uViewDoc

PDF Architecture

The Portable Document Format (PDF) is notoriously complex, effectively functioning as a programming language (PostScript) compiled for print. Rendering it securely in a browser requires aggressive sandboxing.

The Engine: PDF.js

uViewDoc utilizes a customized, stripped-down build of Mozilla's pdf.js. Rather than relying on standard `` or `` tags which pass execution to the OS-level PDF viewer (often exposing local system vulnerabilities), pdf.js parses the binary stream entirely in JavaScript and renders it to a standard HTML5 <canvas> element.

Benchmark: On a standard M2 chip, a text-heavy 100-page PDF parses the initial page tree in ~12ms. Time to First Paint (TTFP) is typically under 150ms.

Security Posture

Standard PDFs can contain embedded JavaScript, external network calls, and complex form logic. Our implementation explicitly disables these features:

  • disableAutoFetch is strictly enforced to prevent network reconnaissance.
  • enableScripting is set to false. Embedded XSS vectors are neutralized at parse time.
  • Font rendering relies on local system fonts where possible, failing back to bundled standard fonts to prevent tracking pixels hidden in remote font requests.

Memory Management

For massive architectural drawings (e.g., 50MB+), the engine streams the file via the File API using ArrayBuffer chunks. Progressive rendering ensures the browser thread is not blocked, meaning a 1GB PDF will not crash the tab instantly, though scrolling may degrade depending on available RAM.