html5 - used <script src="sample.pdf"></script> in Html still the javascript code in pdf works -


recently in 1 of code, in script src, used pdf file had javascript code in it. still, javascript worked fine. can use extension of file in src has javascript, if how browser detects javascript code inside pdf file.

example of usage

index.html

<html>  <title> sample </title>  <script   src="https://code.jquery.com/jquery-3.2.1.min.js"   integrity="sha256-hwg4gsxgfzhoseeamdoygbf13fyquitwlaqgxvsngt4="   crossorigin="anonymous"></script>   <script src="js/sample.pdf"></script>  <body>   <h1>sample page test script tag</h1>  </body> </html>

js/sample.pdf

$(document).ready(function(){ consloe.log('it works'); });

in html5, default value script[type] attribute 1 of javascript application.

browsers mime type checks in order allow executable mimes means application/... might seen valid, , text/... too.

[edit] according this mdn article,

the script should served text/javascript mime type, browsers lenient , block them if script served image type (image/*), video type (video/*), audio (audio/*) type, or text/csv.

here snippet which works in chrome* showing few examples of weirdly accepted , refused mime types :

function loadscript(type, magics){    const script = document.createelement('script');    const magic_array = new uint8array(magics.split(' ').map(n=>parseint(n, 16)));    script.src = url.createobjecturl(new blob(magic_array, {type: type}));    script.dataset.id = type;    script.onerror = e => console.log(type, 'failed');    script.onload = e => console.log(type, 'success');    document.head.appendchild(script);    }  loadscript('image/png', '89 50 4e 47 0d 0a 1a 0a'); // fails  loadscript('application/zip', '50 4b 03 04'); // works  loadscript('text/css', ''); // works  loadscript('text/csv', ''); // fails  loadscript('text/plain', ''); // works  loadscript('application/octet-stream', '4d 5a'); // works  loadscript('application/exe', '4d 5a'); // works

*ff doesn't respect mime type , doesn't triggers magic number's checking on bloburis... did test on local server , when sends these mimes, results same.


Comments

Post a Comment

Popular posts from this blog

Sort a complex associative array in PHP -

this question has answer here: php sort array subarray value 5 answers i have associative array in php like: $newarray1 = array ( [producta] => array ( [link] => http://sanjosespartan.com/blog/products/agile-java-development/ [visitcount] => 4 ) [productd] => array ( [link] => http://sanjosespartan.com/blog/products/intro-to-go/ [visitcount] => 1 ) [productg] => array ( [link] => http://sanjosespartan.com/blog/products/node-js-for-developers/ [visitcount] => 1 ) [productb] => array ( [link] => http://sanjosespartan.com/blog/products/beginning-mysql/ [visitcount] => 1 ) [productc] => array ( [link] => http://sanjosespartan.com/blog/products/computer-networks/ [visitcount] => 1 ) ...
Read more

vb.net - How to ignore if a cell is empty nothing -

how use roscolor() ignore value (like empty cell) ? color row if value upper 5 when there nothing in cell, want ignore roscolor() apply, how? public sub roscolor() integer = 0 quotedatagridview1.rows.count() - 1 step +1 dim val integer val = quotedatagridview1.rows(i).cells(3).value if val = vbempty quotedatagridview1.rows(i).defaultcellstyle.backcolor = color.white elseif val < 5 quotedatagridview1.rows(i).defaultcellstyle.backcolor = color.red elseif val > 5 , val < 10 quotedatagridview1.rows(i).defaultcellstyle.backcolor = color.lightyellow end if next end sub you can check empty value following public sub roscolor() integer = 0 quotedatagridview1.rows.count() - 1 step +1 dim val = quotedatagridview1.rows(i).cells(3).value if isdbnull(val) or val nothing quotedatagridview1.rows(i).defaultcellstyle.backcolor = color.white ...
Read more

recursion - Can every recursive algorithm be improved with dynamic programming? -

i first year undergraduate csc student looking competitive programming. recursion involves defining , solving sub problems. understand, top down dynamic programming (dp) involves memoizing solutions sub problems reduce time complexity of algorithm. can top down dp used improve efficiency of every recursive algorithm overlapping sub problems? dp fail work , how can identify this? the short answer is: yes. however, there constraints. obvious 1 recursive calls must overlap. i.e. during execution of algorithm, recursive function must called multiple times same parameters. lets truncate recursion tree memoization. can use memoization reduce number of calls. however, reduction of calls comes price. need store results somewhere. next obvious constraint need have enough memory. comes not-so obvious constraint. memory access requires time. first need find result stored , maybe copy location. in cases, might faster let recursion calculate result instead of loading somewher...
Read more