Merge pull request #1092 from shamoon/update-pdfjs

Chore: update pdfjs to 3.11.174, resolve CVE
VadimDez · May 14, 2024 · 1280c5f · 1280c5f
2 parents d1b0301 + 9148eec
commit 1280c5f
Show file tree

Hide file tree

Showing 4 changed files with 16 additions and 12 deletions.
diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -39,7 +39,7 @@
   },
   "homepage": "https://github.com/VadimDez/ng2-pdf-viewer#readme",
   "dependencies": {
-    "pdfjs-dist": "^3.10.111",
+    "pdfjs-dist": "^3.11.174",
     "tslib": "^2.3.0"
   },
   "devDependencies": {

diff --git a/src/app/pdf-viewer/pdf-viewer.component.spec.ts b/src/app/pdf-viewer/pdf-viewer.component.spec.ts
@@ -114,7 +114,8 @@ describe('AppComponent', () => {
         url: src,
         cMapUrl,
         cMapPacked: true,
-        enableXfa: true
+        enableXfa: true,
+        isEvalSupported: false,
       });
     });
 
@@ -126,7 +127,8 @@ describe('AppComponent', () => {
         url: src,
         cMapUrl,
         cMapPacked: true,
-        enableXfa: true
+        enableXfa: true,
+        isEvalSupported: false,
       });
     });
 
@@ -139,7 +141,8 @@ describe('AppComponent', () => {
         url: srcUrl,
         cMapUrl,
         cMapPacked: true,
-        enableXfa: true
+        enableXfa: true,
+        isEvalSupported: false,
       });
     });
   });

diff --git a/src/app/pdf-viewer/pdf-viewer.component.ts b/src/app/pdf-viewer/pdf-viewer.component.ts
@@ -466,8 +466,9 @@ export class PdfViewerComponent
     const params: any = {
       cMapUrl: this._cMapsUrl,
       cMapPacked: true,
-      enableXfa: true
+      enableXfa: true,
     };
+    params.isEvalSupported = false; // http://cve.org/CVERecord?id=CVE-2024-4367
 
     if (srcType === 'string') {
       params.url = this.src;