summaryrefslogtreecommitdiff
path: root/Build/source/texk/kpathsea
diff options
context:
space:
mode:
authorKarl Berry <karl@freefriends.org>2023-10-10 22:01:41 +0000
committerKarl Berry <karl@freefriends.org>2023-10-10 22:01:41 +0000
commita0dc1ccfd20bcd453d4a31103c94c20754a0816b (patch)
treeeb2b6356a146350e90c4c8a95f5ac3d341d0632e /Build/source/texk/kpathsea
parent1045e3f70340d9f7540d9c9328a282ee84f88a51 (diff)
support new envvar TEXMF_OUTPUT_DIRECTORY
git-svn-id: svn://tug.org/texlive/trunk@68508 c570f23f-e606-0410-a88d-b1316a301751
Diffstat (limited to 'Build/source/texk/kpathsea')
-rw-r--r--Build/source/texk/kpathsea/ChangeLog16
-rw-r--r--Build/source/texk/kpathsea/doc/kpathsea.info260
-rw-r--r--Build/source/texk/kpathsea/doc/kpathsea.texi112
-rw-r--r--Build/source/texk/kpathsea/tex-file.c44
-rw-r--r--Build/source/texk/kpathsea/tex-make.c48
-rw-r--r--Build/source/texk/kpathsea/texmf.cnf12
6 files changed, 319 insertions, 173 deletions
diff --git a/Build/source/texk/kpathsea/ChangeLog b/Build/source/texk/kpathsea/ChangeLog
index 738b1c0acfa..e5547f58cda 100644
--- a/Build/source/texk/kpathsea/ChangeLog
+++ b/Build/source/texk/kpathsea/ChangeLog
@@ -1,3 +1,19 @@
+2023-10-09 Karl Berry <karl@freefriends.org>
+
+ * tex-file.c (kpathsea_name_ok): also allow files under
+ the TEXMF_OUTPUT_DIRECTORY envvar.
+ * tex-make.c (misstex): first try writing missfont.log in
+ TEXMF_OUTPUT_DIRECTORY, if it's set. Update unit test.
+ * doc/kpathsea.texi (mktex script names): mention
+ TEXMF_OUTPUT_DIRECTORY as new first location for missfont.log.
+ (Calling sequence) <kpathsea_out_name_ok>: also mention
+ TEXMF_OUTPUT_DIRECTORY, and kpsewhich's --safe-{in,out}-name options.
+ * texmf.cnf: mention that TEXMF_OUTPUT_DIRECTORY must be set in
+ the environment, and emphasize caveats.
+
+ * doc/kpathsea.texi (Specially-recognized files): reword
+ to avoid underfull line.
+
2023-08-11 TANAKA Takuji <ttk@t-lab.opal.ne.jp>
* tests/{cnfline,cnfnewline,cnfnull,cnfprog,kpsestat,kpsewhich}.test:
diff --git a/Build/source/texk/kpathsea/doc/kpathsea.info b/Build/source/texk/kpathsea/doc/kpathsea.info
index 32cddefe1b5..9dc59db8881 100644
--- a/Build/source/texk/kpathsea/doc/kpathsea.info
+++ b/Build/source/texk/kpathsea/doc/kpathsea.info
@@ -37,7 +37,7 @@ Kpathsea library
****************
This manual documents the Kpathsea library for path searching. It
-corresponds to version 6.3.5, released in February 2023.
+corresponds to version 6.3.5, released in October 2023.
* Menu:
@@ -62,7 +62,7 @@ File: kpathsea.info, Node: Introduction, Next: unixtex.ftp, Prev: Top, Up: T
**************
This manual corresponds to version 6.3.5 of the Kpathsea library,
-released in February 2023.
+released in October 2023.
The library's fundamental purpose is to return a filename from a list
of directories specified by the user, similar to what shells do when
@@ -1235,9 +1235,10 @@ filename, and returns the first file found.
'-D' is a synonym, for compatibility with Dvips. Default is 600.
'--engine=NAME'
- Set the engine name to NAME. By default it is not set. The engine
- name is used in some search paths to allow files with the same name
- but used by different engines to coexist.
+ Set the engine name to NAME. By default it is not set in
+ 'kpsewhich' (TeX engines set it to the appropriate string). The
+ engine name is used in some search paths to allow files with the
+ same name but used by different engines to coexist.
In particular, since the memory dump files ('.fmt'/'.base'/'.mem')
are now stored in subdirectories named for the engine ('tex',
@@ -1473,9 +1474,9 @@ their corresponding format:
A user-specified format will override the above defaults.
- Another useful configuration file in this regard is 'tcfmgr.map',
-found in 'texmf/texconfig/tcfmgr.map', which records various information
-about the above configuration files (among others).
+ Another reference for information about TeX's many special files is
+'tcfmgr.map', found in 'texmf/texconfig/tcfmgr.map', which records
+various information about the above configuration files (among others).

File: kpathsea.info, Node: Auxiliary tasks, Next: Standard options, Prev: Specially-recognized files, Up: Invoking kpsewhich
@@ -2289,17 +2290,20 @@ file types which support runtime generation.
