summaryrefslogtreecommitdiff
path: root/Build/source/extra/epstopdf
diff options
context:
space:
mode:
authorManuel Pégourié-Gonnard <mpg@elzevir.fr>2010-02-23 00:01:01 +0000
committerManuel Pégourié-Gonnard <mpg@elzevir.fr>2010-02-23 00:01:01 +0000
commitb020a81de2354beba61b6cc7d2c2671a919f3c24 (patch)
tree2df886561f14fde1145a568a1b6d3e7d27b57d54 /Build/source/extra/epstopdf
parent05be7ef176f89f31ca8c0af45ecf67e3f08c12de (diff)
epstopdf: Protect against rogue programs in '.' on win32.
git-svn-id: svn://tug.org/texlive/trunk@17152 c570f23f-e606-0410-a88d-b1316a301751
Diffstat (limited to 'Build/source/extra/epstopdf')
-rwxr-xr-xBuild/source/extra/epstopdf/epstopdf.pl31
1 files changed, 30 insertions, 1 deletions
diff --git a/Build/source/extra/epstopdf/epstopdf.pl b/Build/source/extra/epstopdf/epstopdf.pl
index 25ab5ce043e..0e1de61ab06 100755
--- a/Build/source/extra/epstopdf/epstopdf.pl
+++ b/Build/source/extra/epstopdf/epstopdf.pl
@@ -47,6 +47,12 @@ use strict;
#
# emacs-page
# History
+# 2010/02/23 (Manuel P\'egouri\'e-Gonnard)
+# * Use kpsewhich for filename validation in restricted mode, both input and
+# output. Requires kpathsea 5.1.0 (TL2010), rejects the name with earlier
+# versions of kpsewhich.
+# * Call external programs with full path on win32 in order to avoid obvious
+# attacks with rogue versions of these programs in the current directory.
# 2009/11/27 v2.12 (Karl Berry)
# * Make --filter work again
# 2009/11/25 (Manuel P\'egouri\'e-Gonnard)
@@ -245,6 +251,28 @@ sub errorUsage {
$restricted = 1 if $::opt_restricted;
debug "Restricted mode activated" if $restricted;
+### safe kpsewhich command for windows
+my $kpsewhich = 'kpsewhich';
+if ($restricted and ($^O eq 'MSWin32')) {
+ use File::Basename;
+ my $mydirname = dirname $0;
+ # $mydirname is the location of the Perl script
+ $kpsewhich = "$mydirname/../../../bin/win32/$kpsewhich";
+}
+debug "kpsewhich command: $kpsewhich";
+
+### find a executable (.exe) in the PATH on windows, or bail out in error
+sub make_full_path_w32 {
+ my ($name) = @_;
+ $name = "$name.exe" unless $name =~ /\.exe\z/;
+ my $path = $ENV{'PATH'};
+ for my $path_elt (split(/;/, $path)) {
+ my $fullname = "$path_elt/$name";
+ return $fullname if -e $fullname;
+ }
+ error "Program $name not found in PATH\n($path)";
+}
+
### check if a name is "safe" according to kpse's open(in|out)_any
# return true if name is ok, false otherwise
sub safe_name {
@@ -253,7 +281,7 @@ sub safe_name {
$option = '-safe-in-name' if $mode eq 'in';
$option = '-safe-out-name' if $mode eq 'out';
error "Unkown check mode '$mode' in safe_name()." unless $option;
- my @arg = ('kpsewhich', '-progname', 'repstopdf', $option, $name);
+ my @arg = ($kpsewhich, '-progname', 'repstopdf', $option, $name);
my $bad = system {$arg[0]} @arg;
return not $bad;
}
@@ -295,6 +323,7 @@ if ($::opt_gscmd) {
or error "Value of gscmd '$GS' not allowed in restricted mode.";
}
}
+$GS = make_full_path_w32($GS) if $restricted and ($^O eq 'MSWin32');
### start building GS command line for the pipe
my @GS = ($GS);