External Content Access

Internet access

Your application can inform you when a PDF file is attempting to connect to an Internet site. Opening a Web page represents a security risk because malicious content can be transferred whenever a PDF communicates with the Internet. In addition to visible links in a PDF document, form fields can contain hidden JavaScript calls that open a page in a browser or silently requests data from the Internet.

Configuration

With enhanced security enabled, files and folders in privileged locations allow internet access even if Trust Manager is set to “Block all.” Also, cross domain access always requires specifically trusting those domains as a privileged location in the Enhanced Security panel–simply trusting those sites in the Trust Manager will not work.

Internet access panel

To control web site access behavior:

1. Choose Preferences > Trust Manager.

2. Choose Change Settings in the Internet Access… panel.

3. Choose whether to allow, block, or create custom settings for PDF access to web sites.

4. Choose OK.

Manage Internet Access dialog

If you choose the custom settings option, the Web Sites panel becomes active and you can enter unique URLs. URLs must begin with www and end with a valid suffix. The Acrobat family of products maintains a white and black list of URLs called the Trust List. Users can specify whether or not URL access is allowed on a global or per-URL basis.

Manage Internet Access dialog

For URLs that aren’t explicitly trusted or blocked (they are not on the white or black list), a warning appears whenever a document tries to access the Internet. When you check Remember my action for this site, the site is added to your URL white or black list.

Blocked URL alert

External connection warning

Multimedia (legacy)

Multimedia poses a security risk because it could potentially change the document’s appearance or present security holes through multimedia players. There are two types of multimedia, and application behavior varies with each type:

• Legacy multimedia: Any multimedia content which uses 3rd party multimedia plug-ins for playing content is legacy multimedia. The Yellow Message Bar appears on playing the legacy multimedia.

• Default supported multimedia: Any multimedia content which uses the Authplay.dll for playing content is defined as non-legacy multimedia. Files like .flv and h.264 encoded files play by default. The Yellow Message Bar doesn’t appear in the presence of these media types.

Configuration

To configure multimedia preferences:

1. Choose Preferences > Multimedia Trust (legacy).

2. Configure the Trust Options panel:

   1. Check or uncheck Allow multimedia operations.

   2. Set multimedia player permissions as follows: Select the player in the list and select an option from the Change permission for selected multimedia player to drop-down list:

      • Always: The player is used without prompting.

      • Never: Prevents the player from being used.

      • Prompt: Prompts the user to enable the player when a media clip tries to use that player.

   3. Select one or more of the playback options:

      • Allow playback in floating window with no title bars: Opens the media in a separate window without a title bar.

      • Allow document to set title text in a floating-playback window: Opens the media in a separate window with a title bar.

      • Allow playback in full-screen window: Opens the media in full-screen mode.

3. Choose OK.

Note

Membership on the trusted document list is permanent until the list is manually cleared. Choose Clear to remove all documents from that list.

XObjects

The application can inform you when a PDF file tries to access external content identified as a stream object by flags which are defined in the PDF Reference. For example, an URL might point to an image external to the document. Only PDF developers create PDF files with streams, so you may not need to enable access to external content. This feature interacts with enhanced security as shown below:

XObjects and enhanced security

XObject setting	Enhanced Security	Behavior
Never	On	No XObject access; proxy displays, if any.
Never	Off	No XObject access; proxy displays, if any.
Always	On (w/ privileged location set)	XObject displays.
Always	Off	No XObject access; proxy displays, if any.

To configure external content access:

1. Choose Preferences > Page Display.

2. Configure the Reference XObjects View Mode panel. Set Show reference XObject targets to:

   • Always

   • Never

   • Only PDF/X-5 compliant ones

3. Set the location of referenced files (if any).

4. Choose OK.

Resource access

3D content

3D content is disabled by default. However, users can enable it via the checkbox at Preferences > 3D and Multimedia > Enable 3D Content. 3D content has been integrated into the Trust Framework so that it’s possible to display 3D content for files residing in a privileged location even when 3D is disabled. The feature allows you to:

• Disable or enable 3D content.

• Lock the setting so users cannot change it.

• Trust files, folders, and hosts as privileged locations via Preferences > Security (Enhanced) > Privileged Locations panel so that when a PDF with 3D content opens:

  • If it is trusted, the 3D content renders.

  • If it is not trusted, a Yellow Message Bar appears which states that the file might pose pose a security risk. The Options button provides options for trusting once or always. Trusting the document for always adds the file to the privileged locations list and sets a registry entry under \TrustManager\cTrustedFolders\cTrustedFor3D.

Preference paths:

• End user: HKCU\Software\Adobe\(product)\(version)\3D\b3DEnableContent.

• Lockable setting:

  • 32-bit: HKLM\SOFTWARE\Policies\Adobe\(product)\(version)\FeatureLockDown\bEnable3D

  • 64-bit: HKLM\SOFTWARE\Wow6432Node\Adobe\(product)\(version)\FeatureLockDown\bEnable3D

Flash integration

Note

Acrobat products do not use Flash in any part of the product. Embedded Flash content may play in a PDF if that feature is not disabled; however, that capability is likely to be disabled in 2018.

Adobe Reader and Acrobat stopped shipping with a dedicated Flash player in version 9.5.1, . Since then, rendering Flash content in a PDF requires that a Flash Player already reside on users machine. This strategy simplifies Acrobat and Reader deployments by reducing the number of future required updates should a security issue arise.

When users open a PDF that requires Flash, a dialog prompts them to download and install the latest Flash player. To preinstall Flash, go here:

• Windows: Adobe Reader and Acrobat Flash Player Download for Windows

• Macintosh: Adobe Reader and Acrobat Flash Player Download for Mac

Control whether Flash plays within PDFs by setting the bEnableFlash registry entry (Win) or EnableFlash plist entry (Mac). When bEnableFlash = 0, Flash content is rendered as an empty, white box and does not play. A yellow message bar also appears at the top of the document stating that “Some features are disabled to avoid potential security risks.” When bEnableFlash = 1, Flash plays if there is a system player present. If a player is not found, then the user is prompted to download the latest version.

Preference paths:

• 32-bit: HKLM\SOFTWARE\Policies\Adobe\(product)\(version)\FeatureLockDown\bEnableFlash

• 64-bit: HKLM\SOFTWARE\Wow6432Node\Adobe\(product)\(version)\FeatureLockDown\bEnableFlash

• Macintosh: Contents::MacOS::Preferences << FeatureLockdown << /EnableFlash  [ /b false ] >>

Note

A file residing in a privileged location cannot override this preference.

PDF Links

With the March, 2018 release, it is possible to block PDF actions which result in following and opening links in a PDF. For details, see the Preference Reference.