[syncfusion_flutter_pdfviewer] pdfjs version is deprecated since 2021 and has vulnabilities

[emiliecollinbluesoft]

Bug description

Hello,

The web integration is asking to use PdfJs to render pdf :
`<script src="//cdnjs.cloudflare.com/ajax/libs/pdf.js/2.11.338/pdf.min.js"></script>

<script type="text/javascript"> pdfjsLib.GlobalWorkerOptions.workerSrc = "//cdnjs.cloudflare.com/ajax/libs/pdf.js/2.11.338/pdf.worker.min.js"; </script>`

Following snyk's result, this version (release in 2021) has vulnerability.
This seems possible to update until last 2.x version (2.16.105 - release in 2022), after that, the SfPdfViewer.memory has a flutter error, probably due to a not compatible version of pdfJs. Because we are in 2024, the use of version 4.9.x should be a reference, especially with a paid Syncfusion commercial license.
Regards.

Steps to reproduce

Incremente the pdfJs version in the <script></script>.

Code sample

Code sample

<script src="//cdnjs.cloudflare.com/ajax/libs/pdf.js/4.9.155/pdf.min.js"></script>

Version 4.9.155 doesn't get anymore worker file.

<script src="//cdnjs.cloudflare.com/ajax/libs/pdf.js/3.11.174/pdf.min.js"></script>
  <script type="text/javascript">
    pdfjsLib.GlobalWorkerOptions.workerSrc = "//cdnjs.cloudflare.com/ajax/libs/pdf.js/3.11.174/pdf.worker.min.js";
  </script>
  

Worker but vulnerability.
The base widget :

Container(
            width: 700,
            constraints: BoxConstraints(maxWidth: context.screenWidth),
            child: SfPdfViewer.memory(
              pdfBytes,
              canShowHyperlinkDialog: false,
              onHyperlinkClicked: (linkDetails) =>
                  launchInBrowser(linkDetails.uri, inNewTab: true),
            ),
          ),

Screenshots or Video

Screenshots / Video demonstration

[Upload media here]

Stack Traces

Stack Traces

══╡ EXCEPTION CAUGHT BY WIDGETS LIBRARY ╞═══════════════════════════════════════════════════════════
The following JSRangeError was thrown building FutureBuilder<Map<int, List<dynamic>>?>(dirty,
dependencies: [Directionality, MediaQuery, _ViewScope], state: _FutureBuilderState<Map<int,
List<dynamic>>?>#a9d1e):
Invalid argument: Invalid array length

The relevant error-causing widget was:
  SfPdfViewer
  SfPdfViewer:file:x
packages/flutter/src/widgets/async.dart 609:48                                                                      build
packages/flutter/src/widgets/framework.dart 5592:27                                                                 build
packages/flutter/src/widgets/framework.dart 5480:15                                                                 performRebuild
packages/flutter/src/widgets/framework.dart 5643:11                                                                 performRebuild
packages/flutter/src/widgets/framework.dart 5196:7                                                                  rebuild
packages/flutter/src/widgets/framework.dart 5666:5                                                                  update
packages/flutter/src/widgets/framework.dart 3824:14                                                                 updateChild
packages/flutter/src/widgets/framework.dart 6765:14                                                                 update
packages/flutter/src/widgets/framework.dart 3824:14                                                                 updateChild
packages/flutter/src/widgets/framework.dart 5505:16                                                                 performRebuild
packages/flutter/src/widgets/framework.dart 5196:7                                                                  rebuild
packages/flutter/src/widgets/framework.dart 5556:5                                                                  update
packages/flutter/src/widgets/framework.dart 3824:14                                                                 updateChild
packages/flutter/src/widgets/framework.dart 6765:14                                                                 update
packages/flutter/src/widgets/framework.dart 3824:14                                                                 updateChild
packages/flutter/src/widgets/framework.dart 5505:16                                                                 performRebuild
packages/flutter/src/widgets/framework.dart 5643:11                                                                 performRebuild
packages/flutter/src/widgets/framework.dart 5196:7                                                                  rebuild
packages/flutter/src/widgets/framework.dart 2904:18                                                                 buildScope
packages/flutter/src/widgets/binding.dart 989:9                                                                     drawFrame
packages/flutter/src/rendering/binding.dart 448:5                                                                   [_handlePersistentFrameCallback]
packages/flutter/src/scheduler/binding.dart 1386:7                                                                  [_invokeFrameCallback]
packages/flutter/src/scheduler/binding.dart 1311:9                                                                  handleDrawFrame
packages/flutter/src/scheduler/binding.dart 1169:5                                                                  [_handleDrawFrame]
lib/_engine/engine/platform_dispatcher.dart 1346:5                                                                  invoke
lib/_engine/engine/platform_dispatcher.dart 260:5                                                                   invokeOnDrawFrame
lib/_engine/engine/initialization.dart 185:36                                                                       <fn>
dart-sdk/lib/_internal/js_dev_runtime/private/ddc_runtime/operations.dart 550:37                                    _checkAndCall
dart-sdk/lib/_internal/js_dev_runtime/private/ddc_runtime/operations.dart 555:39                                    dcall

