{"record":{"id":"2cd1d638edd57a88","repo":"mozilla/pdf.js","slug":"doc-url-is-read-only","errorCode":null,"errorMessage":"doc.URL is read-only","messagePattern":"doc\\.URL is read-only","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"src/scripting_api/doc.js","lineNumber":687,"sourceCode":"\n  set templates(_) {\n    throw new Error(\"doc.templates is read-only\");\n  }\n\n  get title() {\n    return this._title;\n  }\n\n  set title(_) {\n    throw new Error(\"doc.title is read-only\");\n  }\n\n  get URL() {\n    return this._URL;\n  }\n\n  set URL(_) {\n    throw new Error(\"doc.URL is read-only\");\n  }\n\n  get viewState() {\n    return undefined;\n  }\n\n  set viewState(_) {\n    throw new Error(\"doc.viewState is read-only\");\n  }\n\n  get xfa() {\n    return this._xfa;\n  }\n\n  set xfa(_) {\n    throw new Error(\"doc.xfa is read-only\");\n  }\n","sourceCodeStart":669,"sourceCodeEnd":705,"githubUrl":"https://github.com/mozilla/pdf.js/blob/5903d58d58e4dd9ce6ffa3834aea8480f06b4ada/src/scripting_api/doc.js#L669-L705","documentation":"`Doc.URL` returns the URL from which the document was loaded (`this._URL`). It is read-only per the Acrobat spec — the source URL is a factual attribute of how the doc was opened, not settable by in-document scripts. PDF.js's throwing setter enforces that contract.","triggerScenarios":"A script writes `doc.URL = 'https://...';` to redirect or record the source. The setter throws on that line.","commonSituations":"Scripts that try to force a reload from a new URL; branding/audit code that rewrites the URL field; legacy scripts ported from a local-file context.","solutions":["Remove the assignment; read the value (`var u = doc.URL;`).","Control the source URL from the embedding page / `getDocument` call rather than from inside a document script.","Wrap script execution in try/catch."],"exampleFix":"// before\ndoc.URL = 'https://example.com/doc.pdf';\n\n// after\nvar u = doc.URL; // read-only source URL","handlingStrategy":"validation","validationCode":"const READ_ONLY_DOC_PROPS = new Set(['URL','path' /* ... */]);\nfunction assertsNoReadOnlyWrite(scriptSrc) {\n  for (const p of READ_ONLY_DOC_PROPS) {\n    if (new RegExp(`\\\\bdoc\\\\.${p}\\\\s*=[^=]`).test(scriptSrc)) {\n      throw new Error(`Script writes read-only property doc.${p}`);\n    }\n  }\n}\nassertsNoReadOnlyWrite(myScript);","typeGuard":"function isReadOnlyDocProp(doc, prop) {\n  const desc = Object.getOwnPropertyDescriptor(Object.getPrototypeOf(doc), prop)\n    || Object.getOwnPropertyDescriptor(doc, prop);\n  return !!desc && !!desc.get && !desc.set;\n}\nisReadOnlyDocProp(doc, 'URL'); // true","tryCatchPattern":"try {\n  doc.URL = 'https://example.com/doc.pdf';\n} catch (e) {\n  if (/\\\\bURL is read-only/.test(e.message)) console.warn(e.message);\n  else throw e;\n}","preventionTips":["Source URL/path is set by how the doc is loaded; control it from `getDocument`/the embedding page.","Read `doc.URL` rather than writing it.","Lint scripts for assignments to read-only source properties."],"tags":["scripting","acrobat-js-api","doc-object","read-only","url"],"backgroundTag":null,"analyzedSha":"5903d58d58e4dd9ce6ffa3834aea8480f06b4ada","analyzedAt":"2026-08-13T02:28:27.364Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}