3805201 - Clarification regarding PDF preview and XSS classification in SuccessFactors Work Zone

This document intends to provide a deep understanding about XSS classification within SuccessFactors Work Zone, which affects PDF Preview documents rendering.

SAP SuccessFactors Work Zone

The FAQ section below addresses common questions for XSS classification for PDF uploads.

Q: What conditions trigger the XSS classification on a PDF upload?

The security scan flags a PDF when both of the following are detected within the file — including inside compressed data streams:

• A /OpenAction entry
• A JavaScript-related marker

The presence of /AcroForm, /Widget, or /AA entries alone is not sufficient to trigger the block. However, when combined with compressed stream content containing the above markers, the classification applies.

Q: Which PDF constructs are rejected by the scan?

There is no published blocklist. The scan currently enforces two checks:

• Encrypted PDFs — blocked unconditionally.
• PDFs containing both /OpenAction and a JavaScript marker — blocked when this combination is detected anywhere in the file, including inside compressed content.

Q: Can the security check be disabled or a document added to an allow-list?

No. The scan runs unconditionally at upload time and cannot be disabled or bypassed at any level — tenant, workspace, or individual document. There is currently no allow-list or exception mechanism available.

Q: Does enabling the "PDF Viewer" feature affect the security scan behavior?

No. The security scan executes at upload time, prior to any PDF viewer processing. Enabling or disabling the inline PDF Viewer feature has no effect on whether a document is blocked by the scan.

Q: If the scan rule is updated, does the affected document need to be re-uploaded?

No re-upload is required. The scan result is stored as a flag on the document record. If the rule is updated, the document can be re-processed on the server-side (SAP) without any loss of associated data (comments, likes, view counts).

This re-processing requires the Engineering team to execute a dedicated script. If this is needed, Customers should raise a Support Case under LOD-SF-SWZ-DOC component — the assigned Support Engineer will coordinate the request with Engineering internally.

Q: Is there a roadmap item for allowing interactive-form PDFs in preview?

No roadmap item currently exists for this capability.

Customers are encouraged to submit a feature enhancement request via the SAP Customer Influence portal. A recommended framing for the request can be: the scanner should differentiate between script execution actions (e.g., JavaScript — which pose a genuine security risk) and passive navigation actions (e.g., /GoTo, /Named, /URI — which cannot execute code). PDFs exported from tools such as Adobe InDesign with internal navigation buttons are a common enterprise publishing format and should not be treated as security threats.

• KBA 3718632 - PDF preview unavailable due to cross-site scripting (XSS) detection in SAP Build Work Zone
• KBA 2090228 - How to submit enhancement ideas for SAP SuccessFactors Product

pdf preview unavailable, xss message, cross-site script, openaction, javascript marker, conversionstatus not_applicable, conversionstatus failed, inline pdf viewer, upload-time security scan, interactive form, acroform, widget annotations, goto named uri, blocked preview, flatten pdf, INC35631805 , KBA , LOD-SF-SWZ-DOC , Document Repository Integration , Problem