Tiny Online Tools
Why a PDF has scripts at all
PDF has supported JavaScript since Acrobat 3. It is what makes a form add up a column, reject a badly formatted date, or grey out a field until a box is ticked. It is also what makes a malicious PDF worth sending.
Most tools that claim to detect PDF JavaScript look only at /Names /JavaScript. That is the document-level store, and in a real business form it is usually empty. The interesting code is bound to individual fields.
Every place this looks
/Names /JavaScript— the document-level name tree. It is a tree, not a list, so a tool that reads only the root array finds nothing in a file with many scripts./OpenAction— runs the moment the document opens, before you have read a word.- Document additional actions — before close, before and after save, before and after print.
- Page actions — on page open and page close.
- Annotation actions — the
/Aaction of a link or button, plus mouse-enter, mouse-exit, mouse-down, mouse-up, focus and blur. - Form-field actions — keystroke, format, validate and calculate. This is where the code actually lives in a form that does anything.
/AcroForm /CO— the calculation order, which decides which of two dependent totals wins.
Action chains through /Next are followed, because a tool that stops at the first link reads the harmless part and misses the handoff.
Observations, not verdicts
Calls like app.launchURL, this.submitForm, this.exportDataObject, Net.HTTP, eval and long runs of \uNNNN escapes are flagged as things worth reading the script for. None of them is proof of anything: a legitimate expense form calls submitForm, and a legitimate template calls util.printf. The flag tells you where to look.
Nothing is executed
Scripts are read out of the object graph as text and displayed. They are never evaluated, never injected into the page, and never fetched over the network. Copy one, save one as a .js file, or take all of them as a ZIP with a JSON report.
Privacy
The file is parsed entirely in your browser and never uploaded — which matters when the file you are inspecting is one you do not trust.