('.tfm') TFM files.
These names can be overridden by an environment variable specific to the
-program--for example, 'DVIPSMAKEPK' for Dvipsk.
+program; for example, 'DVIPSMAKEPK' for Dvipsk.
If a 'mktex...' script fails, the invocation is appended to a file
-'missfont.log' (by default) in the current directory. You can then
-execute the log file to create the missing files after fixing the
-problem.
+'missfont.log' (by default) in the current directory. After fixing the
+problem, you can then execute the log file to create the missing files.
- If the current directory is not writable and the environment variable
-or configuration file value 'TEXMFOUTPUT' is set, its value is used.
-Otherwise, nothing is written. The name 'missfont.log' is overridden by
-the 'MISSFONT_LOG' environment variable or configuration file value.
+ If the environment variable 'TEXMF_OUTPUT_DIRECTORY' is set,
+'missfont.log' is first tried to be written there; if it's not set, the
+current directory is tried first. If that first write fails and the
+environment variable or configuration file value 'TEXMFOUTPUT' is set,
+we try to write 'missfont.log' there. Otherwise nothing is written.
+
+ The base filename 'missfont.log' is overridden by the 'MISSFONT_LOG'
+environment variable or configuration file value.

File: kpathsea.info, Node: mktex script arguments, Prev: mktex script names, Up: mktex scripts
@@ -2482,31 +2486,49 @@ this:
etc.). In other words, if you are looking up a VF or some other
file that need not exist, don't use this.
- 9. TeX can write output files, via the '\openout' primitive; this
- opens a security hole vulnerable to Trojan horse attack: an
- unwitting user could run a TeX program that overwrites, say,
- '~/.rhosts'. Analogous security holes exist for many other
- programs. To alleviate this, there is a configuration variable
- 'openout_any', which selects one of three levels of security. When
- it is set to 'a' (for "any"), no restrictions are imposed. When it
- is set to 'r' (for "restricted"), filenames beginning with '.' are
- disallowed (except '.tex' because LaTeX needs it). When it is set
- to 'p' (for "paranoid") additional restrictions are imposed: an
- absolute filename must refer to a file in (a subdirectory) of
- 'TEXMFOUTPUT', and any attempt to go up a directory level is
- forbidden (that is, paths may not contain a '..' component). The
- paranoid setting is the default. (For backwards compatibility, 'y'
- and '1' are synonyms of 'a', while 'n' and '0' are synonyms for
- 'r'.) The function 'kpathsea_out_name_ok', with a filename as
- second argument, returns 'true' if that filename is acceptable to
- be opend for output or 'false' otherwise.
+ 9. TeX can write output files, via the '\openout' primitive. This
+ opens a security vulnerability: an unwitting user could run a TeX
+ document that overwrites, say, '~/.profile'. Analogous
+ vulnerabilities exist for almost any program that can write files,
+ but since users expect TeX to typeset documents, not overwrite
+ personal files, it's desirable to handle this. To alleviate it,
+ there is a configuration variable 'openout_any', which selects one
+ of three levels of security:
+
+ * When set to 'a' (for "any"), no restrictions are imposed.
+
+ * When is set to 'r' (for "restricted"), filenames beginning
+ with '.' are disallowed (except '.tex', because LaTeX needs
+ it).
+
+ * When set to 'p' (for "paranoid"), additional restrictions are
+ imposed. First, an absolute filename must refer to a file in
+ (or in a subdirectory of) either the 'TEXMF_OUTPUT_DIRECTORY'
+ environment variable or the 'TEXMFOUTPUT' environment variable
+ or configuration file setting. Second, any attempt to go up a
+ directory level is forbidden; that is, paths may not contain a
+ '..' component.
+
+ * For backwards compatibility, 'y' and '1' are synonyms of 'a',
+ while 'n' and '0' are synonyms for 'r'.
+
+ The paranoid setting is the default. Any program intended to be
+ safely called from TeX should implement the same measures, one way
+ or another. *Note (web2c)Shell escapes::.
+
+ The function 'kpathsea_out_name_ok', with a filename as second
+ argument, returns 'true' if that filename is acceptable to be
+ opened for output or 'false' otherwise. The Kpsewhich program has
+ options '--safe-in-name' and '--safe-out-name' to provide a command
+ line interface for the checking.
10. Similarly, the function 'kpathsea_in_name_ok', with a filename as
second argument, returns 'true' if that filename is acceptable to
be opend for input or 'false' otherwise, depending on the value of
- the configuration variable 'openin_any' (with 'a' as default).
+ the configuration variable 'openin_any' (with 'a' as default; too
+ many system directories are involved to make 'p' feasible).
- 11. To close the kpathsea library instance you are using, call
+ 11. To close the Kpathsea library instance you are using, call
'kpathsea_finish'. This function closes any open log files and
frees the memory used by the instance.
@@ -3054,30 +3076,30 @@ Index
* --expand-path=STRING: Auxiliary tasks. (line 16)
* --expand-var=STRING: Auxiliary tasks. (line 34)
* --format=NAME: Path searching options.
