Only handle scripting updates that target a known field

Collect the ids of the document field annotations and ignore any id
coming from the scripting sandbox that isn't among them.
This commit is contained in:
Calixte Denizet 2026-07-20 18:32:54 +02:00
parent 6c18df5768
commit 4ea07c2431
No known key found for this signature in database
GPG Key ID: 0C5442631EE0691F

View File

@ -45,6 +45,8 @@ class PDFScriptingManager {
#externalServices = null; #externalServices = null;
#objectIds = null;
#pdfDocument = null; #pdfDocument = null;
#pdfViewer = null; #pdfViewer = null;
@ -104,6 +106,18 @@ class PDFScriptingManager {
if (pdfDocument !== this.#pdfDocument) { if (pdfDocument !== this.#pdfDocument) {
return; // The document was closed while the data resolved. return; // The document was closed while the data resolved.
} }
// Collect the ids of every field annotation, so that any sandbox message
// targeting an unknown id can be ignored.
if (objects) {
this.#objectIds = new Set();
for (const fields of Object.values(objects)) {
for (const { id } of fields) {
this.#objectIds.add(id);
}
}
}
try { try {
this.#scripting = this.#initScripting(); this.#scripting = this.#initScripting();
} catch (error) { } catch (error) {
@ -368,6 +382,9 @@ class PDFScriptingManager {
const ids = siblings ? [id, ...siblings] : [id]; const ids = siblings ? [id, ...siblings] : [id];
for (const elementId of ids) { for (const elementId of ids) {
if (!this.#objectIds?.has(elementId)) {
continue;
}
const element = document.querySelector( const element = document.querySelector(
`[data-element-id="${elementId}"]` `[data-element-id="${elementId}"]`
); );
@ -456,6 +473,8 @@ class PDFScriptingManager {
} }
async #destroyScripting() { async #destroyScripting() {
this.#objectIds = null;
if (!this.#scripting) { if (!this.#scripting) {
this.#pdfDocument = null; this.#pdfDocument = null;