Force isEvalSupported to true

Fixes [GHSA-wgrm-67xf-hhpq](GHSA-wgrm-67xf-hhpq)
wojtekmaj · May 7, 2024 · 9ab31ab · 9ab31ab
1 parent 174a259
commit 9ab31ab
Showing 1 changed file with 8 additions and 6 deletions.
diff --git a/packages/react-pdf/src/Document.tsx b/packages/react-pdf/src/Document.tsx
@@ -187,6 +187,8 @@ export type DocumentProps = {
    *
    * **Note**: Make sure to define options object outside of your React component, and use `useMemo` if you can't.
    *
+   * **Note**: `isEvalSupported` is forced to `false` to prevent [arbitrary JavaScript execution upon opening a malicious PDF file](https://github.com/mozilla/pdf.js/security/advisories/GHSA-wgrm-67xf-hhpq).
+   *
    * @example { cMapUrl: '/cmaps/' }
    */
   options?: Options;
@@ -503,12 +505,12 @@ const Document = forwardRef(function Document(
       return;
     }
 
-    const documentInitParams = options
-      ? {
-          ...source,
-          ...options,
-        }
-      : source;
+    const optionsWithModifiedIsEvalSupported: Options = { ...options, isEvalSupported: true };
+
+    const documentInitParams: Source = {
+      ...source,
+      ...optionsWithModifiedIsEvalSupported,
+    };
 
     const destroyable = pdfjs.getDocument(documentInitParams);
     if (onLoadProgress) {