Changes In Fdf Behavior; Examples Of Prevented Behavior - Adobe 22002484 Manual

Acrobat Family of Products
Security Feature User Guide

8.1.2 Changes in FDF Behavior

FDF files are data exchange files. Like acrobatsecurity files, they help you move certificate, server, and
other data from one machine to another. This data transfer usually involves some mechanism such as data
injection into a PDF form field, installing files, executing a script, and so on. These actions represent a
potential security risk, and in some environments that risk may be unacceptable. Enhanced Security
disables some FDF functionality unless those FDF files originate from a specifically privileged file, folder, or
server. Table 3
Table 3 Rules for opening a PDF via FDF
FDF
Action location
Opening a target PDF local
Opening a target PDF local
Opening a target PDF https
server
Opening a target PDF https
server
Data injection n/a
Data injection server
Data injection server
Data injection Varied
Script injection Any

Examples of Prevented Behavior

The following are examples of disallowed actions when Enhanced Security is on:
lists the high level rules defining FDF behavior.
Tip: If you need to configure your environment for enhanced security or need to troubleshoot
FDF workflows that may not be working as expected, see
PDF
location 8.x behavior
local PDF opens and no
authentication required.
http server PDF opens
http server PDF opens and no
authentication required.
local Blocked
n/a Allowed
browser Allowed
Application Allowed
Varied Allowed
Any Allowed
External Content and Document Security
Changes in FDF Behavior
"Enhanced Security" on page
9.x behavior
Same.
User authorization required unless trusted via
enhanced security feature.
Same.
Http hosted FDFs cannot open local files.
Allowed if:
Data retuned via a form submit with

url#FDF.
FDF has no /FDF key.

cross-domain policy permits it.

Allowed if:
Link to PDF contains #FDF=url.

FDF has no /FDF key.

x-domain policy permits it.

Allowed if:
PDF makes EFS POST/GET and FDF sends

data in https response to same PDF.
x-domain policy permits it.

Authorization required if enhanced security is on and
document is not set as a privileged location.
Injection is blocked unless if enhanced security is on
and FDF is not in a privileged location.
97
95.