Answers.Body: <p>Most reading systems for epubs do not include JavaScript support at this time, so you're fairly safe. For those that do, the IDPF (International Digital Publishing Forum; they're the folks who make the epub standard) has a section on <a href="http://www.idpf.org/epub/30/spec/epub30-contentdocs.html#sec-scripted-content-security" rel="nofollow noreferrer">security in the epub 3.0 spec</a>. It pretty much lays the onus on the reading system developers to disable various avenues of attack. One thing of note is that all their points are phrased as &quot;reading systems should&quot; where <a href="https://www.rfc-editor.org/rfc/rfc2119" rel="nofollow noreferrer">&quot;should&quot; means</a>:</p>
  <blockquote>
  <p>that there may exist valid reasons in particular circumstances to
  ignore a particular item, but the full implications must be
  understood and carefully weighed before choosing a different
  course.</p>
  </blockquote>
  <p>So their security concerns may or may not be addressed by individual reading systems. It's a good bet that the major ones will play ball, though--particularly as most of them have someone in the IDPF.</p>
  <p>As far as downloading stuff from random places on the web--well, run a virus scan on anything you get and you'll probably be okay, but that's always riskier than going through &quot;official&quot; channels.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2014-02-14T21:43:45.083Z
Answers.Text: To add to Tom's answer: Apple probably disabled localStorage and, more prominently, network access from JS code in iBooks, for security reasons.
Answers.UserDisplayName: Alberto Pettarin
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2014-02-14T18:35:18.423Z
Answers.LastActivityDate: 2014-02-14T18:35:18.423Z
Answers.LastEditDate: 2021-10-07T07:05:27.390Z
Answers.UserDisplayName: Tom
Body: <p>I get eBooks and literature from a variety of places. Mostly legal places, like Amazon - but sometimes from other random places. </p>
  
  <p>PDFs are more popular and come with advanced capabilities, like JScript, that should be disabled in the name of security. </p>
  
  <p>Are there any known security issues for other e-Formats - like ePubs - or are there steps that should be taken to protect ones self? Mainly for when getting books from different sources and being used on Windows/Android/Kindle/etc?</p>
  
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2014-02-14T18:15:35.333Z
Comments.Text: Interesting (and long) read here: http://www.baldurbjarnason.com/notes/epub-javascript-security/
Comments.UserDisplayName: Jason Down
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2016-04-18T12:56:44.183Z
Comments.Text: [This link](http://www.idpf.org/epub/31/spec/epub-overview.html#sec-scripting) describes the scripting available in Epub 3.1 but I haven't found a reader yet that supports scripting. I suspect authors don't want to put in any scripting just in case something bad happens and the author gets blamed.
Comments.UserDisplayName: Bulrush
Tags: <epub><pdf><calibre><security>
Title: ePubs, PDFs and security
UserDisplayName: WernerCD
ThreadText: # ePubs, PDFs and security
  
  (Asked by: username_0 on 2014-02-14)
  
  I get eBooks and literature from a variety of places. Mostly legal places, like Amazon - but sometimes from other random places.
  
  PDFs are more popular and come with advanced capabilities, like JScript, that should be disabled in the name of security.
  
  Are there any known security issues for other e-Formats - like ePubs - or are there steps that should be taken to protect ones self? Mainly for when getting books from different sources and being used on Windows/Android/Kindle/etc?
  
  **Tags:** epub, pdf, calibre, security
  
  > **Comments:**
  > **username_1**: Interesting (and long) read here: http://www.baldurbjarnason.com/notes/epub-javascript-security/  
  > **username_2**: [This link](http://www.idpf.org/epub/31/spec/epub-overview.html#sec-scripting) describes the scripting available in Epub 3.1 but I haven't found a reader yet that supports scripting. I suspect authors don't want to put in any scripting just in case something bad happens and the author gets blamed.  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_3 on 2014-02-14. Score: 5 | Accepted answer
  
  Most reading systems for epubs do not include JavaScript support at this time, so you're fairly safe. For those that do, the IDPF (International Digital Publishing Forum; they're the folks who make the epub standard) has a section on [security in the epub 3.0 spec](http://www.idpf.org/epub/30/spec/epub30-contentdocs.html#sec-scripted-content-security). It pretty much lays the onus on the reading system developers to disable various avenues of attack. One thing of note is that all their points are phrased as "reading systems should" where ["should" means](https://www.rfc-editor.org/rfc/rfc2119):
  
  > that there may exist valid reasons in particular circumstances to
  > ignore a particular item, but the full implications must be
  > understood and carefully weighed before choosing a different
  > course.
  
  So their security concerns may or may not be addressed by individual reading systems. It's a good bet that the major ones will play ball, though--particularly as most of them have someone in the IDPF.
  
  As far as downloading stuff from random places on the web--well, run a virus scan on anything you get and you'll probably be okay, but that's always riskier than going through "official" channels.
  
  > **Comments:**
  > **username_4**: To add to Tom's answer: Apple probably disabled localStorage and, more prominently, network access from JS code in iBooks, for security reasons.  
  
  ---
  
  