foxitreader

maintainer Muflone · 462 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a prebuilt installer from Foxit's official CDN; while the host is not whitelisted, it is plausibly the project's official source, and the build process extracts and repackages binaries without executing remote code or introducing untrusted dependencies.

Triggered rules

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-07-25) reviewed this and agrees it is LOW (confidence 95%): The package downloads a prebuilt installer from Foxit's official CDN; while the host is not whitelisted, it is plausibly the project's official source, and the build process extracts and repackages binaries without executing remote code or introducing untrusted dependencies.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 source=("http://cdn09.foxitsoftware.com/pub/foxit/reader/desktop/linux/2.x/${pkgver%.*.*}/en_us/FoxitReader.enu.setup.${pkgver}.x64.run.tar.gz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Muflone http://www.muflone.com/contacts/english/
    
      2# Contributor: Stephen Zhang <zsrkmyn at gmail dot com>
    
      3# Contributor: TDY <tdy@archlinux.info>
    
      4
    
      5pkgname=foxitreader
    
      6pkgver=2.4.5.0727
    
      7_foxitrevision=rb70e8df
    
      8pkgrel=2
    
      9pkgdesc="A fast, secure and complete PDF viewer"
    
      10arch=('x86_64')
    
      11url="https://www.foxitsoftware.com/products/pdf-reader/"
    
      12license=('LicenseRef-EULA')
    
      13depends=('libsecret' 'libxslt' 'libxcomposite' 'libgl' 'libxrender' 'gstreamer0.10-base'
    
       'libxi' 'libsm' 'fontconfig' 'dbus' 'openssl-1.0' 'desktop-file-utils'
    
       'libxkbcommon' 'libxml2-legacy')
    
      16makedepends=('p7zip' 'chrpath')
    
      17optdepends=('gtk2: use GTK+ dialogs under GTK+ based desktop environments')
    
      18source=("http://cdn09.foxitsoftware.com/pub/foxit/reader/desktop/linux/2.x/${pkgver%.*.*}/en_us/FoxitReader.enu.setup.${pkgver}.x64.run.tar.gz"
    
      "eula.html"
    
      "${pkgname}.patch"
    
      "${pkgname}-excluded_files")
    
      22sha256sums=('633279b6c9fcfa3c45e055df321a87d633ecfea11f668a06e838bb91b5bf6247'
    
          '4ca287e0c47f46df4185be7ff273c0cced304672ebc750aad6236590e1a772e6'
    
          'ef4438f745f719f03a06a14ff220f0629409b9729c62418e0be7250b4c9e4daf'
    
          'e558529c6dbea047eee744b011ffcc214547c503896b14211ebf5f6309ef4e9f')
    
      26
    
      27build() {
    
local _file
    
local _line
    
local _position
    
# Clean installer dir
    
if [ -d "${pkgname}-installer" ]
    
then
    
  rm -rf "${pkgname}-installer"
    
fi
    
mkdir "${pkgname}-installer"
    
# Decompress .run installer
    
_file="FoxitReader.enu.setup.${pkgver}(${_foxitrevision}).x64.run"
    
LANG=C grep --only-matching --byte-offset --binary \
    
            --text $'7z\xBC\xAF\x27\x1C' "${_file}" | cut -f1 -d: | 
    
       while read _position
    
       do
    
         dd if="${_file}" \
    
            bs=1M iflag=skip_bytes status=none skip=${_position} \
    
            of="${pkgname}-installer/bin-${_position}.7z"
    
       done
    
# Clean build dir
    
if [ -d "${pkgname}-build" ]
    
then
    
  rm -rf "${pkgname}-build"
    
fi
    
# Decompress 7z files (some files are damaged during the extraction)
    
cd "${pkgname}-installer"
    
install -m 755 -d "${srcdir}/${pkgname}-build"
    
for _file in *.7z
    
do
    
  7z -bd -bb0 -y x -o"${srcdir}/${pkgname}-build" ${_file} 1>/dev/null 2>&1 || true
    
done
    
# Apply final patches
    
cd "${srcdir}/${pkgname}-build"
    
patch -p1 --no-backup-if-mismatch -i "${srcdir}/${pkgname}.patch"
    
# Remove insecure RPATH
    
for _file in "lib/libFcitxQt5DBusAddons.so.1.0" \
    
             "lib/libQt5PrintSupport.so.5.3.2" \
    
             "platforminputcontexts/libfcitxplatforminputcontextplugin.so" \
    
             "printsupport/libcupsprintersupport.so"
    
do
    
  echo "  -> Removing insecure RPATH from ${_file}"
    
  chrpath --delete "${_file}"
    
done
    
# Remove unneeded files
    
rm "Activation" "Activation.desktop" "Activation.sh" \
    
   "countinstalltion" "countinstalltion.sh" \
    
   "installUpdate" "ldlibrarypath.sh" \
    
   "maintenancetool.sh" "Uninstall.desktop" \
    
   "Update.desktop" "updater" "updater.sh"
    
find -type d -name ".svn" -exec rm -rf {} +
    
find -type f -name ".directory" -exec rm -rf {} +
    
find -type f -name "*~" -exec rm {} +
    
# Remove excluded files
    
while IFS='' read -r _line
    
do
    
  if [ "${_line::2}" = "# " ]
    
  then
    
    echo "  -> Removing excluded files from ${_line:2}..."
    
  elif [ -n "${_line}" -a "${_line::1}" != "#" ]
    
  then
    
    rm "${srcdir}/${pkgname}-build/${_line}"
    
  fi
    
done < "${srcdir}/${pkgname}-excluded_files"
    
      91}
    
      92
    
      93package() {
    
install -m 755 -d "${pkgdir}/usr/lib/${pkgname}"
    
cd "${srcdir}/${pkgname}-build"
    
cp -r * "${pkgdir}/usr/lib/${pkgname}"
    
# Install icon and desktop files
    
install -m 755 -d "${pkgdir}/usr/share/pixmaps"
    
install -m 644 "images/FoxitReader.png" \
    
  "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
    
install -m 755 -d "${pkgdir}/usr/share/applications"
    
install -m 644 "FoxitReader.desktop" \
    
  "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
rm FoxitReader.desktop
    
# Install license file
    
install -m 755 -d "${pkgdir}/usr/share/licenses/${pkgname}"
    
install -m 644 -t "${pkgdir}/usr/share/licenses/${pkgname}" "${srcdir}/eula.html"
    
# Install launcher script
    
cd "${pkgdir}"
    
install -m 755 -d "${pkgdir}/usr/bin"
    
ln -s "/usr/lib/${pkgname}/FoxitReader.sh" "${pkgdir}/usr/bin/${pkgname}"
    
      112}
    
      113
    
      114

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2