diff options
author | Karl Berry <karl@freefriends.org> | 2023-10-10 22:01:41 +0000 |
---|---|---|
committer | Karl Berry <karl@freefriends.org> | 2023-10-10 22:01:41 +0000 |
commit | a0dc1ccfd20bcd453d4a31103c94c20754a0816b (patch) | |
tree | eb2b6356a146350e90c4c8a95f5ac3d341d0632e /Build/source/texk/kpathsea | |
parent | 1045e3f70340d9f7540d9c9328a282ee84f88a51 (diff) |
support new envvar TEXMF_OUTPUT_DIRECTORY
git-svn-id: svn://tug.org/texlive/trunk@68508 c570f23f-e606-0410-a88d-b1316a301751
Diffstat (limited to 'Build/source/texk/kpathsea')
-rw-r--r-- | Build/source/texk/kpathsea/ChangeLog | 16 | ||||
-rw-r--r-- | Build/source/texk/kpathsea/doc/kpathsea.info | 260 | ||||
-rw-r--r-- | Build/source/texk/kpathsea/doc/kpathsea.texi | 112 | ||||
-rw-r--r-- | Build/source/texk/kpathsea/tex-file.c | 44 | ||||
-rw-r--r-- | Build/source/texk/kpathsea/tex-make.c | 48 | ||||
-rw-r--r-- | Build/source/texk/kpathsea/texmf.cnf | 12 |
6 files changed, 319 insertions, 173 deletions
diff --git a/Build/source/texk/kpathsea/ChangeLog b/Build/source/texk/kpathsea/ChangeLog index 738b1c0acfa..e5547f58cda 100644 --- a/Build/source/texk/kpathsea/ChangeLog +++ b/Build/source/texk/kpathsea/ChangeLog @@ -1,3 +1,19 @@ +2023-10-09 Karl Berry <karl@freefriends.org> + + * tex-file.c (kpathsea_name_ok): also allow files under + the TEXMF_OUTPUT_DIRECTORY envvar. + * tex-make.c (misstex): first try writing missfont.log in + TEXMF_OUTPUT_DIRECTORY, if it's set. Update unit test. + * doc/kpathsea.texi (mktex script names): mention + TEXMF_OUTPUT_DIRECTORY as new first location for missfont.log. + (Calling sequence) <kpathsea_out_name_ok>: also mention + TEXMF_OUTPUT_DIRECTORY, and kpsewhich's --safe-{in,out}-name options. + * texmf.cnf: mention that TEXMF_OUTPUT_DIRECTORY must be set in + the environment, and emphasize caveats. + + * doc/kpathsea.texi (Specially-recognized files): reword + to avoid underfull line. + 2023-08-11 TANAKA Takuji <ttk@t-lab.opal.ne.jp> * tests/{cnfline,cnfnewline,cnfnull,cnfprog,kpsestat,kpsewhich}.test: diff --git a/Build/source/texk/kpathsea/doc/kpathsea.info b/Build/source/texk/kpathsea/doc/kpathsea.info index 32cddefe1b5..9dc59db8881 100644 --- a/Build/source/texk/kpathsea/doc/kpathsea.info +++ b/Build/source/texk/kpathsea/doc/kpathsea.info @@ -37,7 +37,7 @@ Kpathsea library **************** This manual documents the Kpathsea library for path searching. It -corresponds to version 6.3.5, released in February 2023. +corresponds to version 6.3.5, released in October 2023. * Menu: @@ -62,7 +62,7 @@ File: kpathsea.info, Node: Introduction, Next: unixtex.ftp, Prev: Top, Up: T ************** This manual corresponds to version 6.3.5 of the Kpathsea library, -released in February 2023. +released in October 2023. The library's fundamental purpose is to return a filename from a list of directories specified by the user, similar to what shells do when @@ -1235,9 +1235,10 @@ filename, and returns the first file found. '-D' is a synonym, for compatibility with Dvips. Default is 600. '--engine=NAME' - Set the engine name to NAME. By default it is not set. The engine - name is used in some search paths to allow files with the same name - but used by different engines to coexist. + Set the engine name to NAME. By default it is not set in + 'kpsewhich' (TeX engines set it to the appropriate string). The + engine name is used in some search paths to allow files with the + same name but used by different engines to coexist. In particular, since the memory dump files ('.fmt'/'.base'/'.mem') are now stored in subdirectories named for the engine ('tex', @@ -1473,9 +1474,9 @@ their corresponding format: A user-specified format will override the above defaults. - Another useful configuration file in this regard is 'tcfmgr.map', -found in 'texmf/texconfig/tcfmgr.map', which records various information -about