- (line 69)
+ (line 70)
* --help: Standard options. (line 8)
* --help-formats: Auxiliary tasks. (line 42)
* --interactive: Path searching options.
- (line 151)
+ (line 152)
* --mktex=FILETYPE: Path searching options.
- (line 156)
+ (line 157)
* --mode=STRING: Path searching options.
- (line 162)
+ (line 163)
* --must-exist: Path searching options.
- (line 167)
+ (line 168)
* --no-casefold-search: Path searching options.
(line 19)
* --no-mktex=FILETYPE: Path searching options.
- (line 156)
+ (line 157)
* --path=STRING: Path searching options.
- (line 172)
+ (line 173)
* --progname=NAME: Path searching options.
- (line 180)
+ (line 181)
* --safe-in-name=NAME: Auxiliary tasks. (line 48)
* --safe-out-name=NAME: Auxiliary tasks. (line 48)
* --show-path=NAME: Auxiliary tasks. (line 54)
* --subdir=STRING: Path searching options.
- (line 185)
+ (line 186)
* --var-brace-value=VARIABLE: Auxiliary tasks. (line 60)
* --var-value=VARIABLE: Auxiliary tasks. (line 74)
* --version: Standard options. (line 11)
@@ -3255,7 +3277,7 @@ Index
* arguments to mktex: mktex script arguments.
(line 6)
* argv[0]: Calling sequence. (line 14)
-* autoconf, recommended: Calling sequence. (line 117)
+* autoconf, recommended: Calling sequence. (line 135)
* automounter, and ls-R: ls-R. (line 46)
* auxiliary tasks: Auxiliary tasks. (line 6)
* Bach, Johann Sebastian: Default expansion. (line 41)
@@ -3279,7 +3301,7 @@ Index
* bug checklist: Bug checklist. (line 6)
* bug mailing list: Mailing lists. (line 6)
* bugs, reporting: Reporting bugs. (line 6)
-* c-*.h: Calling sequence. (line 117)
+* c-*.h: Calling sequence. (line 135)
* c-auto.h: Programming overview.
(line 35)
* cache of fonts, local: Security. (line 22)
@@ -3482,7 +3504,7 @@ Index
* group-writable directories: Security. (line 40)
* GSFTOPK_DEBUG (128): Debugging. (line 88)
* hash table buckets, printing: Debugging. (line 105)
-* hash table routines: Calling sequence. (line 110)
+* hash table routines: Calling sequence. (line 128)
* hash_summary_only variable for debugging: Debugging. (line 105)
* history of Kpathsea: History. (line 6)
* Hoekwater, Taco: History. (line 78)
@@ -3492,9 +3514,9 @@ Index
* include fontmap directive: Fontmap. (line 36)
* INDEXSTYLE: Supported file formats.
(line 84)
-* input lines, reading: Calling sequence. (line 110)
+* input lines, reading: Calling sequence. (line 128)
* interactive query: Path searching options.
- (line 151)
+ (line 152)
* interface, not frozen: Introduction. (line 29)
* introduction: Introduction. (line 6)
* kdebug:: Debugging. (line 105)
@@ -3511,10 +3533,10 @@ Index
* kpathsea_find_file: File lookup. (line 38)
* kpathsea_find_file <1>: Calling sequence. (line 62)
* kpathsea_find_glyph: Glyph lookup. (line 26)
-* kpathsea_finish: Calling sequence. (line 106)
+* kpathsea_finish: Calling sequence. (line 124)
* kpathsea_init_prog: Fallback font. (line 15)
* kpathsea_init_prog <1>: Calling sequence. (line 53)
-* kpathsea_in_name_ok: Calling sequence. (line 101)
+* kpathsea_in_name_ok: Calling sequence. (line 118)
* kpathsea_new: Calling sequence. (line 9)
* kpathsea_open_file: Calling sequence. (line 74)
* kpathsea_out_name_ok: Calling sequence. (line 82)
@@ -3551,7 +3573,7 @@ Index
* license for using the library: Introduction. (line 32)
* LIGFONTS: Supported file formats.
(line 88)
-* lines, reading arbitrary-length: Calling sequence. (line 110)
+* lines, reading arbitrary-length: Calling sequence. (line 128)
* Linux File System Standard: mktex configuration. (line 113)
* local cache of fonts: Security. (line 22)
* log file: Logging. (line 6)
@@ -3574,7 +3596,7 @@ Index
* mailing lists: Mailing lists. (line 6)
* MAKETEX_DEBUG (512): Debugging. (line 91)
* MAKETEX_FINE_DEBUG (1024): Debugging. (line 100)
-* memory allocation routines: Calling sequence. (line 110)
+* memory allocation routines: Calling sequence. (line 128)
* metafont driver files: mktex configuration. (line 93)
* Metafont failures: TeX or Metafont failing.
(line 6)
@@ -3597,7 +3619,7 @@ Index
* mismatched checksum warnings: Suppressing warnings.
(line 17)
* missfont.log: mktex script names. (line 35)
-* MISSFONT_LOG: mktex script names. (line 40)
+* MISSFONT_LOG: mktex script names. (line 45)
* missing character warnings: Suppressing warnings.
