pdfcrop 1.18 (including rpdfcrop)

git-svn-id: svn://tug.org/texlive/trunk@14387 c570f23f-e606-0410-a88d-b1316a301751

19 files changed, 273 insertions, 31 deletions

diff --git a/Build/source/texk/texlive/linked_scripts/ChangeLog b/Build/source/texk/texlive/linked_scripts/ChangeLog
index 30119464e68..c235e94a958 100644
--- a/Build/source/texk/texlive/linked_scripts/ChangeLog
+++ b/Build/source/texk/texlive/linked_scripts/ChangeLog
@@ -1,3 +1,7 @@
+2009-07-23  Karl Berry  <karl@tug.org>
+
+	* Makefile.am (install-links): create rpdfcrop as a link to pdfcrop.
+
 2009-06-03  Karl Berry  <karl@tug.org>
 
 	* Makefile.am (nobase_dist_scriptx_SCRIPTS): remove ps2eps.pl,
diff --git a/Build/source/texk/texlive/linked_scripts/Makefile.am b/Build/source/texk/texlive/linked_scripts/Makefile.am
index 4a8a42a0f7c..3c751ec9236 100644
--- a/Build/source/texk/texlive/linked_scripts/Makefile.am
+++ b/Build/source/texk/texlive/linked_scripts/Makefile.am
@@ -135,13 +135,16 @@ install-links:
 	    echo "creating link '$$target' -> '$(REL)/texmf-dist/scripts/$$s'"; \
 	    $(LN_S) $(REL)/texmf-dist/scripts/$$s $$target; \
 	  done && \
-	  rm -rf getnonfreefonts-sys && \
+	  rm -f rpdfcrop && \
+	  echo "creating link 'rpdfcrop' -> 'pdfcrop'" && \
+	  $(LN_S) pdfcrop rpdfcrop && \
+	  rm -f getnonfreefonts-sys && \
 	  echo "creating link 'getnonfreefonts-sys' -> 'getnonfreefonts'" && \
 	  $(LN_S) getnonfreefonts getnonfreefonts-sys && \
-## man dir link for those mans which can use it.
 	  rm -f man && \
 	  echo "creating link 'man' -> '$(REL)/texmf/doc/man'" && \
 	  (ln -s $(REL)/texmf/doc/man man || :)
+## man dir link for those mans which can use it.
 
 uninstall-hook:
 	@for s in $(nobase_dist_scriptx_SCRIPTS) $(nobase_dist_script_SCRIPTS); do \
diff --git a/Build/source/texk/texlive/linked_scripts/Makefile.in b/Build/source/texk/texlive/linked_scripts/Makefile.in
index cdbaa6167ba..d4596147375 100644
--- a/Build/source/texk/texlive/linked_scripts/Makefile.in
+++ b/Build/source/texk/texlive/linked_scripts/Makefile.in
@@ -563,7 +563,10 @@ install-links:
 	    echo "creating link '$$target' -> '$(REL)/texmf-dist/scripts/$$s'"; \
 	    $(LN_S) $(REL)/texmf-dist/scripts/$$s $$target; \
 	  done && \
-	  rm -rf getnonfreefonts-sys && \
+	  rm -f rpdfcrop && \
+	  echo "creating link 'rpdfcrop' -> 'pdfcrop'" && \
+	  $(LN_S) pdfcrop rpdfcrop && \
+	  rm -f getnonfreefonts-sys && \
 	  echo "creating link 'getnonfreefonts-sys' -> 'getnonfreefonts'" && \
 	  $(LN_S) getnonfreefonts getnonfreefonts-sys && \
 	  rm -f man && \
diff --git a/Build/source/texk/texlive/linked_scripts/pdfcrop/pdfcrop.pl b/Build/source/texk/texlive/linked_scripts/pdfcrop/pdfcrop.pl
index 412e979ac50..9dbcdb22d90 100755
--- a/Build/source/texk/texlive/linked_scripts/pdfcrop/pdfcrop.pl
+++ b/Build/source/texk/texlive/linked_scripts/pdfcrop/pdfcrop.pl
@@ -22,8 +22,8 @@ $^W=1; # turn warning on
 #
 my $file        = "pdfcrop.pl";
 my $program     = uc($&) if $file =~ /^\w+/;
-my $version     = "1.15";
-my $date        = "2009/07/14";
+my $version     = "1.18";
+my $date        = "2009/07/18";
 my $author      = "Heiko Oberdiek";
 my $copyright   = "Copyright (c) 2002-2009 by $author.";
 #
@@ -52,6 +52,15 @@ my $copyright   = "Copyright (c) 2002-2009 by $author.";
 #   2008/09/12 v1.14: Error detection for invalid Bounding Boxes.
 #   2009/07/14 v1.15: Fix for negative coordinates in Bounding Boxes
 #                     (David Menestrina).
+#   2009/07/16 v1.16: Security fixes:
+#                     * -dSAFER added for Ghostscript,
+#                     * -no-shell-escape added for pdfTeX/XeTeX.
+#   2009/07/17 v1.17: Security fixes:
+#                     * Backticks and whitespace are forbidden
+#                       for options --(gs|pdftex|xetex)cmd.
+#                     * Validation of options --papersize and --resolution.
+#   2009/07/18 v1.18: * Restricted mode added.
+#                     * Option --version added.
 
