Ghost JavaScript and ghost Document Action enigma

[JR Boulay]

Hi experts.

Today I received a strange PDF document, when it is opened it automatically launch the Print command.

So I tried to remove this unwanted Action with Acrobat Pro DC.

But I cannot find it, it can only be seen in JavaScript : All JavaScript, and it's labelled "Belong to: Document-Actions : Document Open" (see screengrabs), and it's not a Page Action.

I never heard about a Document Action named "Document Open", I cannot find it in the Acrobat UI nor in the SDK JavaScript Reference…

The only clue I have is the document creator : Skia/PDF

Did I mess something obvious or is it a real mystery?

You can download this PDF here: Shared Files - Acrobat.com

[try67]

It's just the internal name of that doc-level script. I've seen it happen in the past that such scripts that were applied using external tools don't show up in the Document JavaScripts window (probably because they were not defined completely correctly), but they still execute when the file is opened.

[JR Boulay]

It's just the internal name of that doc-level script.

Did you try to remove this script?

I cannot: I can delete it and save the PDF, and when I reopen the PDF it's still here…

[Bernd Alheit]

JR_Boulay  wrote

It's just the internal name of that doc-level script.

Did you try to remove this script?

I cannot: I can delete it and save the PDF, and when I reopen the PDF it's still here…

The file without the script:

Shared Files - Acrobat.com

[George_Johnson]

There is a document open action, but Acrobat has never provided a UI for setting an action for it. See the PDF Reference for more info (OpenAction).

[JR Boulay]

See the PDF Reference for more info

As you can see on the screengrab above, there is nothing about a "Document Open" action in the PDF Reference.

[Karl Heinz Kremer]

Your screenshot shows the JavaScript API documentation, not the PDF specification.

in the 1.7 version of the spec, it’s in table 28

[George_Johnson]

It's been around for a long time, before forms and JavaScript were added to the spec. I know that it was supported for JavaScript placed there in Acrobat/Reader 4, not certain about before that. With JavaScript, it's not really needed since we can use document-level scripts to execute code on document open, but it was a sneaky way to hide code that we didn't want people messing with easily, as well as other types of actions. There was a malicious PDF (Peachy) that used this technique, and because it used OpenAction for which there's no UI in Acrobat for viewing/editing such actions, there was a lot of consternation.

[JR Boulay]

Thank you to all.

Now I am less ignorant.