the above configuration files (among others). + Another reference for information about TeX's many special files is +'tcfmgr.map', found in 'texmf/texconfig/tcfmgr.map', which records +various information about the above configuration files (among others). File: kpathsea.info, Node: Auxiliary tasks, Next: Standard options, Prev: Specially-recognized files, Up: Invoking kpsewhich @@ -2289,17 +2290,20 @@ file types which support runtime generation. ('.tfm') TFM files. These names can be overridden by an environment variable specific to the -program--for example, 'DVIPSMAKEPK' for Dvipsk. +program; for example, 'DVIPSMAKEPK' for Dvipsk. If a 'mktex...' script fails, the invocation is appended to a file -'missfont.log' (by default) in the current directory. You can then -execute the log file to create the missing files after fixing the -problem. +'missfont.log' (by default) in the current directory. After fixing the +problem, you can then execute the log file to create the missing files. - If the current directory is not writable and the environment variable -or configuration file value 'TEXMFOUTPUT' is set, its value is used. -Otherwise, nothing is written. The name 'missfont.log' is overridden by -the 'MISSFONT_LOG' environment variable or configuration file value. + If the environment variable 'TEXMF_OUTPUT_DIRECTORY' is set, +'missfont.log' is first tried to be written there; if it's not set, the +current directory is tried first. If that first write fails and the +environment variable or configuration file value 'TEXMFOUTPUT' is set, +we try to write 'missfont.log' there. Otherwise nothing is written. + + The base filename 'missfont.log' is overridden by the 'MISSFONT_LOG' +environment variable or configuration file value. File: kpathsea.info, Node: mktex script arguments, Prev: mktex script names, Up: mktex scripts @@ -2482,31 +2486,49 @@ this: etc.). In other words, if you are looking up a VF or some other file that need not exist, don't use this. - 9. TeX can write output files, via the '\openout' primitive; this - opens a security hole vulnerable to Trojan horse attack: an - unwitting user could run a TeX program that overwrites, say, - '~/.rhosts'. Analogous security holes exist for many other - programs. To alleviate this, there is a configuration variable - 'openout_any', which selects one of three levels of security. When - it is set to 'a' (for "any"), no restrictions are imposed. When it - is set to 'r' (for "restricted"), filenames beginning with '.' are - disallowed (except '.tex' because LaTeX needs it). When it is set - to 'p' (for "paranoid") additional restrictions are imposed: an - absolute filename must refer to a file in (a subdirectory) of - 'TEXMFOUTPUT', and any attempt to go up a directory level is - forbidden (that is, paths may not contain a '..' component). The - paranoid setting is the default. (For backwards compatibility, 'y' - and '1' are synonyms of 'a', while 'n' and '0' are synonyms for - 'r'.) The function 'kpathsea_out_name_ok', with a filename as - second argument, returns 'true' if that filename is acceptable to - be opend for output or 'false' otherwise. + 9. TeX can write output files, via the '\openout' primitive. This + opens a security vulnerability: an unwitting user could run a TeX + document that overwrites, say, '~/.profile'. Analogous + vulnerabilities exist for almost any program that can write files, + but since users expect TeX to typeset documents, not overwrite + personal files, it's desirable to handle this. To alleviate it, + there is a configuration variable 'openout_any', which selects one + of three levels of security: + + * When set to 'a' (for "any"), no restrictions are imposed. + + * When is set to 'r' (for "restricted"), filenames beginning + with '.' are disallowed (except '.tex', because LaTeX needs + it). + + * When