[Bug]: Security Vulnerability reported in version- 2.14.305

[Nikhil-Kumar-TBS]

Attach (recommended) or Link to PDF file

Hi Team,

We are currently using workerVersion = '2.14.305', and a Double Escaping/Unescaping vulnerability has been identified in this version. Based on our review, it appears that there is currently no available fix for this issue.

https://mozilla.github.io/pdf.js/getting_started/#download

Could you please review this and advise on how we should proceed to mitigate or handle this vulnerability?

Additionally, if a fix is planned for an upcoming release, kindly share the expected timeline or version in which the issue will be addressed.

Issue link- https://github.com/ePRINTit/cloud-saas-chrome-ext/security/code-scanning/2

Thank you for your support.

Web browser and its version

Chrome Version 145.0.7632.117 (Official Build) (64-bit)

Operating system and its version

windows11 64 bit

PDF.js version

2.14.305

Is the bug present in the latest PDF.js version?

Yes

Is a browser extension

No

Steps to reproduce the problem

scaping meta-characters in untrusted input is an important technique for preventing injection attacks such as cross-site scripting. One particular example of this is HTML entity encoding, where HTML special characters are replaced by HTML character entities to prevent them from being interpreted as HTML markup. For example, the less-than character is encoded as < and the double-quote character as ". Other examples include backslash-escaping for including untrusted data in string literals and percent-encoding for URI components.

The reverse process of replacing escape sequences with the characters they represent is known as unescaping.

Note that the escape characters themselves (such as ampersand in the case of HTML encoding) play a special role during escaping and unescaping: they are themselves escaped, but also form part of the escaped representations of other characters. Hence care must be taken to avoid double escaping and unescaping: when escaping, the escape character must be escaped first, when unescaping it has to be unescaped last.

If used in the context of sanitization, double unescaping may render the sanitization ineffective. Even if it is not used in a security-critical context, it may still result in confusing or garbled output.

What is the expected behavior?

Excepted behaviour should be by using this version it reads the pdf without raising any security issues.

What went wrong?

By using this version we got this security issue- Double escaping or unescaping issue which is a high severity issue.

Link to a viewer

No response

Additional context

No response

[timvandermeij]

PDF.js 2.14.305 is 4 years old and therefore far out of support and should really not be used anymore. The fix is therefore to upgrade to the most recent version (5.5.207 as of writing).