yeah, if you dont want to give all your users permission to upload JS files just have them change their outgoing attachment to PDFs