set to 'p' (for "paranoid"), additional restrictions are + imposed. First, an absolute filename must refer to a file in + (or in a subdirectory of) either the 'TEXMF_OUTPUT_DIRECTORY' + environment variable or the 'TEXMFOUTPUT' environment variable + or configuration file setting. Second, any attempt to go up a + directory level is forbidden; that is, paths may not contain a + '..' component. + + * For backwards compatibility, 'y' and '1' are synonyms of 'a', + while 'n' and '0' are synonyms for 'r'. + + The paranoid setting is the default. Any program intended to be + safely called from TeX should implement the same measures, one way + or another. *Note (web2c)Shell escapes::. + + The function 'kpathsea_out_name_ok', with a filename as second + argument, returns 'true' if that filename is acceptable to be + opened for output or 'false' otherwise. The Kpsewhich program has + options '--safe-in-name' and '--safe-out-name' to provide a command + line interface for the checking. 10. Similarly, the function 'kpathsea_in_name_ok', with a filename as second argument, returns 'true' if that filename is acceptable to be opend for input or 'false' otherwise, depending on the value of - the configuration variable 'openin_any' (with 'a' as default). + the configuration variable 'openin_any' (with 'a' as default; too + many system directories are involved to make 'p' feasible). - 11. To close the kpathsea library instance you are using, call + 11. To close the Kpathsea library instance you are using, call 'kpathsea_finish'. This function closes any open log files and frees the memory used by the instance. @@ -3054,30 +3076,30 @@ Index * --expand-path=STRING: Auxiliary tasks. (line 16) * --expand-var=STRING: Auxiliary tasks. (line 34) * --format=NAME: Path searching options. - (line 69) + (line 70) * --help: Standard options. (line 8) * --help-formats: Auxiliary tasks. (line 42) * --interactive: Path searching options. - (line 151) + (line 152) * --mktex=FILETYPE: Path searching options. - (line 156) + (line 157) * --mode=STRING: Path searching options. - (line 162) + (line 163) * --must-exist: Path searching options. - (line 167) + (line 168) * --no-casefold-search: Path searching options. (line 19) * --no-mktex=FILETYPE: Path searching options. - (line 156) + (line 157) * --path=STRING: Path searching options. - (line 172) + (line 173) * --progname=NAME: Path searching options. - (line 180) + (line 181) * --safe-in-name=NAME: Auxiliary tasks. (line 48) * --safe-out-name=NAME: Auxiliary tasks. (line 48) * --show-path=NAME: Auxiliary tasks. (line 54) * --subdir=STRING: Path searching options. - (line 185) + (line 186) * --var-brace-value=VARIABLE: Auxiliary tasks. (line 60) * --var-value=VARIABLE: Auxiliary tasks. (line 74) * --version: Standard options. (line 11) @@ -3255,7 +3277,7 @@ Index * arguments to mktex: mktex script arguments. (line 6) * argv[0]: Calling sequence. (line 14) -* autoconf, recommended: Calling sequence. (line 117) +* autoconf, recommended: Calling sequence. (line 135) * automounter, and ls-R: ls-R. (line 46) * auxiliary tasks: Auxiliary tasks. (line 6) * Bach, Johann Sebastian: Default expansion. (line 41) @@ -3279,7 +3301,7 @@ Index * bug checklist: Bug checklist. (line 6) * bug mailing list: Mailing lists. (line 6) * bugs, reporting: Reporting bugs. (line 6) -* c-*.h: Calling sequence. (line 117) +* c-*.h: Calling sequence. (line 135) * c-auto.h: Programming overview. (line 35) * cache of fonts, local: Security. (line 22) @@ -3482,7 +3504,7 @@ Index * group-writable directories: Security. (line 40) * GSFTOPK_DEBUG (128): Debugging. (line 88) * hash table buckets, printing: Debugging. (line 105) -* hash table routines: Calling sequence. (line 110) +* hash table routines: Calling sequence. (line 128) * hash_summary_only variable for debugging: Debugging. (line 105) * history