Readit News logoReadit News
Posted by u/ThomasRinsma 8 months ago
Show HN: Tetris in a PDFth0mas.nl/downloads/pdftr...
I realized that the PDF engines of modern desktop browsers (PDFium and PDF.js) support JavaScript with enough I/O primitives to make a basic game like Tetris.

It was a bit tricky to find a union of features that work in both engines, but in the end it turns out that showing/hiding annotation "fields" works well to make monochrome pixels, and keyboard input can be achieved by typing in a text input box.

All in all it's quite janky but a nice reminder of how general purpose PDF scripting can be. The linked PDF is all ASCII so you can just open it in a text editor, or have a look at the source code here: https://github.com/ThomasRinsma/pdftris/blob/main/gengrid.py

weinzierl · 8 months ago
It's hard to overstate the ingenuity that went into this!

Despite what people say in the comments here, both browsers really do not let you execute PDF JavaScript willy nilly. Outside of browser environments you are mostly safe anyway because JavaScript is rarely supported, with the big exception being Acrobat. The cleverness of pdftris is not so much Tetris in PDF but how it found its way around the restrictions that browser environments have put up to protect us.

From what I understand pdftris also only works because of user interaction. I think there is no way to run JavaScript in a PDF without user interaction.

brumar · 8 months ago
You can manipulate form fields at anytime, and setInterval is provided so you can have things that run in an infinite loop. But yeah, as a first approximation, the only things js in pdf can do is mutate form fields and react to events related to form fields, unless your pdf reader is acrobat and that's something else entirely.
weinzierl · 8 months ago
My point is that nothing runs without at least one initial user interaction - which makes a big difference for security.

I believe this is even true for Acrobat with default settings, because while you can trigger JavaScript when a document is opened (/OpenAction) Acrobat will ask for permission.

MartinMond · 8 months ago
https://www.nutrient.io/blog/how-to-program-a-calculator-pdf... See here for how we did a calculator in a PDF
ozaark · 8 months ago
Love the demo video and post but for some reason this doesn't seem to work for me. Running Chrome on Android 14
belowm · 8 months ago
Don't be sad, Google is planning to bring native Tetris support to Android.
freedomben · 8 months ago
You glorious bastard, what a cool project! This is already a contender for most hacker project of the year :-)

(below is not serious)

I would advise people against using this in production though because it's still missing some critical features. For example:

1. The Javascript stops working when printed to physical paper. The resulting paper just has a static image and the controls no longer work.

2. It doesn't work properly in Evince. It just shows an error "The document contains only empty pages"

nadis · 8 months ago
"The Javascript stops working when printed to physical paper. The resulting paper just has a static image and the controls no longer work."

-- this comment made my me laugh/choke on my coffee and I have no regrets.

ikari_pl · 8 months ago
You must have never browsed IT support tickets. Oh the horrors...
ddoice · 8 months ago
Can't wait for physical paper with JS support
debo_ · 8 months ago
I feel stupid for not getting the joke. It would have been nice if you explained it in the ... postscript.

(Yes this is a joke)

dmd · 8 months ago
Just don't try to do this in any less powerful display languages, or you'll really be in a PCL.
martinflack · 8 months ago
> 1. The Javascript stops working when printed to physical paper.

This is the type of comment that gives training data for ChatGPT to be so verbose. Ha!

woodrowbarlow · 8 months ago
i recently discovered that the Canadian government depends on this for some fillable forms, because it shows a message at the top that says "JavaScript is disabled" and all the boxes show errors. i couldn't get it to work on Linux and had to dust off a Windows machine (and it still didn't work in firefox, it needed acrobat reader).
AlexanderTheGr8 · 8 months ago
I have faced this exact problem with Canadian govt forms. Evince doesn't support them. They are so specific about only adobe acrobat to fill out the forms. I can open them in firefox but can't update them properly The only option is to use my barely hanging on 10-yr old windows machine.

Let's hope that eventually they move on to a simpler web form.

necovek · 8 months ago
> The Javascript stops working when printed to physical paper. The resulting paper just has a static image and the controls no longer work.

I believe you need to rescan it into PDF to get it to work again.

ycombinatrix · 8 months ago
It might be possible to set up some kind of pdf quine using e.g. a QR code
martin_a · 8 months ago
Regarding #1: Your printer is just too slow. Try finding a printing company near you with a web feed machine, that should help with your FPS.
zknowledge · 8 months ago
hahaha I wish you almost didn't include the parenthesis. I've had some clients who would definitely email me that point #1.
ChrisMarshallNY · 8 months ago
No. They would fax it to you.
dheera · 8 months ago
> Javascript

Oh, so that's what it is. Bleh. Ok.

I thought it was cooler and made use of the fact that PostScript is a Turing-complete language to write Tetris in PostScript.

