How to remove URL embedded in PDF document? (dialog "the document is trying to connect to" appears)

Question

I have an Adobe PDF document which when opened displays a warning dialog with the words "the document is trying to connect to" followed by a certain URL.

I choose the "Block" option to try to be safe.

But I'd rather not have this dialog displayed at all, or for the PDF document itself to contain the URL. Connecting to the URL is unnecessary for the document to be useful - it's contents can still be read when "Block" is chosen.

I'm not looking for a solution that addresses the symptom - i.e. the dialog - so I'm not looking for a solution that simply says something like: "change security settings to block on default" or something like that.

The solution I am looking for is to simply remove the URL mentioned in the dialog, from the actual PDF document, so that the dialog never occurs.

My first attempt at this solution was to open the PDF in the Notepad++ text editor (any text editor would suffice, if it has search). Then I searched for the URL mentioned in the warning dialog.

Here is the snippet of the PDF code from the PDF document itself, showing the URL

This only occured once in the document. So I experimented with removing various bits: just the URL to leave () and then the whole snippet.

In all experiments with removing the URL and associated code, the warning dialog disappeared but instead Adobe Reader reported:

"the file is damaged but is being repaired"

and the PDF file still loaded and was displayed.

But obviously I'm looking for a solution that removes the URL without causing this other dialog to occur. Presumably my manual edit disturbed the code somehow, maybe a checksum or a offset position value became inconsitent with the actual position of some code.

So, is there a utility to strip/filter/remove such embedded URLs in PDFs with the resultant document intact without errors?

(By the way, I had to show the code snippet as a image as the it would not get displayed completely due to the double angled equality brackets being interpreted as markup I guess. The URL given was an example to illustrate the problem and not the actual one seen.)

Answer 1

PDF file contains a table with file offsets at the end, and they go wrong if you remove the URL.

You can replace it with spaces, preserving the count of characters (preferably in hex editor), and it should work fine.

Overwrite the

/S/URI/(http://....afile.exe)

with spaces and leave the braces around intact, like this:

7210 0 obj
<<                                            >>
endobj xref

(it's the "object reference", you don't want to change it because the offset table would go wrong)

Or, you can look for a PDF editor, but I believe this would be overkill.

Please post your results :)

Answer 2

To answer my own question, a colleague just suggested another solution would be to print the PDF to a file - the resultant output file being in the format of PDF. The process of printing might sanitise the contents and remove the URL call.

An example print to file PDF "virtual printer" is the very good free open source PDF forge http://www.pdfforge.org/ This installs like a printer driver and is available in the standard Windows choice of printers via the Control Panel and as a printer in the list offered by Windows Applications that print stuff - such as Adobe PDF Reader :)

I'll give it a go and let you know...

Answer 3

Both PDF-XChange Viewer and PDF-XChange Editor by tracker-software are able to add and delete links in their respective free versions (not limited to private use). Just hit Tools >> Link Tools and boxes will highlight areas with embedded links. Of course this is not an option to discard hundreds of links in huge documents.

Answer 4

Well I can give you a little help. PDFs are in a binary format, and most binary formats use byte counting to separate records instead of newlines. In other words, you can't change the filesize without making all of the counts wrong. Whatever you replace that url with had better be the same size. If you were willing to invest some time in studying the file format, you could remove it, then adjust the appropriate "counts," but no guesses as to where those are. Or, you could learn another PDF command that was innocuous and could be coerced to the same size as any url.

Or you could find a PDF editor to do the magic for you. This sounds like the easiest to me.

Answer 5

If you have Acrobat Pro 9 try:

1. Open the PDF file in AP9 and block any net access attempts.

2. Click File Menu / Properties / Security Tab / Enter 'Security Method' = [No Security] (if you can)

3. Click Advanced Menu / Document Processing / Edit All Javascripts

4. Check for the URL in the code box, then if it exists:

Remove the Javascript functions but not the XML tags.

In my case I removed the code between (and not including):

/* * * * * * * * * * * belongs to: Document-Actions:Document Open * * * * * * * * * * */

and the next

//< /ACRO_script>

Click [OK] then look for external hyperlinks in the document and use the link tool on the Advanced Editing Toolbar to highlight them, and the Del key to delete them (the text of the link will remain).

If this is not correct for you it should hopefully provide some clues.

Answer 6

In case someone is still looking for a solution in Linux:

pdftocairo -pdf file_with_links.pdf file_without_links.pdf