 ### program identification
 my $title = "$program $version, $date - $copyright\n";
@@ -74,6 +83,12 @@ my $Win = 0;
 $Win = 1 if $^O =~ /mswin32/i;
 $Win = 1 if $^O =~ /cygwin/i;
 
+# restricted mode
+my $restricted = 0;
+if ($0 =~ /rpdfcrop/ or $0 =~ /restricted/) {
+    $restricted = 1;
+}
+
 # "null" device
 use File::Spec::Functions qw(devnull);
 my $null = devnull();
@@ -83,8 +98,26 @@ my $inputfile   = "";
 my $outputfile  = "";
 my $tmp = "tmp-\L$program\E-$$";
 
+### paper sizes
+
+my @papersizes = qw[
+  11x17 ledger legal letter lettersmall
+  archE archD archC archB archA
+  a0 a1 a2 a3 a4 a4small a5 a6 a7 a8 a9 a10
+  isob0 isob1 isob2 isob3 isob4 isob5 isob6
+  c0 c1 c2 c3 c4 c5 c6
+  jisb0 jisb1 jisb2 jisb3 jisb4 jisb5 jisb6
+  b0 b1 b2 b3 b4 b5
+  flsa flse halfletter
+];
+my %papersizes;
+foreach (@papersizes) {
+    $papersizes{$_} = 1;
+}
+
 ### option variables
 my @bool = ("false", "true");
+$::opt_version    = 0;
 $::opt_help       = 0;
 $::opt_debug      = 0;
 $::opt_verbose    = 0;
@@ -104,6 +137,7 @@ ${title}Syntax:   \L$program\E [options] <input[.pdf]> [output file]
 Function: Margins are calculated and removed for each page in the file.
 Options:                                                    (defaults:)
   --help              print usage
+  --version           print version number
   --(no)verbose       verbose printing                      ($bool[$::opt_verbose])
   --(no)debug         debug informations                    ($bool[$::opt_debug])
   --gscmd <name>      call of ghostscript                   ($::opt_gscmd)
@@ -119,6 +153,7 @@ Options:                                                    (defaults:)
   --(no)hires         using `%%HiResBoundingBox'            ($bool[$::opt_hires])
                       instead of `%%BoundingBox'
 Expert options:
+  --restricted        turn on restricted mode               ($bool[$restricted])
   --papersize <foo>   parameter for gs's -sPAPERSIZE=<foo>,
                       use only with older gs versions <7.32 ($::opt_papersize)
   --resolution <xres>x<yres>                                ()
@@ -140,6 +175,7 @@ my @OrgArgv = @ARGV;
 use Getopt::Long;
 GetOptions(
   "help!",
+  "version!",
   "debug!",
   "verbose!",
   "gscmd=s",
@@ -153,9 +189,15 @@ GetOptions(
   "papersize=s",
   "resolution=s",
   "bbox=s",
+  "restricted" => sub { $restricted = 1; },
 ) or die $usage;
 !$::opt_help or die $usage;
 
+if ($::opt_version) {
+    print "$version\n";
+    exit(0);
+}
+
 $::opt_verbose = 1 if $::opt_debug;
 
 @ARGV >= 1 or die $usage;
@@ -227,6 +269,55 @@ else {
 }
 print "* Margins: $llx $lly $urx $ury\n" if $::opt_debug;
 
