As I mentioned some time ago we wan perform several actions with a PDF file. One of them is application execution, which we can use on different platforms like Windows, Unix or Mac.In order to check the potential of this functionality I'm going to modify a basic PDF. First of all we must include an action trigger, when we open the document, for example. For this task we have to put an /OpenAction element in the document catalog, pointing to an object that will be the /Launch action which will execute the desired application. The action object can include the following elements:

• /S: this is an obligatory parameter of name type that specifies the object action type. In this case its value will be /Launch.
   
• /F: if the elements /Win, /Unix or /Mac are absent this parameter is obligatory and specifies the application or file path that we want to execute or print. This is something I haven't mention but with this action we can print documents too, but only in Windows systems for the moment.
   
• /Win: it's an optional dictionary that contains specific entries for this operating system. We can find another /F element with the same functionality as the other one, /D to indicate the default directory, /O to specify if we want to 'open' or 'print' (being the former the default one) and /P to put the application arguments.

  

• /Unix and /Mac: theoretically they are the same type of elements as /Win, but nowadays they are not specified officially. To launch an application on these platforms we should indicate the application path in the global /F, at least in the case of Linux, where it doesn't work with evince or KPDF but yes with xpdf. Besides these problems the execution through the /OpenAction element does not run either, so we have to put a trigger when the mouse clicks on an annotation, for example. This is an example:

  

When we trigger the action in both operating systems, Linux and Windows, a warning window appears, asking the user if it's OK. You can download this sample to check it out.

With xpdf we must always answer this question but in Acrobat Reader 8.1.2 exists the option of "Not ask again", choosing the comfort of the user and against his security. I can imagine a quite real scenario where the user could choose to mark this box in order to avoid answering again and again.

Someone could spoof one of his friends and send an email with a PDF that launches a beautiful PPT. Maybe the first time he receives the email he won't mark the box but after receiving some more he'll do it (that annoying window!!). At this moment it will be possible to execute any application without any warning...Maybe downloading and launching a trojan?? Here you can find a PDF file launching calc.exe.

In the version 8.1.2 of Acrobat Reader we can avoid it by unchecking a box (checked by default) in the preferences menu and that permits to launch external applications to open embedded files.

As you can see PDF files are not inoffensive at all, in following posts I'll try to tell you more about its dark side.

myPDF_launch_win.pdf (Windows PDF sample launching calc.exe)
myPDF_launch_linux.pdf (Linux PDF sample launching gedit, only for xpdf)