I need help - I can help - ESET AV And Fillable Forms

ESET AV And Fillable Forms

Printed From: Debenu Quick PDF Library - PDF SDK Community Forum
Category: For Users of the Library
Forum Name: I need help - I can help
Forum Description: Problems and solutions while programming with the Debenu Quick PDF Library and Debenu PDF Viewer SDK
URL: http://www.quickpdf.org/forum/forum_posts.asp?TID=3746
Printed Date: 02 May 24 at 3:19PM
Software Version: Web Wiz Forums 11.01 - http://www.webwizforums.com

Topic: ESET AV And Fillable Forms

Posted By: André Labuschagné
Subject: ESET AV And Fillable Forms
Date Posted: 29 Sep 19 at 12:06PM

Hi All

We have a showstopper with ESET AV. As soon as we declare a Global JavaScript package it reads the pdf as a trojan virus. Has anyone seen this before?

Cheers

André

Replies:

Posted By: Ingo
Date Posted: 29 Sep 19 at 2:04PM

the only possible action is to call ESET AV with the description of your issue to make a future ESET AV more accurate.
In the past (very past past ;-) i've made several trys with exe- and dll-compressors. There i've got similar actions from av-tools ;-)
The question is:
Is the javascript package the problem (perhaps you can remove some functionalities) or is the GetGlobalJavaScript-syntax from QuickPDF the problem?

-------------
Cheers,
Ingo

Posted By: André Labuschagné
Date Posted: 29 Sep 19 at 4:06PM

Hi Ingo

I have actually been in contact with them a week ago and sent them the pdf to check for a false positive and they came back clueless. Go figure. I was completely gobsmacked. IMHO AV programmers are clueless. It is their algorithm. They should know what the heck they wrote and why their algorithm is not happy with the javascript. They have requested a before and after example and I have tracked it to perfectly acceptable Acrobat JS without which these fillable forms would not exist. These functions cannot be removed. I am going to send that to them first thing tomorrow morning.

It is not the get global as I have rebuilt the entire pdf without any javascript call to any global scripts. It is failing on the set global. Maybe there is something wrong in there - I will play around with the very first one and revert if I get it sorted. I doubt that Foxit have got it all wrong. I know of developers who use fillable forms with Foxit and the very reason why we have joined the club.

Thanks for the input.

Cheers

André

Posted By: André Labuschagné
Date Posted: 29 Sep 19 at 6:09PM

Hi Ingo

I have found where ESET is gong south - SetOpenActionJavaScript(TheJavascript) - it does not like either the running of a script on file open or the code itself. All I am doing is setting :

commitOnSelChange to true

for the combos.

Maybe it does not like the syntax or the concept of running the code when the document is open.

Will keep you posted.

Cheers

André

Posted By: André Labuschagné
Date Posted: 29 Sep 19 at 10:53PM

Hi Ingo

Well, well, well. In my estimate ESET is pretty buggy. I introduced the javascript into the pdf bit by bit and now it is happy with the pdf. Nothing else has changed. Will send this pdf to ESET as well.

You gotta just love AV products.

Cheers

André

Posted By: Ingo
Date Posted: 30 Sep 19 at 9:55PM

Hi Andre,

please keep in mind that users of pdf-readers are able to deactivate javascript code for some security reasons...
http://pdfcomments.blogspot.com/2012/04/my-dear-readers-regarding-trojan-and.html

-------------
Cheers,
Ingo

Posted By: André Labuschagné
Date Posted: 02 Oct 19 at 1:01PM

Hi Ingo

Thanks for that - we are aware of that and warn them before hand. The interesting thing is that it worked and then did not work and then did again with zero changes to the AV. We now have a direct line into the ESET developers and have sent them the one attracting the block and the one not attracting the block. Both of course have javascript in it. Weird stuff. Have not heard from them but will revert if and when we do.

And thanks for the link.

Cheers

André