(line 20)
* mkocp: mktex script names. (line 18)
@@ -3651,6 +3673,7 @@ Index
(line 145)
* online Metafont display, spurious: Unable to generate fonts.
(line 36)
+* openout_any: Calling sequence. (line 82)
* OPENTYPEFONTS: Supported file formats.
(line 149)
* optimization caveat: TeX or Metafont failing.
@@ -3665,6 +3688,7 @@ Index
(line 158)
* OVPFONTS: Supported file formats.
(line 161)
+* paranoid mode, for output files: Calling sequence. (line 97)
* path expansion: Path expansion. (line 6)
* path searching: Path searching. (line 6)
* path searching options: Path searching options.
@@ -3713,7 +3737,7 @@ Index
(line 16)
* readable: Suppressing warnings.
(line 26)
-* reading arbitrary-length lines: Calling sequence. (line 110)
+* reading arbitrary-length lines: Calling sequence. (line 128)
* recording successful searches: Logging. (line 6)
* relative filenames: Searching overview. (line 58)
* reporting bugs: Reporting bugs. (line 6)
@@ -3721,6 +3745,7 @@ Index
* resolution, setting: Path searching options.
(line 49)
* resolutions, last-resort: Fallback font. (line 6)
+* restricted mode, for output files: Calling sequence. (line 93)
* retrieving TeX: unixtex.ftp. (line 6)
* right-hand side of variable assignments: Config files. (line 57)
* RISINPUTS: Supported file formats.
@@ -3763,7 +3788,7 @@ Index
* standard error and debugging output: Debugging. (line 27)
* standard options: Standard options. (line 6)
* startup time, excessive: Slow path searching. (line 6)
-* string routines: Calling sequence. (line 110)
+* string routines: Calling sequence. (line 128)
* strip: mktex configuration. (line 107)
* stripsupplier: mktex configuration. (line 101)
* striptypeface: mktex configuration. (line 104)
@@ -3867,12 +3892,17 @@ Index
* TEXMFINI <2>: Supported file formats.
(line 101)
* TEXMFLOG: Logging. (line 10)
-* TEXMFOUTPUT: mktex script names. (line 40)
+* TEXMFOUTPUT, and missfont.log: mktex script names. (line 39)
+* TEXMFOUTPUT, and paranoid output files: Calling sequence. (line 97)
* TEXMFSCRIPTS: Supported file formats.
(line 195)
* texmfvar: mktex configuration. (line 122)
* TEXMFVAR: mktex configuration. (line 123)
* texmf_casefold_search: Casefolding search. (line 12)
+* TEXMF_OUTPUT_DIRECTORY, and missfont.log: mktex script names.
+ (line 39)
+* TEXMF_OUTPUT_DIRECTORY, and paranoid output files: Calling sequence.
+ (line 97)
* TEXPICTS: Supported file formats.
(line 79)
* TEXPKS: Supported file formats.
@@ -3921,6 +3951,7 @@ Index
* unreadable file warnings: Suppressing warnings.
(line 27)
* unreadable files: Searching overview. (line 63)
+* unrestricted mode, for output files: Calling sequence. (line 91)
* unusable ls-R warning: ls-R. (line 51)
* usage patterns, finding: Logging. (line 6)
* USERPROFILE, as ~ expansion: Tilde expansion. (line 6)
@@ -3967,61 +3998,62 @@ Index

Tag Table:
Node: Top1480
-Node: Introduction2263
-Node: History4333
-Node: unixtex.ftp8929
-Node: Security10399
-Node: TeX directory structure12903
-Node: Path searching16942
-Node: Searching overview17900
-Node: Path sources21719
-Node: Config files22945
-Node: Path expansion27817
-Node: Default expansion28770
-Node: Variable expansion30840
-Node: Tilde expansion32241
-Node: Brace expansion33221
-Node: KPSE_DOT expansion34160
-Node: Subdirectory expansion34673
-Node: Casefolding search37021
-Node: Casefolding rationale37790
-Node: Casefolding examples39136
-Node: Filename database44182
-Node: ls-R45164
-Node: Filename aliases48840
-Node: Database format50018
-Node: Invoking kpsewhich51031
-Node: Path searching options51986
-Node: Specially-recognized files61589
-Node: Auxiliary tasks62944
-Node: Standard options66669
-Node: TeX support67025
-Node: Supported file formats68379
-Node: File lookup76198
-Node: Glyph lookup77947
-Node: Basic glyph lookup79071
-Node: Fontmap79951
-Node: Fallback font82461
-Node: Suppressing warnings83373
-Node: mktex scripts84500
-Node: mktex configuration85715
-Node: mktex script names91518
-Node: mktex script arguments92904
-Node: Programming93783
-Node: Programming overview94356
-Node: Calling sequence97217
-Node: Program-specific files103746
-Node: Programming with config files104769
-Node: Reporting bugs106356
-Node: Bug checklist107034
-Node: Mailing lists110503
-Node: Debugging111180
-Node: Logging116257
-Node: Common problems118124
-Node: Unable to find files118601
-Node: Slow path searching121011
-Node: Unable to generate fonts122386
-Node: TeX or Metafont failing124858
-Node: Index126060
+Node: Introduction2262
+Node: History4331
+Node: unixtex.ftp8927
+Node: Security10397
