PDF OpenAction and JavaScript: What They Do and Why They Matter

A PDF is usually pages of text and pictures, but the format also lets a file do things: jump to a page when opened, run a script when a button is clicked, open a web address, send form data somewhere. These actions are part of the PDF specification (ISO 32000), they are used legitimately all the time, and they are also a long-standing way to attack readers. Knowing what they are helps you judge what you receive.

Actions and where they sit

An action is a dictionary with a type, the /S entry. A link annotation has an action that runs when you click it; a form button has one too. Some actions are attached to events that need no click:

• OpenAction in the document catalog runs when the file is opened.
• Additional actions (AA) run on events such as a page being opened or closed, or the document being saved, printed or closed.
• The JavaScript name tree lists document-level scripts that run when the file is opened.

Viewers differ in what they honour, and many ask permission or block the dangerous ones, but a file that has such an entry is asking.

The action types that matter

• JavaScript. Code run by the viewer's script engine. Forms use it for calculation and validation; it can also open links, send data or try to exploit a bug in the viewer.
• Launch. Asks the viewer to open or run another file or program. Modern viewers warn or block, and an ordinary document rarely needs it.
• SubmitForm and ImportData. Send form data to a web address, or load data from a file.
• URI. Opens a web address, normal for links, notable when it is run automatically.
• GoToR and GoToE. Jump into another PDF file, or into a file embedded in this one.
• Rich media, movie, sound and 3D. Active content played inside the page.

Beyond actions, a PDF can contain embedded files, which are not run but can be extracted, and, rarely today, XFA forms, an XML-based dynamic form technology that Adobe removed from the standard and that only Adobe products fully support.

How to look without running anything

The structure can be read as data. The PDF Active Content Scanner walks the document catalog and every page in your browser, lists each action with its location, marks the ones that can run automatically, shows the start of any script and lists embedded files, without running a line of it. It also decodes names written with #-escapes, a trick used to disguise keywords, and shows raw keyword counts like the pdfid tool does. Compressed object streams hide keywords from a plain text search, which is why the full walk matters.

Reading the result sensibly

• No findings: the structure has no actions or embedded files. It does not prove the file is safe; exploits in fonts, images or a particular viewer's parser are not visible this way.
• A fillable form with JavaScript: normal. Read what the script does.
• An invoice or contract with JavaScript, a Launch action or an OpenAction script: unusual, ask the sender.
• An embedded executable or script file: do not open it unless you expected it from a trusted source.

If a file worries you, do not open it in an up-to-date viewer with scripting enabled; ask the sender for another copy through a different channel, and have it checked by your IT security staff or a malware scanner. For documents you send, remove what is not needed: flattening turns forms and annotations into page content, and the PDF Attachments Extractor shows what is embedded. See also PDF redaction mistakes for a different kind of hidden content.