	//var m = app.listToolbarButtons(); 	// to get list of items inside the Addon toolbar
    
	for (var i = 0; i < m.length; i++) FancyMenuList(m[i], 0);

Limitations
  • The tool will not work for any functions that require privileged functions. fixed v1.0
  • If a document is open when you change or add a menu item, when the document is closed that menu item may disappear until you restart PDF XChange.
You do not have the required permissions to view the files attached to this post.
Last edited by Mathew on Thu Jun 18, 2026 5:37 pm, edited 21 times in total.
User avatar
Sean - PDF-XChange
Site Admin
Posts: 1091
Joined: Wed Sep 14, 2016 5:42 pm

Re: [tool] JavaScript Snippets menu items

Post by Sean - PDF-XChange »

Hi Mathew - that's fantastic, thank you very much!

Kind regards,
Sean Godley
Technical Writer
PDF-XChange Co LTD
Sales: +1 (250) 324-1621
Fax: +1 (250) 324-1623
User avatar
Mathew
User
Posts: 835
Joined: Thu Jun 19, 2014 7:30 pm

Re: [tool] JavaScript Snippets menu items

Post by Mathew »

I've updated the tool to make it easier to add icons. Also it can run privileged functions and run functions at startup.
[Edit] see below for updated file viewtopic.php?p=202792#p202792

Changes v1.0.1
  • fix passing scriptID when running from Run button;
  • fix bug saving position of scripts
Changes v1.0
  • rearrange dialog;
  • add trusted function option;
  • add run button;
  • add startup function option;
  • add dialog to pick icon
  • add example scripts
Changes v0.2 (not posted)
  • fix bug showing/hiding menu on add-ins;
  • add help buttons;
  • add keyboard shortcut
If you installed the v0.1 which only had one sample script and want to get the new example scripts, you can import them from this text file. First extract the zip file, then use "import" in the tool to import the text file:
example scripts.zip
You do not have the required permissions to view the files attached to this post.
Last edited by Mathew on Sun May 10, 2026 3:18 am, edited 1 time in total.
User avatar
Sean - PDF-XChange
Site Admin
Posts: 1091
Joined: Wed Sep 14, 2016 5:42 pm

Re: [tool] JavaScript Snippets menu items

Post by Sean - PDF-XChange »

Hi Mathew,

That's great - thanks again.

Kind regards,
Sean Godley
Technical Writer
PDF-XChange Co LTD
Sales: +1 (250) 324-1621
Fax: +1 (250) 324-1623
User avatar
Mathew
User
Posts: 835
Joined: Thu Jun 19, 2014 7:30 pm

Re: [tool] JavaScript Snippets menu items

Post by Mathew »

..oops posted that one too soon. This fixes some bugs and makes getting previews of the built in icons much better.
If you installed v1.0 you can delete the file Icons.pdf from the Javascripts folder - no longer needed.
snippetMenus v1.1.zip
Changes v1.1
  • fix bug compressing hex streams;
  • improve getting preview icons;
  • add warning for startup function;
  • add filter button on icon IDs
image.png
You do not have the required permissions to view the files attached to this post.
User avatar
Daniel - PDF-XChange
Site Admin
Posts: 12927
Joined: Wed Jan 03, 2018 6:52 pm

[tool] JavaScript Snippets menu items

Post by Daniel - PDF-XChange »

:)
Dan McIntyre - Support Technician
PDF-XChange Co. LTD

+++++++++++++++++++++++++++++++++++
Our Web site domain and email address has changed as of 26/10/2023.
https://www.pdf-xchange.com
[email protected]
DIV
User
Posts: 266
Joined: Fri Jun 23, 2017 1:47 am

Re: [tool] JavaScript Snippets menu items

Post by DIV »

This looks like a really useful contribution!

I have one query for you, Mathew. You mentioned "Also it can run privileged functions and run functions at startup." I was wondering whether this could (realistically) have any security implications? I'm not sure exactly what you meant with "privileged functions", but perhaps it could include file creation and deletion? How about User-Access Control? Internet access?
I can't imagine hackers would bother targeting malware for a tool used by dozens of people, but if your tool becomes popular enough....

It may be a non-issue. It was just the wording that made me think it'd be good to double-check.
User avatar
Mathew
User
Posts: 835
Joined: Thu Jun 19, 2014 7:30 pm

Re: [tool] JavaScript Snippets menu items

Post by Mathew »

DIV wrote: Thu May 07, 2026 5:46 am This looks like a really useful contribution!

I have one query for you, Mathew. You mentioned "Also it can run privileged functions and run functions at startup." I was wondering whether this could (realistically) have any security implications? I'm not sure exactly what you meant with "privileged functions", but perhaps it could include file creation and deletion? How about User-Access Control? Internet access?
I can't imagine hackers would bother targeting malware for a tool used by dozens of people, but if your tool becomes popular enough....

It may be a non-issue. It was just the wording that made me think it'd be good to double-check.
Hi @DIV,

I think security of this script is definitely a potential issue. I've tried to think of vectors that could make this script dangerous and in all cases I can think of, it has the same problems as the console (for which everything is run as a trusted function by default): Any script has to be entered by the user.

