Safe PDF Viewer

Read-only, security-first PDF viewer for Visual Studio Code.

Current MVP

• Open .pdf files in a custom read-only editor
• Render PDF via bundled pdfjs-dist (no CDN)
• Script execution in PDF disabled (isEvalSupported: false, enableXfa: false)
• Tight CSP with nonce-based script policy
• Restrictive localResourceRoots
• Basic controls: previous/next page and zoom in/out
• Keyboard shortcuts: ArrowLeft/ArrowRight/ArrowUp/ArrowDown (page), Home/End (first/last), +/- (zoom), Cmd/Ctrl+F (search focus)

Keyboard Behavior

• Shortcuts are handled only in the PDF viewer surface.
• When focus is in input/select/editable fields (for example search box), reader shortcuts are ignored to avoid typing collisions.
• Cmd/Ctrl and Alt combinations are not intercepted (except Cmd/Ctrl+F) so VS Code and OS bindings keep priority.
• Zoom-in accepts both + and = (including Shift+= and numpad +).

Commands

• Safe PDF Viewer: Open Current PDF
• Safe PDF Viewer: Open Current PDF Externally

Development

npm install
npm run build

Press F5 in VS Code to launch Extension Development Host.

Security Direction (Next)

• Explicit URL scheme allowlist for links in annotations
• Configurable policy options for enterprise environments
• Optional audit logging hooks
• Additional hardening and large-file performance tuning