════════════════════════════════════════════════════════════════════════════════════════════════════
2
Another exception was thrown: Invalid argument: Invalid array length

On which target platforms have you observed this bug?

Web

Flutter Doctor output

Flutter (Channel stable, 3.19.2, on Microsoft Windows [Version 10.0.22631.4460], locale en-150)
• Flutter version 3.19.2 on channel stable at x
• Upstream repository https://github.com/flutter/flutter.git
• Framework revision 7482962148 (10 months ago), 2024-02-27 16:51:22 -0500
• Engine revision 04817c99c9
• Dart version 3.3.0
• DevTools version 2.31.1

[√] Windows Version (Installed version of Windows is version 10 or higher)

[√] Android toolchain - develop for Android devices (Android SDK version 34.0.0)
• Android SDK at x
• Platform android-34, build-tools 34.0.0
• Java binary at: x
• Java version OpenJDK Runtime Environment (build 17.0.10+0--11609105)
• All Android licenses accepted.

[√] Chrome - develop for the web
• Chrome at x

[√] Visual Studio - develop Windows apps (Visual Studio Enterprise 2022 17.11.6)
• Visual Studio at x
• Visual Studio Enterprise 2022 version 17.11.35431.28
• Windows 10 SDK version 10.0.22000.0

[!] Android Studio (version 2022.2)
• Android Studio at
• Flutter plugin can be installed from:
https://plugins.jetbrains.com/plugin/9212-flutter
• Dart plugin can be installed from:
https://plugins.jetbrains.com/plugin/6351-dart
X Unable to determine bundled Java version.
• Try updating or re-installing Android Studio.

[√] Android Studio (version 2024.1)
• Android Studio at x
• Flutter plugin can be installed from:
https://plugins.jetbrains.com/plugin/9212-flutter
• Dart plugin can be installed from:
https://plugins.jetbrains.com/plugin/6351-dart
• Java version OpenJDK Runtime Environment (build 17.0.10+0--11609105)

[√] VS Code (version 1.96.0)
• VS Code at x
• Flutter extension version 3.102.0

[√] Connected device (3 available)
• Windows (desktop) • windows • windows-x64 • Microsoft Windows [Version 10.0.22631.4460]
• Chrome (web) • chrome • web-javascript • Google Chrome 131.0.6778.140
• Edge (web) • edge • web-javascript • Microsoft Edge 128.0.2739.42

[√] Network resources
• All expected network resources are available.

[immankumarsync]

Hi @emiliecollinbluesoft, we are able to replicate the reported issue, that when upgrading the pdf.js version 'Invalid argument' exception occurs. Currently, we are validating the issue, and we will provide further details once we found the cause of the issue.

Could you please try the below script and check whether the worker issue is resolved or not with pdf.js version greater than 4.x.x?

  <script type="module" async>
    import * as pdfjsLib from 'https://cdnjs.cloudflare.com/ajax/libs/pdf.js/4.9.155/pdf.min.mjs';
    pdfjsLib.GlobalWorkerOptions.workerSrc = "https://cdnjs.cloudflare.com/ajax/libs/pdf.js/4.9.155/pdf.worker.min.mjs";
  </script>

Please note that using this script will not resolve the 'Invalid argument' exception.

[emiliecollinbluesoft]

Hi @immankumarsync , I can confirm that the script is working and like you mentionned it, the 'Invalid argument' exception is not resolved.

[immankumarsync]

Hi @emiliecollinbluesoft, As we are using the PDF.js library on the web platform to render PDF pages, our analysis found that the bytes used to create the 'PDFJsDocument' are being disposed of by the PDF.js library. This causes the "Invalid argument" error in the 'syncfusion_flutter_pdf' library. We have raised this query in the PDF.js repository and will provide a solution once we receive a response from them.

mozilla/pdf.js#19261

[emiliecollinbluesoft]

Solved with the today's update. Thanks.