Set isEvalSupported to false to prevent arbitrary code execution.

learningequality · Nov 6, 2024 · 7d43f77 · 7d43f77
1 parent d687ccb
commit 7d43f77
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/kolibri/plugins/pdf_viewer/assets/src/views/PdfRendererIndex.vue b/kolibri/plugins/pdf_viewer/assets/src/views/PdfRendererIndex.vue
@@ -291,6 +291,7 @@
       const loadingPdf = PDFJSLib.getDocument({
         url: this.defaultFile.storage_url,
         worker: this.worker,
+        isEvalSupported: false,
       });
       // pass callback to update loading bar
       loadingPdf.onProgress = loadingProgress => {