+Node: TeX directory structure12901
+Node: Path searching16940
+Node: Searching overview17898
+Node: Path sources21717
+Node: Config files22943
+Node: Path expansion27815
+Node: Default expansion28768
+Node: Variable expansion30838
+Node: Tilde expansion32239
+Node: Brace expansion33219
+Node: KPSE_DOT expansion34158
+Node: Subdirectory expansion34671
+Node: Casefolding search37019
+Node: Casefolding rationale37788
+Node: Casefolding examples39134
+Node: Filename database44180
+Node: ls-R45162
+Node: Filename aliases48838
+Node: Database format50016
+Node: Invoking kpsewhich51029
+Node: Path searching options51984
+Node: Specially-recognized files61654
+Node: Auxiliary tasks63025
+Node: Standard options66750
+Node: TeX support67106
+Node: Supported file formats68460
+Node: File lookup76279
+Node: Glyph lookup78028
+Node: Basic glyph lookup79152
+Node: Fontmap80032
+Node: Fallback font82542
+Node: Suppressing warnings83454
+Node: mktex scripts84581
+Node: mktex configuration85796
+Node: mktex script names91599
+Node: mktex script arguments93170
+Node: Programming94049
+Node: Programming overview94622
+Node: Calling sequence97483
+Ref: openout_any101641
+Node: Program-specific files104692
+Node: Programming with config files105715
+Node: Reporting bugs107302
+Node: Bug checklist107980
+Node: Mailing lists111449
+Node: Debugging112126
+Node: Logging117203
+Node: Common problems119070
+Node: Unable to find files119547
+Node: Slow path searching121957
+Node: Unable to generate fonts123332
+Node: TeX or Metafont failing125804
+Node: Index127006

End Tag Table
diff --git a/Build/source/texk/kpathsea/doc/kpathsea.texi b/Build/source/texk/kpathsea/doc/kpathsea.texi
index ce95244b31a..ad1aec64583 100644
--- a/Build/source/texk/kpathsea/doc/kpathsea.texi
+++ b/Build/source/texk/kpathsea/doc/kpathsea.texi
@@ -3,7 +3,7 @@
@settitle Kpathsea: A library for path searching
@set version 6.3.5
-@set month-year February 2023
+@set month-year October 2023
@copying
This file documents the Kpathsea library for path searching.
@@ -1535,9 +1535,10 @@ Dvips. Default is 600.
@item --engine=@var{name}
@opindex --engine=@var{name}
@cindex engine name
-Set the engine name to @var{name}. By default it is not set. The
-engine name is used in some search paths to allow files with the same
-name but used by different engines to coexist.
+Set the engine name to @var{name}. By default it is not set in
+@code{kpsewhich} (@TeX{} engines set it to the appropriate string).
+The engine name is used in some search paths to allow files with the
+same name but used by different engines to coexist.
In particular, since the memory dump files
(@file{.fmt}/@file{.base}/@file{.mem}) are now stored in
@@ -1822,9 +1823,10 @@ look for the file @file{pdftexconfig.tex} instead.)
A user-specified format will override the above defaults.
@flindex tcfmgr.map
-Another useful configuration file in this regard is @file{tcfmgr.map},
-found in @file{texmf/texconfig/tcfmgr.map}, which records various
-information about the above configuration files (among others).
+Another reference for information about @TeX{}'s many special files is
+@file{tcfmgr.map}, found in @file{texmf/texconfig/tcfmgr.map}, which
+records various information about the above configuration files (among
+others).
@node Auxiliary tasks
@@ -3018,23 +3020,28 @@ formats. This script is also named @command{fmtutil}, and reads
@vindex XDVIMAKEPK
@vindex DVILJMAKEPK
@noindent These names can be overridden by an environment variable specific
-to the program---for example, @code{DVIPSMAKEPK} for Dvipsk.
+to the program; for example, @code{DVIPSMAKEPK} for Dvipsk.
@comment next two paragraphs are repeated in dvips.texi
@flindex missfont.log
@cindex failed @code{mktex@dots{}} script invocation
If a @code{mktex@dots{}} script fails, the invocation is appended to a
-file @file{missfont.log} (by default) in the current directory. You can
-then execute the log file to create the missing files after fixing the
-problem.
+file @file{missfont.log} (by default) in the current directory. After
+fixing the problem, you can then execute the log file to create the
+missing files.
+
+@vindex TEXMF_OUTPUT_DIRECTORY@r{, and @file{missfont.log}}
+@vindex TEXMFOUTPUT@r{, and @file{missfont.log}}
+If the environment variable @code{TEXMF_OUTPUT_DIRECTORY} is set,
+@file{missfont.log} is first tried to be written there; if it's not
+set, the current directory is tried first. If that first write fails
+and the environment variable or configuration file value
+@code{TEXMFOUTPUT} is set, we try to write @file{missfont.log} there.