+### papersize validation (security)
+if ($::opt_papersize ne '') {
+    $::opt_papersize =~ /^[0-9A-Za-z]+$/
+            or die "$Error Invalid papersize ($::opt_papersize)!\n";
+    $papersizes{$::opt_papersize}
+            or die "$Error Unknown papersize ($::opt_papersize),"
+                   . " see ghostscript's documentation for option `-r'!\n";
+}
+
+### resolution validation (security)
+if ($::opt_resolution ne '') {
+    $::opt_resolution =~ /^\d+(x\d+)?$/
+            or die "$Error Invalid resolution ($::opt_resolution),"
+                   . " see ghostscript's documentation!\n";
+}
+
+### command name validation (security)
+my %cmd = (
+    'gscmd' => \$::opt_gscmd,
+    'pdftexcmd' => \$::opt_pdftexcmd,
+    'xetexcmd' => \$::opt_xetexcmd
+);
+foreach my $cmd (keys %cmd) {
+    my $val = ${$cmd{$cmd}};
+    next unless $val;
+    $val =~ s/^\s+//;
+    $val =~ s/\s+$//;
+    next unless $val;
+    if ($val =~ /`/) {
+        die "$Error Forbidden backtick for option `--$cmd' ($val)!\n";
+    }
+    if ($val =~ /\s/) {
+        die "$Error Forbidden whitespace for option `--$cmd' ($val)!\n";
+    }
+}
+if ($restricted) {
+    if ($::opt_pdftexcmd and $::opt_pdftexcmd ne 'pdftex') {
+        die "$Error pdfTeX program name must not be changed in restricted mode!\n";
+    }
+    if ($::opt_xetexcmd and $::opt_xetexcmd ne 'xetex') {
+        die "$Error XeTeX program name must not be changed in restricted mode!\n";
+    }
+    if ($::opt_gscmd) {
+        $::opt_gscmd =~ /^(gs|mgs|gswin32c|gs386|gsos2)$/
+        or $::opt_gscmd =~ /^gs[\-_]?(\d|\d[\.-_]?\d\d)c?$/
+        or die "$Error: Invalid Ghostscript program name in restricted mode!\n";
+    }
+}
+
 ### cleanup system
 my @unlink_files = ();
 my $exit_code = 1;
@@ -393,7 +484,7 @@ if ($::opt_bbox) {
      @bbox = ($1, $2, $3, $4);
 }
 my $page = 0;
-my $gs_pipe = "$::opt_gscmd @gsargs 2>&1";
+my $gs_pipe = "$::opt_gscmd -dSAFER @gsargs 2>&1";
 $gs_pipe .= " 1>$null" unless $::opt_verbose;
 $gs_pipe .= "|";
 
@@ -454,11 +545,11 @@ END_WARNING
 close(GS);
 
 if ($? & 127) {
-    die sprintf  "!!! Error: Ghostscript died with signal %d!\n",
+    die sprintf  "$Error Ghostscript died with signal %d!\n",
                  ($? & 127);
 }
 elsif ($? != 0) {
-    die sprintf "!!! Error: Ghostscript exited with error code %d!\n",
+    die sprintf "$Error Ghostscript exited with error code %d!\n",
                 $? >> 8;
 }
 
@@ -466,7 +557,7 @@ print TMP "\\csname \@\@end\\endcsname\n\\end\n";
 close(TMP);
 
 if ($page == 0) {
-    die "!!! Error: Ghostscript does not report bounding boxes!\n";
+    die "$Error Ghostscript does not report bounding boxes!\n";
 }
 