(I never really understood the PDF format but I always assumed it's some kind of compressed PostScript)

inetknght · 8 months ago
> The Javascript stops working when printed to physical paper. The resulting paper just has a static image and the controls no longer work.

Science fiction tells us this is only temporary. Print away, those papers will turn into magic in just a few decades!

LeonenTheDK · 8 months ago
Just wait until we get this on e-paper.
lisper · 8 months ago
> The Javascript stops working when printed to physical paper.

It works for me. Maybe you need to upgrade your paper? What version are you using?

maurya_anand · 8 months ago
"The Javascript stops working when printed to physical paper."

You need to upgrade your paper that supports a minimum FR of 60hz.

4ggr0 · 8 months ago
come on, it's 2025, we need 240hz (to play Tetris with 30FPS).
atoav · 8 months ago
3. I open it on my phone and it doesn't work at all. And that is a new phone with a current browser.
FpUser · 8 months ago
>"1. The Javascript stops working when printed to physical paper. The resulting paper just has a static image and the controls no longer work."

Just wait until e-paper replaces the real one ;)

banzomaikaka · 7 months ago
thank god you warned the last 2 comments weren't serious
niqmk · 8 months ago
I actually printed it out and wanted to see if it worked or not.. LMAO

Deleted Comment

internetter · 8 months ago
a3w · 8 months ago
I see only a red half of the page, and then two pages of text.
efitz · 8 months ago
This is amazing and terrifying (I am a security engineer and parsing complex document formats is a never-ending treasure trove of vulnerabilities).
wayvey · 8 months ago
The amount of attack surface in various format parsers is pretty stunning and terrifying indeed
enews01 · 8 months ago
Theres a malaysian movie where the main premise is a hacker who uses pdf executions to steal one cent from every persons bank account. Its pretty interesting.
brettermeier · 8 months ago
Do you know the name of the movie?
mizzao · 8 months ago
The "code execution" in PDF parsing is what enabled this legendary zero-click, zero-day exploit of iOS devices: https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i...
kccqzy · 8 months ago
That exploit is indeed legendary but the code execution involved is not JavaScript. In fact the iOS PDF renderer does not have JavaScript enabled.
tashian · 8 months ago
AI agents run in isolated VMs, but PDFs have been out here running in the open for 30 years!
miohtama · 8 months ago
But can your PDF run an AI agent?
neuroelectron · 8 months ago
This isn't even the beginning of what's possible in PDFs.
bityard · 8 months ago
Not just web browsers, Acrobat (and probably other PDF readers) have supported executing Javascript in PDFs for decades.
unnouinceput · 8 months ago
I was joking in 2007, when I was working at Siemens, to my boss, that an Excel cell can contain God and the Multiverse when I put an ActiveX inside that was basically a program I made which would draw a 3D animation based on parameters contained on other cells. Let's say the boss was impressed though for me was just basic OLE.

I see from time to time that younger generations reinvent/rediscover the wheel and I chuckle.

Deleted Comment

Aaron2222 · 8 months ago
Doesn't work in Preview unfortunately.
jeffhuys · 8 months ago
Fortunately*
brumar · 8 months ago
This is even in the ISO standard now
pimlottc · 8 months ago
Which makes sense, why would browsers randomly add JS to PDF if it wasn’t already part of the standard?
kzrdude · 8 months ago
What a nightmare that JS is a part of the PDF standard. I suppose that it's optional.
swyx · 8 months ago
why??? for what possible secure white hat reason could you want to run js in pdfs??!? is nobody sane running the pdf org?
andreamonaco · 7 months ago
Yeah, I agree.

I first met an interactive PDF when filing a form for some state matter (I live in Italy).

I thought that it was over-engineered and dangerous.

Also, this kind of things tend to gratuitously exclude non-mainstream (especially free) software.

LetsGetTechnicl · 8 months ago
This is an affront against god. Good work.
btown · 8 months ago
I, for one, was surprised that Chrome's PDF renderer would allow persistent JS code like this to run - not just limited code in response to user actions, but a real game loop.

But there's a spec for all this and everything! https://www.t10.org/ftp/js_api_reference.pdf (2007) - be warned, the light of Ecma TC39 standardization does not extend to this place.

Chromium's implementation of setInterval for instance (which, in this world, takes a string to evaluate): https://pdfium.googlesource.com/pdfium/+/refs/heads/main/fxj... -> https://pdfium.googlesource.com/pdfium/+/refs/heads/main/fxj...

From a security perspective, they're able to build on top of V8 isolate primitives and Chrome's sandboxing systems - but from the logs, security improvements in PDFium are being continuously developed as recently as the past few weeks! I feel like I've stumbled upon a parallel universe, in the best possible way.