+Otherwise nothing is written.
-@vindex TEXMFOUTPUT
@vindex MISSFONT_LOG
-If the current directory is not writable and the environment variable or
-configuration file value @code{TEXMFOUTPUT} is set, its value is
-used. Otherwise, nothing is written. The name @samp{missfont.log} is
-overridden by the @code{MISSFONT_LOG} environment variable or
-configuration file value.
+The base filename @samp{missfont.log} is overridden by the
+@code{MISSFONT_LOG} environment variable or configuration file value.
@node mktex script arguments
@@ -3261,34 +3268,67 @@ exist, don't use this.
@item
@findex kpathsea_out_name_ok
-@TeX{} can write output files, via the @code{\openout} primitive; this opens
-a security hole vulnerable to Trojan horse attack: an unwitting user could
-run a @TeX{} program that overwrites, say, @file{~/.rhosts}. Analogous
-security holes exist for many other programs. To alleviate this, there is a
-configuration variable @code{openout_any}, which selects one of three levels
-of security. When it is set to @samp{a} (for ``any''), no restrictions are
-imposed. When it is set to @samp{r} (for ``restricted''), filenames
-beginning with @samp{.} are disallowed (except @file{.tex} because @LaTeX{}
-needs it). When it is set to @samp{p} (for ``paranoid'') additional
-restrictions are imposed: an absolute filename must refer to a file in (a
-subdirectory) of @code{TEXMFOUTPUT}, and any attempt to go up a directory
-level is forbidden (that is, paths may not contain a @samp{..} component).
-The paranoid setting is the default. (For backwards compatibility, @samp{y}
-and @samp{1} are synonyms of @samp{a}, while @samp{n} and @samp{0} are
-synonyms for @samp{r}.) The function @code{kpathsea_out_name_ok}, with a
-filename as second argument, returns @code{true} if that filename is
-acceptable to be opend for output or @code{false} otherwise.
+@vindex openout_any
+@anchor{openout_any}
+@TeX{} can write output files, via the @code{\openout} primitive. This
+opens a security vulnerability: an unwitting user could run a @TeX{}
+document that overwrites, say, @file{~/.profile}. Analogous
+vulnerabilities exist for almost any program that can write files, but
+since users expect @TeX{} to typeset documents, not overwrite personal
+files, it's desirable to handle this. To alleviate it, there is a
+configuration variable @code{openout_any}, which selects one of three
+levels of security:
+
+@itemize
+@item
+@cindex unrestricted mode, for output files
+When set to @samp{a} (for ``any''), no restrictions are imposed.
+
+@item
+@cindex restricted mode, for output files
+When is set to @samp{r} (for ``restricted''), filenames beginning
+with @samp{.} are disallowed (except @file{.tex}, because @LaTeX{}
+needs it).
+
+@item
+@cindex paranoid mode, for output files
+@vindex TEXMF_OUTPUT_DIRECTORY@r{, and paranoid output files}
+@vindex TEXMFOUTPUT@r{, and paranoid output files}
+When set to @samp{p} (for ``paranoid''), additional restrictions are
+imposed. First, an absolute filename must refer to a file in (or in a
+subdirectory of) either the @code{TEXMF_OUTPUT_DIRECTORY} environment
+variable or the @code{TEXMFOUTPUT} environment variable or
+configuration file setting. Second, any attempt to go up a directory
+level is forbidden; that is, paths may not contain a @samp{..}
+component.
+
+@item
+For backwards compatibility, @samp{y} and @samp{1} are synonyms of
+@samp{a}, while @samp{n} and @samp{0} are synonyms for @samp{r}.
+
+@end itemize
+
+The paranoid setting is the default. Any program intended to be safely
+called from @TeX{} should implement the same measures, one way or
+another. @xref{Shell escapes,,, web2c, Web2c}.
+
+The function @code{kpathsea_out_name_ok}, with a filename as second
+argument, returns @code{true} if that filename is acceptable to be
+opened for output or @code{false} otherwise. The Kpsewhich program
+has options @samp{--safe-in-name} and @samp{--safe-out-name} to
+provide a command line interface for the checking.
@item
@findex kpathsea_in_name_ok
Similarly, the function @code{kpathsea_in_name_ok}, with a filename as
second argument, returns @code{true} if that filename is acceptable to be
opend for input or @code{false} otherwise, depending on the value of the
-configuration variable @code{openin_any} (with @samp{a} as default).
+configuration variable @code{openin_any} (with @samp{a} as default;
+too many system directories are involved to make @samp{p} feasible).
@item
@findex kpathsea_finish
-To close the kpathsea library instance you are using, call
+To close the Kpathsea library instance you are using, call
@code{kpathsea_finish}. This function closes any open log files and
frees the memory used by the instance.
diff --git a/Build/source/texk/kpathsea/tex-file.c b/Build/source/texk/kpathsea/tex-file.c
index 335f13b45f4..6ece0ff5c4b 100644
--- a/Build/source/texk/kpathsea/tex-file.c
+++ b/Build/source/texk/kpathsea/tex-file.c
@@ -1,7 +1,7 @@
/* tex-file.c: high-level file searching by format.
