Bug 103603 - PDF exported with Writer warning "Contains an open action to be performed when the document is viewed."
Summary: PDF exported with Writer warning "Contains an open action to be performed whe...
Status: RESOLVED NOTOURBUG
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: filters and storage (show other bugs)
Version:
(earliest affected)
5.1.4.2 release
Hardware: All All
: medium enhancement
Assignee: Not Assigned
URL:
Whiteboard:
Keywords:
Depends on:
Blocks: PDF-Export
  Show dependency treegraph
 
Reported: 2016-10-31 14:35 UTC by leigh.tate
Modified: 2017-12-25 09:35 UTC (History)
4 users (show)

See Also:
Crash report or crash signature:


Attachments
screenshot of not passing the VirusTotal scan (71.61 KB, image/jpeg)
2016-11-04 12:39 UTC, leigh.tate
Details
PDF that didn't pass the scan (1.25 MB, application/pdf)
2016-11-04 16:23 UTC, leigh.tate
Details
Excerpt from original document causing the problem (149.33 KB, application/vnd.oasis.opendocument.text)
2017-06-03 09:30 UTC, leigh.tate
Details

Note You need to log in before you can comment on or make changes to this bug.
Description leigh.tate 2016-10-31 14:35:15 UTC
Description:
This is an enhancement request.

I recently had to submit a pdf to a group which first required it be scanned at www.virustotal.com. The pdf could not pass the scan because it contained an open action. 

The same file passed the scan if converted to pdf from either Abiword or Word. 

Actual Results:  
Convert any LO Writer created document to pdf. Will not pass the scan at VirusTotal.

Expected Results:
Pass the scan at VirusTotal.


Reproducible: Always

User Profile Reset: No

Additional Info:


User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:49.0) Gecko/20100101 Firefox/49.0
Comment 1 Heiko Tietze 2016-11-04 11:26:06 UTC
Normal PDF pass the test (tried with inbuilt dummy text). No idea what you mean with "open action" but a) you have plenty of options to save a PDF, and b) competitors may delete the action. Anyway, it would be good to attach an example file, at best stripped down to the actual issue.
Comment 2 leigh.tate 2016-11-04 12:39:27 UTC
Created attachment 128485 [details]
screenshot of not passing the VirusTotal scan

If your pdf passed the VirusTotal <https://www.virustotal.com/> scan and mine didn't, then perhaps it had to do with my settings for exporting the pdf. I used the default settings and my scan results are shown in the attached screenshot. My pdf didn't fail but it didn't pass either. 

As starred and highlighted in pink on the screenshot:

"This PDF file contains an open action to be performed when the document is viewed. Malicious PDF documents with JavaScript very often use open actions to launch the JavaScript without user interaction."

I can use the exact same file to create a pdf in either Abiword or Word and those give me a green pass with no open action warning. 

What export-to-pdf settings did you use to pass the VirusTotal scan?
Comment 3 Heiko Tietze 2016-11-04 14:46:35 UTC
(In reply to leigh.tate from comment #2)
> What export-to-pdf settings did you use to pass the VirusTotal scan?

I used the default:
JPEG compression 90%, 150dpi
PDF form FDF, bookmarks, placeholders (everything else off)
(document had no formatting, no fields, no variables etc., just the dummy text)

Better you attach a document, either odt or pdf.
Comment 4 leigh.tate 2016-11-04 16:23:11 UTC
Created attachment 128491 [details]
PDF that didn't pass the scan

Attached is the pdf that gave the results in the previous screenshot.
Comment 5 Heiko Tietze 2016-11-05 08:51:48 UTC
Tried with a ToC and with links to external resources, nothing leads to a problem at virustotal. And when I run the test with your file it neither complains.

Let's see if the experts have an idea -> NEW.
Comment 6 Cor Nouws 2016-11-05 12:46:38 UTC
PDF export can vary from application to application.
IMO a simple NotOurBug.
But if we would want to look at details, then the specific file is needed.
Comment 7 QA Administrators 2017-05-31 10:51:21 UTC Comment hidden (obsolete)
Comment 8 Xisco Faulí 2017-05-31 15:51:03 UTC Comment hidden (obsolete)
Comment 9 leigh.tate 2017-06-03 09:30:15 UTC
Created attachment 133821 [details]
Excerpt from original document causing the problem

The original odt text is for an eBook which size exceeds Bugzilla's file size limit. This is one of the four sections with photos removed to meet that requirement.
Comment 10 QA Administrators 2017-12-04 12:45:38 UTC Comment hidden (obsolete)
Comment 11 Buovjaga 2017-12-18 16:29:07 UTC
(In reply to leigh.tate from comment #9)
> Created attachment 133821 [details]
> Excerpt from original document causing the problem
> 
> The original odt text is for an eBook which size exceeds Bugzilla's file
> size limit. This is one of the four sections with photos removed to meet
> that requirement.

I got "No engines detected this file".
Settings are the default, because I had reset my profile.

Are you really still getting results with Virustotal? It might be that some scanners fixed their heuristics or false positives.

Arch Linux 64-bit
Version: 6.1.0.0.alpha0+
Build ID: b2d87e00ed93db79ba64a9bef83e20d44c69dd7c
CPU threads: 8; OS: Linux 4.14; UI render: default; VCL: kde4; 
Locale: fi-FI (fi_FI.UTF-8); Calc: group threaded
Built on December 18th 2017
Comment 12 Timur 2017-12-25 09:35:52 UTC
Title was misleading. There's no "virus" and count is 0. This document exported to PDF passes. 
"Details" gives a warning for PDF: "Contains an open action to be performed when the document is viewed."
I guess it's bookmarks like in https://helpx.adobe.com/acrobat/using/applying-actions-scripts-pdfs.html. 
I close the bug.