528707 - navigator.plugins should not include nppdf32.dll when "Display PDF in Browser" is disabled. (Adobe Reader 9.x)

Status: RESOLVED INCOMPLETE

(Plugins Graveyard :: PDF (Adobe), defect)

Description

[rshimazu]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 6.0; ja; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 GTB5 (.NET CLR 3.5.30729)
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 6.0; ja; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 GTB5 (.NET CLR 3.5.30729)

In Adobe Reader 8 or below, if you uncheck "Display PDF in Browser", javascript detection by navigator.plugins for embedding has worked. But now in Adobe Reader 9.x, even if you uncheck "Display PDF in Browser", nppdf32.dll is detected.

The root cause seems to be that pluginreg.dat does not change itself at all even if users change the settings of "Display PDF in Browser".

This might be the bug of Adobe Reader but I believe Firefox can handle with this problem as well.

If users does not want site owners to detect if thy have installed Adobe Reader or not in their computers, how should they hide this fact?


Reproducible: Always

Steps to Reproduce:
1. Launch Adobe Reader 9 or above, and uncheck "Display PDF in Browser".
2. Launch Firefox. navigator.plugins still list Adobe Reader(nppdf32.dll).
3.
Actual Results:  
navigator.plugins still list Adobe Reader(nppdf32.dll).

Expected Results:  
navigator.plugins should not list Adobe Reader(nppdf32.dll) in this case.

Comment 1

[rshimazu]

Let me explain about this issue again from another perspective: security concerns.

Suppose you want to use Adobe Reader 9.x as a PDF viewer but you do not want to open PDF pages in the web, which might be embedded in malicious sites' HTML pages.

Even if you uncheck "Display PDF in Browser" in Adobe Reader 9.x, when it comes to PDF files embedded in HTML files, Firefox launches Adobe Reader, which in turn opens them automatically without asking anything to you.

In the case of HTML files which are not embedded in HTML files, as well, when you click the urls for PDF files, Adobe Reader launches itself and opens them. It is just fine. It is exactly the same as Adobe Reader 8.x. 

But now I am mainly talking about PDF files embedded in HTML files (which might be hidden). 
If you uncheck "Display PDF in Browser" in Adobe Reader 8.x, it is not launched by Firefox in the case of PDF files embedded in HTML files. But in Adobe Reader 9.x, it is launched by Firefox even in the case of PDF files embedded in HTML files. This may appear convenient to some people, but this will bring about security threats to some people.

So if you do not at all want to open any unreliable PDF files in the web, to uncheck "Display PDF in Browser" and to check if the link url points to PDF files is not just enough in Firefox. PDF files might be embedded in HTML files and you may be forced to open them against your will. 

Therefore, you may have to uncheck "Enable Acrobat JavaScript" or have to use other browsers like Internet Explorer. To uncheck "Display PDF in Browser" is not enough.

Comment 2

[Matthias Versen [:Matti]]

Why do you not just disable the acrobat plugin in Firefox (tools/addons/plugin) ?
unchecking "Display PDF in Browser" switches from displaying PDFs inline in Gecko to an external Acrobat Window and that seems to work as it should.

The Acrobat Reader should and have to remove the plugin from Firefox plugin directory if that setting should prevent Firefox from using the plugin 

I can not see something that have to be fixed on the Gecko part.

Comment 3

[rshimazu]

>The Acrobat Reader should and have to remove the plugin from Firefox plugin
>directory if that setting should prevent Firefox from using the plugin 

>I can not see something that have to be fixed on the Gecko part.

It may be true. Firefox can not rebuild pluginreg.dat in users' profile at all?

To tell the truth, my primary concern is that I can not detect by JavaScript if PDF files can be embedded or not in the combination between Firefox and the recent Adobe Reader. In my site, JavaScript in a HTML file communicates with a PDF. This is based on the presumption that the PDF is embedded in a HTML file.

So I have checked the value of navigator.plugins so far, but now I can not trust this method.

Comment 4

[Benjamin Smedberg]

Closing old bugs in the Plugins component. We aren't going to track issues in 3rd-party plugins in the Mozilla bug tracker. In addition, support for NPAPI plugins will be removed at the end of this year; for more details see the post at https://blog.mozilla.org/futurereleases/2015/10/08/npapi-plugins-in-firefox/

If there is a serious bug in Firefox, it needs to be filed in the "Core" product, "Plug-Ins" component.