Copyright 1993, 1994, 1995, 1996, 1997, 2007, 2008, 2009, 2010, 2011
- 2012, 2014, 2016, 2017, 2019 Karl Berry.
+ 2012, 2014, 2016, 2017, 2019, 2023 Karl Berry.
Copyright 1998-2005 Olaf Weber.
This library is free software; you can redistribute it and/or
@@ -1194,11 +1194,14 @@ kpathsea_name_ok (kpathsea kpse, const_string fname, const_string check_var,
'r' (restricted) means disallowing special file names.
'p' (paranoid) means being really paranoid: disallowing special file
names and restricting output files to be in or below
- the working directory or $TEXMFOUTPUT, while input files
- must be below the current directory, $TEXMFOUTPUT, or
- (implicitly) in the system areas.
+ the working directory or $TEXMFOUTPUT or
+ $TEXMF_OUTPUT_DIRECTORY, while input files
+ must be below the current directory, the envvars, or
+ (only implicitly) in the system areas.
We default to "paranoid". The error messages from TeX may be puzzling.
- This function contains several return and goto statements, be careful. */
+ This function contains several return and goto statements, be careful.
+
+ Paranoia originally supplied by Charles Karney. */
const_string open_choice = kpathsea_var_value (kpse, check_var);
@@ -1231,16 +1234,31 @@ kpathsea_name_ok (kpathsea kpse, const_string fname, const_string check_var,
if (*open_choice == 'r' || *open_choice == 'n' || *open_choice == '0')
return true;
- /* Paranoia originally supplied by Charles Karney. */
if (kpathsea_absolute_p (kpse, fname, false)) {
- const_string texmfoutput = kpathsea_var_value (kpse, "TEXMFOUTPUT");
- /* Absolute pathname is only OK if TEXMFOUTPUT is set, it's not empty,
- fname begins the TEXMFOUTPUT, and is followed by / */
- if (!texmfoutput || *texmfoutput == '\0'
- || fname != strstr (fname, texmfoutput)
- || !IS_DIR_SEP (fname[strlen (texmfoutput)]))
- goto not_ok;
+
+ /* fname can be an absolute pathname only if one of the TEXMF*
+ variables is set, is non-empty, the value is the beginning of
+ fname, and the next character in fname is a directory separator. */
+
+ /* We'll check TEXMF_OUTPUT_DIRECTORY first. This must be an
+ environment variable, not a configuration file setting. */
+ const_string texmfoutdir = getenv ("TEXMF_OUTPUT_DIRECTORY");
+ if (!texmfoutdir || *texmfoutdir == '\0'
+ || fname != strstr (fname, texmfoutdir)
+ || !IS_DIR_SEP (fname[strlen (texmfoutdir)])) {
+
+ /* Ok, that didn't work. Check TEXMFOUTPUT in exactly the same
+ way, except it can be in the configuration file. */
+ const_string texmfoutput
+ = kpathsea_var_value (kpse, "TEXMFOUTPUT");
+ if (!texmfoutput || *texmfoutput == '\0'
+ || fname != strstr (fname, texmfoutput)
+ || !IS_DIR_SEP (fname[strlen (texmfoutput)])) {
+ goto not_ok;
+ }
+ }
}
+
/* For all pathnames, we disallow "../" at the beginning or "/../"
anywhere. */
if (fname[0] == '.' && fname[1] == '.' && IS_DIR_SEP(fname[2]))
diff --git a/Build/source/texk/kpathsea/tex-make.c b/Build/source/texk/kpathsea/tex-make.c
index 530c6ffe535..7a964b48529 100644
--- a/Build/source/texk/kpathsea/tex-make.c
+++ b/Build/source/texk/kpathsea/tex-make.c
@@ -1,6 +1,6 @@
/* tex-make.c: run external programs to make TeX-related files.
- Copyright 1993, 1994, 1995, 1996, 1997, 2008-2020 Karl Berry.
+ Copyright 1993, 1994, 1995, 1996, 1997, 2008-2023 Karl Berry.
Copyright 1997, 1998, 2001-05 Olaf Weber.
This library is free software; you can redistribute it and/or
@@ -18,6 +18,7 @@
#include <kpathsea/config.h>
+#include <kpathsea/absolute.h>
#include <kpathsea/c-fopen.h>
#include <kpathsea/c-pathch.h>
#include <kpathsea/db.h>
@@ -106,7 +107,9 @@ misstex (kpathsea kpse, kpse_file_format_type format, string *args)
/* If this is the first time, have to open the log file. But don't
bother logging anything if they were discarding errors. */
if (!kpse->missfont && !kpse->make_tex_discard_errors) {
+ string first_name;
const_string missfont_name = kpathsea_var_value (kpse, "MISSFONT_LOG");
+
if (!missfont_name || *missfont_name == '1') {
missfont_name = "missfont.log"; /* take default name */
} else if (missfont_name
@@ -114,9 +117,25 @@ misstex (kpathsea kpse, kpse_file_format_type format, string *args)
missfont_name = NULL; /* user requested no missfont.log */
} /* else use user's name */
+ /* If the given name is not already absolute,
+ and TEXMF_OUTPUT_DIRECTORY is set, use that instead of cwd.