At its core, it relies on the Function() object to run scripts, which is a fundamentally risky method. As far as I can tell, it can't get access to any of the private functions and variables of this script. https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Function/Function#security_considerations

Potentially if the persistent global properties for the script were overwritten (ie in JavaScripts/GlobData), that could be a problem, but that would require a trusted function -- again, either through the user installing it or by pasting it in.

The code is fully open - I've not obfuscated it in any way, so I really encourage people with the necessary knowledge to look at the code and let me know if I've done something stupid. :oops: There are now AI tools that apparently open up a range of hacking tools to less sophisticated users than in the past, but I've not had much success using AI to improve/write code: It seems to lead me round in circles and at the end of an evening I'm back where I started (all the while telling me "that's a good point, I should have done that - here's a revised..." or similar.) But there are definitely people on this forum with better AI skills than me.

That said, I forgot to mention it in the first post, and will add it, that there's a way to completely disable trusted functions for the script -- I added it with this concern in mind.
If you are concerned about this script running arbitrary trusted functions, one can completely disable that functionality by changing line 20 of the script:

Code: Select all

  const ALLOW_TRUSTEDFUNCTION = false; // set false to prevent running trusted functions
- Mathew.
User avatar
Daniel - PDF-XChange
Site Admin
Posts: 12927
Joined: Wed Jan 03, 2018 6:52 pm

[tool] JavaScript Snippets menu items

Post by Daniel - PDF-XChange »

:)
Dan McIntyre - Support Technician
PDF-XChange Co. LTD

+++++++++++++++++++++++++++++++++++
Our Web site domain and email address has changed as of 26/10/2023.
https://www.pdf-xchange.com
[email protected]
DIV
User
Posts: 266
Joined: Fri Jun 23, 2017 1:47 am

Re: [tool] JavaScript Snippets menu items

Post by DIV »

Hi, Mathew.

Thanks for your candid response. So it sounds like the main gatekeeper is the user not pasting in dodgy scripts :-)

With regard to the option
const ALLOW_TRUSTEDFUNCTION = false; // set false to prevent running trusted functions
I am still not clear on quite what a "trusted function" is. If this parameter is set to false, then some scripts can run, or no scripts can run? Or maybe all scripts can at least partly run?
User avatar
Mathew
User
Posts: 835
Joined: Thu Jun 19, 2014 7:30 pm

Re: [tool] JavaScript Snippets menu items

Post by Mathew »

DIV wrote: Sat May 09, 2026 4:30 pm With regard to the option
const ALLOW_TRUSTEDFUNCTION = false; // set false to prevent running trusted functions
I am still not clear on quite what a "trusted function" is. If this parameter is set to false, then some scripts can run, or no scripts can run? Or maybe all scripts can at least partly run?
Yes, I think pasting a dodgy script into this tool would not be good. It couldn't do any more than pasting that same script into the console, except that this tool will save it, so it's not necessarily gone the next time PDFX-Change is quit and restarted.

"Trusted Functions" are functions that can run commands that the API has determined need more security. If that option is turned off, scripts will not be able to run if they do something restricted (ie only a trusted function can get a list of the currently open documents, or launch a URL in a browser window, for example). The Acrobat JavaScript API indicates with methods have restrictions. I'll paste a section from the API below, but generally these are functions that can affect multiple pdf documents, or open/save files.
image.png
Even when designated as a trusted function, a script is still very limited in PDF exchange. They can't change document base content, they can only save pdf files, and there's generally a security alert if the script tries to access a file. In the big picture, I think this tool is a lower security risk than having the "Enable JavaScript Actions" setting checked (which allows scripts to run automatically and silently in any pdf you open), because a user is going to be aware of pasting something into the tool. Arbitrary scripts in pdfs we receive, though, I really don't know. I keep it switched off personally:
image(1).png
You do not have the required permissions to view the files attached to this post.
Last edited by Mathew on Thu Jun 04, 2026 11:26 pm, edited 1 time in total.
DIV
User
Posts: 266
Joined: Fri Jun 23, 2017 1:47 am

Re: [tool] JavaScript Snippets menu items

Post by DIV »

Thanks very much for the tips and educational information!
Following your advice, I have likewise disabled the "Enable JavaScript Actions" preference (under File > Preferences > JavaScript).

P.S. I forgot to mention that my experience with AI tools for programming is similar to yours: plausible code is provided, but it may either obviously fail with errors or warnings, or it may quietly fail to work properly — typically after the AI tool has stated that the previous problems have been fixed, which seems persuasive given that there are no longer any obvious errors/warnings.
User avatar
Sean - PDF-XChange
Site Admin
Posts: 1091
Joined: Wed Sep 14, 2016 5:42 pm

Re: [tool] JavaScript Snippets menu items

Post by Sean - PDF-XChange »

:)
Sean Godley
Technical Writer
PDF-XChange Co LTD
Sales: +1 (250) 324-1621
Fax: +1 (250) 324-1623