 ### Run pdfTeX/XeTeX
@@ -482,6 +573,7 @@ else {
     $cmd = $::opt_xetexcmd;
     $texname = 'XeTeX';
 }
+$cmd .= ' -no-shell-escape';
 if ($::opt_verbose) {
     $cmd .= " -interaction=nonstopmode $tmp";
 }
diff --git a/Master/bin/alpha-linux/rpdfcrop b/Master/bin/alpha-linux/rpdfcrop
new file mode 120000
index 00000000000..b915c696540
--- /dev/null
+++ b/Master/bin/alpha-linux/rpdfcrop
@@ -0,0 +1 @@
+pdfcrop
\ No newline at end of file
diff --git a/Master/bin/amd64-freebsd/rpdfcrop b/Master/bin/amd64-freebsd/rpdfcrop
new file mode 120000
index 00000000000..b915c696540
--- /dev/null
+++ b/Master/bin/amd64-freebsd/rpdfcrop
@@ -0,0 +1 @@
+pdfcrop
\ No newline at end of file
diff --git a/Master/bin/i386-freebsd/rpdfcrop b/Master/bin/i386-freebsd/rpdfcrop
new file mode 120000
index 00000000000..b915c696540
--- /dev/null
+++ b/Master/bin/i386-freebsd/rpdfcrop
@@ -0,0 +1 @@
+pdfcrop
\ No newline at end of file
diff --git a/Master/bin/i386-linux/rpdfcrop b/Master/bin/i386-linux/rpdfcrop
new file mode 120000
index 00000000000..b915c696540
--- /dev/null
+++ b/Master/bin/i386-linux/rpdfcrop
@@ -0,0 +1 @@
+pdfcrop
\ No newline at end of file
diff --git a/Master/bin/i386-solaris/rpdfcrop b/Master/bin/i386-solaris/rpdfcrop
new file mode 120000
index 00000000000..b915c696540
--- /dev/null
+++ b/Master/bin/i386-solaris/rpdfcrop
@@ -0,0 +1 @@
+pdfcrop
\ No newline at end of file
diff --git a/Master/bin/mips-irix/rpdfcrop b/Master/bin/mips-irix/rpdfcrop
new file mode 120000
index 00000000000..b915c696540
--- /dev/null
+++ b/Master/bin/mips-irix/rpdfcrop
@@ -0,0 +1 @@
+pdfcrop
\ No newline at end of file
diff --git a/Master/bin/powerpc-aix/rpdfcrop b/Master/bin/powerpc-aix/rpdfcrop
new file mode 120000
index 00000000000..b915c696540
--- /dev/null
+++ b/Master/bin/powerpc-aix/rpdfcrop
@@ -0,0 +1 @@
+pdfcrop
\ No newline at end of file
diff --git a/Master/bin/powerpc-linux/rpdfcrop b/Master/bin/powerpc-linux/rpdfcrop
new file mode 120000
index 00000000000..b915c696540
--- /dev/null
+++ b/Master/bin/powerpc-linux/rpdfcrop
@@ -0,0 +1 @@
+pdfcrop
\ No newline at end of file
diff --git a/Master/bin/sparc-linux/rpdfcrop b/Master/bin/sparc-linux/rpdfcrop
new file mode 120000
index 00000000000..b915c696540
--- /dev/null
+++ b/Master/bin/sparc-linux/rpdfcrop
@@ -0,0 +1 @@
+pdfcrop
\ No newline at end of file
diff --git a/Master/bin/sparc-solaris/rpdfcrop b/Master/bin/sparc-solaris/rpdfcrop
new file mode 120000
index 00000000000..b915c696540
--- /dev/null
+++ b/Master/bin/sparc-solaris/rpdfcrop
@@ -0,0 +1 @@
+pdfcrop
\ No newline at end of file
diff --git a/Master/bin/universal-darwin/rpdfcrop b/Master/bin/universal-darwin/rpdfcrop
new file mode 120000
index 00000000000..b915c696540
--- /dev/null
+++ b/Master/bin/universal-darwin/rpdfcrop
@@ -0,0 +1 @@
+pdfcrop
\ No newline at end of file
diff --git a/Master/bin/x86_64-linux/rpdfcrop b/Master/bin/x86_64-linux/rpdfcrop
new file mode 120000
index 00000000000..b915c696540
--- /dev/null
+++ b/Master/bin/x86_64-linux/rpdfcrop
@@ -0,0 +1 @@
+pdfcrop
\ No newline at end of file
diff --git a/Master/texmf-dist/doc/support/pdfcrop/README b/Master/texmf-dist/doc/support/pdfcrop/README
index 9d47638d3f6..bdab822069e 100644
--- a/Master/texmf-dist/doc/support/pdfcrop/README
+++ b/Master/texmf-dist/doc/support/pdfcrop/README
@@ -1,4 +1,4 @@
-README for pdfcrop 2009/07/14 v1.15
+README for pdfcrop 2009/07/18 v1.18
 
 TABLE OF CONTENTS
 =================
@@ -8,12 +8,13 @@ C. Files
 D. Requirements
 E. Installation
 F. User Interface
-G. Author
-H. Acknowledgement
-I. Questions, Suggested Improvements
-J. Known Problems
-K. History
-L. ToDo
+G. Restricted Mode
+H. Author
+I. Acknowledgement
+J. Questions, Suggested Improvements
+K. Known Problems
+L. History
+M. ToDo
 
 A. DESCRIPTION
 ==============
@@ -73,7 +74,18 @@ E. INSTALLATION
    * See requirements. I do not expect that the perl script
      run under DOS.
 
