diff options
author | Karl Berry <karl@freefriends.org> | 2024-06-28 22:08:39 +0000 |
---|---|---|
committer | Karl Berry <karl@freefriends.org> | 2024-06-28 22:08:39 +0000 |
commit | b522cc20332ad230a34ddc0cab14c93ab3263019 (patch) | |
tree | 21275b37da8ce6b2e1afe3bebe06641c3cc492ff | |
parent | cd09ce29745ba3b8073b18dc4eb76defaa91acf1 (diff) |
no extractbb in restricted mode
git-svn-id: svn://tug.org/texlive/trunk@71645 c570f23f-e606-0410-a88d-b1316a301751
-rw-r--r-- | Build/source/texk/kpathsea/ChangeLog | 4 | ||||
-rw-r--r-- | Build/source/texk/kpathsea/texmf.cnf | 4 | ||||
-rw-r--r-- | Master/texmf-dist/web2c/texmf.cnf | 4 |
3 files changed, 8 insertions, 4 deletions
diff --git a/Build/source/texk/kpathsea/ChangeLog b/Build/source/texk/kpathsea/ChangeLog index dc1bd95adf3..b7e89628ec3 100644 --- a/Build/source/texk/kpathsea/ChangeLog +++ b/Build/source/texk/kpathsea/ChangeLog @@ -1,3 +1,7 @@ +2024-06-29 Karl Berry <karl@tug.org> + + * texmf.cnf (shell_escape_commands): remove extractbb. + 2024-06-04 Karl Berry <karl@freefriends.org> * texmf.cnf (MKTEXPK, etc.): adjust values shown to the diff --git a/Build/source/texk/kpathsea/texmf.cnf b/Build/source/texk/kpathsea/texmf.cnf index 94d1b999fdf..333e6325b3d 100644 --- a/Build/source/texk/kpathsea/texmf.cnf +++ b/Build/source/texk/kpathsea/texmf.cnf @@ -649,7 +649,6 @@ shell_escape = p % shell_escape_commands = \ bibtex,bibtex8,\ -extractbb,\ gregorio,\ kpsewhich,\ l3sys-query,\ @@ -660,7 +659,8 @@ repstopdf,\ r-mpost,\ texosquery-jre8,\ -% we'd like to allow: +% other programs considered: +% extractbb - allowed in the past, but can be exploited. % dvips - but external commands can be executed, need at least -R1. % epspdf, ps2pdf, pstopdf - need to respect openout_any, % and gs -dSAFER must be used and check for shell injection with filenames. diff --git a/Master/texmf-dist/web2c/texmf.cnf b/Master/texmf-dist/web2c/texmf.cnf index 94d1b999fdf..333e6325b3d 100644 --- a/Master/texmf-dist/web2c/texmf.cnf +++ b/Master/texmf-dist/web2c/texmf.cnf @@ -649,7 +649,6 @@ shell_escape = p % shell_escape_commands = \ bibtex,bibtex8,\ -extractbb,\ gregorio,\ kpsewhich,\ l3sys-query,\ @@ -660,7 +659,8 @@ repstopdf,\ r-mpost,\ texosquery-jre8,\ -% we'd like to allow: +% other programs considered: +% extractbb - allowed in the past, but can be exploited. % dvips - but external commands can be executed, need at least -R1. % epspdf, ps2pdf, pstopdf - need to respect openout_any, % and gs -dSAFER must be used and check for shell injection with filenames. |