+ This is only an envvar, not a config file value. */
+ if (!kpathsea_absolute_p (kpse, missfont_name, false)
+ && getenv ("TEXMF_OUTPUT_DIRECTORY")) {
+ first_name = concat3 (getenv ("TEXMF_OUTPUT_DIRECTORY"),
+ DIR_SEP_STRING, missfont_name);
+ } else {
+ first_name = xstrdup (missfont_name);
+ }
kpse->missfont
- = missfont_name ? fopen (missfont_name, FOPEN_A_MODE) : NULL;
- if (!kpse->missfont && kpathsea_var_value (kpse, "TEXMFOUTPUT")) {
+ = missfont_name ? fopen (first_name, FOPEN_A_MODE) : NULL;
+
+ /* If that succeeded, save the name for output below. */
+ if (kpse->missfont) {
+ missfont_name = first_name;
+
+ /* If that failed, try TEXMFOUTPUT. */
+ } else if (kpathsea_var_value (kpse, "TEXMFOUTPUT")) {
missfont_name = concat3 (kpathsea_var_value (kpse, "TEXMFOUTPUT"),
DIR_SEP_STRING, missfont_name);
kpse->missfont = fopen (missfont_name, FOPEN_A_MODE);
@@ -125,6 +144,9 @@ misstex (kpathsea kpse, kpse_file_format_type format, string *args)
if (kpse->missfont)
fprintf (stderr, "kpathsea: Appending font creation commands to %s.\n",
missfont_name);
+
+ /* Uselessly save memory. */
+ free (first_name);
}
/* Write the command if we have a log file. */
@@ -530,15 +552,23 @@ int
main (int argc, char **argv)
{
kpathsea kpse = xcalloc(1, sizeof(kpathsea_instance));
- kpathsea_set_program_name(kpse, argv[0], NULL);
+ kpathsea_set_program_name (kpse, argv[0], NULL);
kpathsea_xputenv (kpse, "KPATHSEA_DPI", "781"); /* call mktexpk */
kpathsea_xputenv (kpse,"MAKETEX_BASE_DPI", "300"); /* call mktexpk */
- kpathsea_set_program_enabled(kpse, kpse_pk_format, 1, kpse_src_env);
+ kpathsea_set_program_enabled (kpse, kpse_pk_format, 1, kpse_src_env);
+
+ /* Succeed. */
test_make_tex (kpse, kpse_pk_format, "cmr10");
- /* Fail with mktextfm. */
- kpathsea_set_program_enabled(kpse, kpse_tfm_format, 1, kpse_src_env);
- test_make_tex (kpse, kpse_tfm_format, "foozler99");
+ /* Fail with mktextfm, writing missfont.log to a different directory. */
+ kpathsea_set_program_enabled (kpse, kpse_tfm_format, 1, kpse_src_env);
+ kpathsea_xputenv (kpse,"TEXMF_OUTPUT_DIRECTORY", "/tmp");
+ test_make_tex (kpse, kpse_tfm_format, "foozout99");
+
+ /* Since the missfont.log descriptor is cached, can only save in one
+ place in a given run, so don't bother doing it twice.
+ test_make_tex (kpse, kpse_tfm_format, "foozler98");
+ */
/* Call something disabled. */
test_make_tex (kpse, kpse_bst_format, "no-way");
@@ -551,6 +581,6 @@ main (int argc, char **argv)
/*
Local variables:
-standalone-compile-command: "gcc -g -I. -I.. -DTEST tex-make.c kpathsea.a"
+standalone-compile-command: "gcc -g -I. -I.. -I$wk/.. -DTEST -DMAKE_KPSE_DLL tex-make.c $wk/.libs/libkpathsea.a && ./a.out"
End:
*/
diff --git a/Build/source/texk/kpathsea/texmf.cnf b/Build/source/texk/kpathsea/texmf.cnf
index 21b0af293c3..4bc73d6bcf8 100644
--- a/Build/source/texk/kpathsea/texmf.cnf
+++ b/Build/source/texk/kpathsea/texmf.cnf
@@ -688,8 +688,18 @@ TEXMF_RESTRICTED_SCRIPTS = \
openin_any = a
openout_any = p
-% Write .log/.dvi/.aux/etc. files here, if the current directory is unwritable.
+% Write .log/.dvi/.aux/etc. files here, if they can't be written in the
+% current directory.
+%
+% Best to use this only when a particular job requires it, not set
+% globally in a configuration file or the environment.
%TEXMFOUTPUT = /tmp
+%
+% A related environment variable is TEXMF_OUTPUT_DIRECTORY. It
+% overrides the current directory for all output files in TeX and the other
+% engines. It cannot be set in a configuration file. And it's even more
+% important to use it only temporarily, when required, to avoid massive
+% confusion about where the output files are ending up.
% If a dynamic file creation fails, log the command to this file, in
% either the current directory or TEXMFOUTPUT. Set to the