-2. Documentation `README':
+2. Restricted program version `rpdfcrop'
+
+   Generate links or install `pdfcrop.pl' again under the
+   name `rpdfcrop'.
+
+   Prefer `rpdfcrop' if you want to add pdfcrop to the
+   programs that may be executed in TeX's restricted
+   shell escape mode. (This feature is added in TeX Live 2009.)
+   For TeX Live (since 2009) see entry for `shell_escape_commands'
+   in the configuration file `texmf.cnf'.
+
+3. Documentation `README':
 
    Copy it to an appropriate place, for example
    `/usr/local/share/doc/pdfcrop/README'.
@@ -99,12 +111,27 @@ F. USER INTERFACE
   Of course the calculation with higher resolution settings are
   more accurate.
 
-G. AUTHOR
+G. RESTRICTED MODE
+==================
+Restricted mode is enabled if:
+* option `--restricted' is used,
+* the program is called under the name `rpdfcrop'
+* or the called program name contains `restricted'.
+This mode sets restrictions for the following options:
+* --pdftexcmd: if used, the value must be empty or `pdftex'.
+* --xetexcmd: if used, the value must be empty or `xetex'.
+* --gscmd: if used, the value must
+  * be empty or
+  * be one of the standard names (gs, gswin32c, mgs, gs386 gsos2) or
+  * consists of `gs', followed by a version number and an
+    optional `c' (Ghostscript's convention for `console version').
+
+H. AUTHOR
 =========
 Heiko Oberdiek
 Email: oberdiek at uni-freiburg.de
 
-H. ACKNOWLEDGEMENT
+I. ACKNOWLEDGEMENT
 ==================
 Anthony Williams
 Scott Pakin <pakin at uiuc.edu>
@@ -114,7 +141,7 @@ R (Chandra) Chandrasekhar
 Christian Stapfer
 David Menestrina
 
-I. QUESTIONS, SUGGESTED IMPROVEMENTS
+J. QUESTIONS, SUGGESTED IMPROVEMENTS
 ====================================
 If you have questions, problems with `pdfcrop', error reports,
 if you have improvements or want to have additional features,
@@ -126,14 +153,14 @@ My environment for developing and testing:
 * pdfTeX 3.141592-1.40.x
 * Ghostscript 8.x
 
-J. KNOWN PROBLEMS
+K. KNOWN PROBLEMS
 =================
 * pdfcrop relies on Ghostscript for the calculation of the
   Bounding Box. If Ghostscript returns wrong values or
   cannot process the pdf file, it sometimes helps to try
   another version of Ghostscript.
 
-K. HISTORY
+L. HISTORY
 ==========
 2002/10/30 v1.0:  First release
 2002/10/30 v1.1:  Option --hires added.
@@ -158,8 +185,17 @@ K. HISTORY
 2008/09/12 v1.14: Error detection for invalid Bounding Boxes.
 2009/07/14 v1.15: Fix for negative coordinates in Bounding Boxes
                   (David Menestrina).
-
-L. TODO
+2009/07/17 v1.16: Security fixes:
+                  * -dSAFER added for Ghostscript,
+                  * -no-shell-escape added for pdfTeX/XeTeX.
+2009/07/17 v1.17: Security fixes:
+                  * Backticks and whitespace are forbidden
+                    for options --(gs|pdftex|xetex)cmd.
+                  * Validation of options --papersize and --resolution.
+2009/07/18 v1.18: * Restricted mode added.
+                  * Option --version added.
+
+M. TODO
 =======
 * Description of user interface.
 * Documentation in other formats, eg. man or info pages.
diff --git a/Master/texmf-dist/scripts/pdfcrop/pdfcrop.pl b/Master/texmf-dist/scripts/pdfcrop/pdfcrop.pl
index 412e979ac50..9dbcdb22d90 100755
--- a/Master/texmf-dist/scripts/pdfcrop/pdfcrop.pl
+++ b/Master/texmf-dist/scripts/pdfcrop/pdfcrop.pl
@@ -22,8 +22,8 @@ $^W=1; # turn warning on
 #
 my $file        = "pdfcrop.pl";
 my $program     = uc($&) if $file =~ /^\w+/;
-my $version     = "1.15";
-my $date        = "2009/07/14";
+my $version     = "1.18";
+my $date        = "2009/07/18";
 my $author      = "Heiko Oberdiek";
 my $copyright   = "Copyright (c) 2002-2009 by $author.";
 #
@@ -52,6 +52,15 @@ my $copyright   = "Copyright (c) 2002-2009 by $author.";
 #   2008/09/12 v1.14: Error detection for invalid Bounding Boxes.
 #   2009/07/14 v1.15: Fix for negative coordinates in Bounding Boxes
 #                     (David Menestrina).
+#   2009/07/16 v1.16: Security fixes:
+#                     * -dSAFER added for Ghostscript,
+#                     * -no-shell-escape added for pdfTeX/XeTeX.
+#   2009/07/17 v1.17: Security fixes:
+#                     * Backticks and whitespace are forbidden
+#                       for options --(gs|pdftex|xetex)cmd.
+#                     * Validation of options --papersize and --resolution.
+#   2009/07/18 v1.18: * Restricted mode added.
+#                     * Option --version added.
 
