From 37426d0c48a3c1ecb1409bbbc09bab136b098a6c Mon Sep 17 00:00:00 2001
From: Thomas Durieux <5577568+tdurieux@users.noreply.github.com>
Date: Wed, 7 Oct 2026 11:09:03 +0000
Subject: [PATCH] fix: validate PDF.js syntax before publishing assets

---
 gulpfile.js              | 4 ++++
 test/asset-build.test.js | 8 ++++++++
 2 files changed, 12 insertions(+)

diff --git a/gulpfile.js b/gulpfile.js
index 22ed1c3..fa0582b 100644
--- a/gulpfile.js
+++ b/gulpfile.js
@@ -8,6 +8,7 @@ const crypto = require("crypto");
 const fs = require("fs");
 const esbuild = require("esbuild");
 const { compileTemplate } = require("vue/compiler-sfc");
+const { Script } = require("node:vm");
 const { promisify } = require("node:util");
 
 const coreJsFiles = [
@@ -69,6 +70,9 @@ async function buildVendorJs() {
   await Promise.all(Object.entries(lazyGroups).map(async ([name, files]) => {
     // PDF.js is already minified upstream. Re-minifying it breaks rendering
     // for documents such as #857, even though page.render() resolves.
+    if (name === "pdf") {
+      for (const file of files) new Script(fs.readFileSync(file, "utf8"), { filename: file });
+    }
     const transforms = name === "pdf" ? [] : [uglify()];
     await promisify(pipeline)(orderedSrc(files), concat(`${name}.min.js`), ...transforms, dest("public/script"));
     lazyAssets[name] = `/script/${name}.${hashFile(`public/script/${name}.min.js`)}.min.js`;
diff --git a/test/asset-build.test.js b/test/asset-build.test.js
index 459c3ef..8b30d77 100644
--- a/test/asset-build.test.js
+++ b/test/asset-build.test.js
@@ -75,6 +75,14 @@ describe("asset build", function () {
     expect(bundled.equals(upstream)).to.equal(true);
   });
 
+  it("rejects invalid PDF.js without publishing a manifest", function () {
+    fs.writeFileSync(path.join(directory, groups.pdfFiles[0]), "function {");
+    const result = build();
+    expect(result.status).not.to.equal(0);
+    expect(result.stderr).to.include("SyntaxError");
+    expect(fs.existsSync(path.join(directory, "public/asset-manifest.json"))).to.equal(false);
+  });
+
   it("fails on missing input without publishing a manifest", function () {
     fs.unlinkSync(path.join(directory, groups.coreJsFiles[0]));
     const result = build();