Post

I made a Doom source port that runs within a PDF file. PDFs support Javascript, so Emscripten is used to compile Doom to asm.js, which is then run within the PDF engine. Input/output is done by manipulating text input fields. doompdf.pages.dev/doom.pdf github.com/ading2210/do...

"PDFs support javascript" is the kind of sentence that makes me want to throw all my tech in a well and go and live in a cave.

It's also not the only scripting language embedded in PDF. PostScript is a full programming language. FormCalc is less powerful, but still there.

I'm aware of postscript, but that at least is relevant to the job of document rendering*, and full is doing some heavy lifting in "full programming language". Also, you know, javascript in general.

Plus, given the sheer number of CVEs from PDF renderering engines in the past, the dev responsible just going "let's add a massive extra attack surface for no good reason" is wild.