 ### program identification
 my $title = "$program $version, $date - $copyright\n";
@@ -74,6 +83,12 @@ my $Win = 0;
 $Win = 1 if $^O =~ /mswin32/i;
 $Win = 1 if $^O =~ /cygwin/i;
 
+# restricted mode
+my $restricted = 0;
+if ($0 =~ /rpdfcrop/ or $0 =~ /restricted/) {
+    $restricted = 1;
+}
+
 # "null" device
 use File::Spec::Functions qw(devnull);
 my $null = devnull();
@@ -83,8 +98,26 @@ my $inputfile   = "";
 my $outputfile  = "";
 my $tmp = "tmp-\L$program\E-$$";
 
+### paper sizes
+
+my @papersizes = qw[
+  11x17 ledger legal letter lettersmall
+  archE archD archC archB archA
+  a0 a1 a2 a3 a4 a4small a5 a6 a7 a8 a9 a10
+  isob0 isob1 isob2 isob3 isob4 isob5 isob6
+  c0 c1 c2 c3 c4 c5 c6
+  jisb0 jisb1 jisb2 jisb3 jisb4 jisb5 jisb6
+  b0 b1 b2 b3 b4 b5
+  flsa flse halfletter
+];
+my %papersizes;
+foreach (@papersizes) {
+    $papersizes{$_} = 1;
+}
+
 ### option variables
 my @bool = ("false", "true");
+$::opt_version    = 0;
 $::opt_help       = 0;
 $::opt_debug      = 0;
 $::opt_verbose    = 0;
@@ -104,6 +137,7 @@ ${title}Syntax:   \L$program\E [options] <input[.pdf]> [output file]
 Function: Margins are calculated and removed for each page in the file.
 Options:                                                    (defaults:)
   --help              print usage
+  --version           print version number
   --(no)verbose       verbose printing                      ($bool[$::opt_verbose])
   --(no)debug         debug informations                    ($bool[$::opt_debug])
   --gscmd <name>      call of ghostscript                   ($::opt_gscmd)
@@ -119,6 +153,7 @@ Options:                                                    (defaults:)
   --(no)hires         using `%%HiResBoundingBox'            ($bool[$::opt_hires])
                       instead of `%%BoundingBox'
 Expert options:
+  --restricted        turn on restricted mode               ($bool[$restricted])
   --papersize <foo>   parameter for gs's -sPAPERSIZE=<foo>,
                       use only with older gs versions <7.32 ($::opt_papersize)
   --resolution <xres>x<yres>                                ()
@@ -140,6 +175,7 @@ my @OrgArgv = @ARGV;
 use Getopt::Long;
 GetOptions(
   "help!",
+  "version!",
   "debug!",
   "verbose!",
   "gscmd=s",
@@ -153,9 +189,15 @@ GetOptions(
   "papersize=s",
   "resolution=s",
   "bbox=s",
+  "restricted" => sub { $restricted = 1; },
 ) or die $usage;
 !$::opt_help or die $usage;
 
+if ($::opt_version) {
+    print "$version\n";
+    exit(0);
+}
+
 $::opt_verbose = 1 if $::opt_debug;
 
 @ARGV >= 1 or die $usage;
@@ -227,6 +269,55 @@ else {
 }
 print "* Margins: $llx $lly $urx $ury\n" if $::opt_debug;
 
+### papersize validation (security)
+if ($::opt_papersize ne '') {
+    $::opt_papersize =~ /^[0-9A-Za-z]+$/
+            or die "$Error Invalid papersize ($::opt_papersize)!\n";
+    $papersizes{$::opt_papersize}
+            or die "$Error Unknown papersize ($::opt_papersize),"
+                   . " see ghostscript's documentation for option `-r'!\n";
+}
+
+### resolution validation (security)
+if ($::opt_resolution ne '') {
+    $::opt_resolution =~ /^\d+(x\d+)?$/
+            or die "$Error Invalid resolution ($::opt_resolution),"
+                   . " see ghostscript's documentation!\n";
+}
+
+### command name validation (security)
+my %cmd = (
+    'gscmd' => \$::opt_gscmd,
+    'pdftexcmd' => \$::opt_pdftexcmd,
+    'xetexcmd' => \$::opt_xetexcmd
+);
+foreach my $cmd (keys %cmd) {
+    my $val = ${$cmd{$cmd}};
+    next unless $val;
+    $val =~ s/^\s+//;
+    $val =~ s/\s+$//;
+    next unless $val;
+    if ($val =~ /`/) {
+        die "$Error Forbidden backtick for option `--$cmd' ($val)!\n";
+    }
+    if ($val =~ /\s/) {
+        die "$Error Forbidden whitespace for option `--$cmd' ($val)!\n";
+    }
+}
+if ($restricted) {
+    if ($::opt_pdftexcmd and $::opt_pdftexcmd ne 'pdftex') {
+        die "$Error pdfTeX program name must not be changed in restricted mode!\n";
+    }
+    if ($::opt_xetexcmd and $::opt_xetexcmd ne 'xetex') {
+        die "$Error XeTeX program name must not be changed in restricted mode!\n";
+    }
+    if ($::opt_gscmd) {
+        $::opt_gscmd =~ /^(gs|mgs|gswin32c|gs386|gsos2)$/
+        or $::opt_gscmd =~ /^gs[\-_]?(\d|\d[\.-_]?\d\d)c?$/
+        or die "$Error: Invalid Ghostscript program name in restricted mode!\n";
+    }
+}
+
 ### cleanup system
 my @unlink_files = ();
 my $exit_code = 1;
@@ -393,7 +484,7 @@ if ($::opt_bbox) {
      @bbox = ($1, $2, $3, $4);
 }
 my $page = 0;
-my $gs_pipe = "$::opt_gscmd @gsargs 2>&1";
+my $gs_pipe = "$::opt_gscmd -dSAFER @gsargs 2>&1";
 $gs_pipe .= " 1>$null" unless $::opt_verbose;
 $gs_pipe .= "|";
 
@@ -454,11 +545,11 @@ END_WARNING
 close(GS);
 
 if ($? & 127) {
-    die sprintf  "!!! Error: Ghostscript died with signal %d!\n",
+    die sprintf  "$Error Ghostscript died with signal %d!\n",
                  ($? & 127);
 }
 elsif ($? != 0) {
-    die sprintf "!!! Error: Ghostscript exited with error code %d!\n",
+    die sprintf "$Error Ghostscript exited with error code %d!\n",
                 $? >> 8;
 }
 
@@ -466,7 +557,7 @@ print TMP "\\csname \@\@end\\endcsname\n\\end\n";
 close(TMP);
 
 if ($page == 0) {
-    die "!!! Error: Ghostscript does not report bounding boxes!\n";
+    die "$Error Ghostscript does not report bounding boxes!\n";
 }
 
 ### Run pdfTeX/XeTeX
@@ -482,6 +573,7 @@ else {
     $cmd = $::opt_xetexcmd;
     $texname = 'XeTeX';
 }
+$cmd .= ' -no-shell-escape';
 if ($::opt_verbose) {
     $cmd .= " -interaction=nonstopmode $tmp";
 }
diff --git a/Master/tlpkg/tlpsrc/pdfcrop.tlpsrc b/Master/tlpkg/tlpsrc/pdfcrop.tlpsrc
index 6483f7985f3..2d6367ae7fe 100644
--- a/Master/tlpkg/tlpsrc/pdfcrop.tlpsrc
+++ b/Master/tlpkg/tlpsrc/pdfcrop.tlpsrc
@@ -1,2 +1,2 @@
 runpattern d texmf-dist/scripts/pdfcrop
-binpattern f bin/${ARCH}/pdfcrop
+binpattern f bin/${ARCH}/*pdfcrop