of Kpathsea: History. (line 6) * Hoekwater, Taco: History. (line 78) @@ -3492,9 +3514,9 @@ Index * include fontmap directive: Fontmap. (line 36) * INDEXSTYLE: Supported file formats. (line 84) -* input lines, reading: Calling sequence. (line 110) +* input lines, reading: Calling sequence. (line 128) * interactive query: Path searching options. - (line 151) + (line 152) * interface, not frozen: Introduction. (line 29) * introduction: Introduction. (line 6) * kdebug:: Debugging. (line 105) @@ -3511,10 +3533,10 @@ Index * kpathsea_find_file: File lookup. (line 38) * kpathsea_find_file <1>: Calling sequence. (line 62) * kpathsea_find_glyph: Glyph lookup. (line 26) -* kpathsea_finish: Calling sequence. (line 106) +* kpathsea_finish: Calling sequence. (line 124) * kpathsea_init_prog: Fallback font. (line 15) * kpathsea_init_prog <1>: Calling sequence. (line 53) -* kpathsea_in_name_ok: Calling sequence. (line 101) +* kpathsea_in_name_ok: Calling sequence. (line 118) * kpathsea_new: Calling sequence. (line 9) * kpathsea_open_file: Calling sequence. (line 74) * kpathsea_out_name_ok: Calling sequence. (line 82) @@ -3551,7 +3573,7 @@ Index * license for using the library: Introduction. (line 32) * LIGFONTS: Supported file formats. (line 88) -* lines, reading arbitrary-length: Calling sequence. (line 110) +* lines, reading arbitrary-length: Calling sequence. (line 128) * Linux File System Standard: mktex configuration. (line 113) * local cache of fonts: Security. (line 22) * log file: Logging. (line 6) @@ -3574,7 +3596,7 @@ Index * mailing lists: Mailing lists. (line 6) * MAKETEX_DEBUG (512): Debugging. (line 91) * MAKETEX_FINE_DEBUG (1024): Debugging. (line 100) -* memory allocation routines: Calling sequence. (line 110) +* memory allocation routines: Calling sequence. (line 128) * metafont driver files: mktex configuration. (line 93) * Metafont failures: TeX or Metafont failing. (line 6) @@ -3597,7 +3619,7 @@ Index * mismatched checksum warnings: Suppressing warnings. (line 17) * missfont.log: mktex script names. (line 35) -* MISSFONT_LOG: mktex script names. (line 40) +* MISSFONT_LOG: mktex script names. (line 45) * missing character warnings: Suppressing warnings. (line 20) * mkocp: mktex script names. (line 18) @@ -3651,6 +3673,7 @@ Index (line 145) * online Metafont display, spurious: Unable to generate fonts. (line 36) +* openout_any: Calling sequence. (line 82) * OPENTYPEFONTS: Supported file formats. (line 149) * optimization caveat: TeX or Metafont failing. @@ -3665,6 +3688,7 @@ Index (line 158) * OVPFONTS: Supported file formats. (line 161) +* paranoid mode, for output files: Calling sequence. (line 97) * path expansion: Path expansion. (line 6) * path searching: Path searching. (line 6) * path searching options: Path searching options. @@ -3713,7 +3737,7 @@ Index (line 16) * readable: Suppressing warnings. (line 26) -* reading arbitrary-length lines: Calling sequence. (line 110) +* reading arbitrary-length lines: Calling sequence. (line 128) * recording successful searches: Logging. (line 6) * relative filenames: Searching overview. (line 58) * reporting bugs: Reporting bugs. (line 6) @@ -3721,6 +3745,7 @@ Index * resolution, setting: Path searching options. (line 49) * resolutions, last-resort: Fallback font. (line 6) +* restricted mode, for output files: Calling sequence. (line 93) * retrieving TeX: unixtex.ftp. (line 6) * right-hand side of variable assignments: Config files. (line 57) * RISINPUTS: Supported file formats. @@ -3763,7 +3788,7 @@ Index * standard error and debugging output: Debugging. (line 27) * standard options: Standard options. (line 6) * startup time, excessive: Slow path searching. (line 6) -* string routines: Calling sequence. (line 110) +* string routines: Calling sequence. (line 128) * strip: mktex configuration. (line 107) * stripsupplier: mktex configuration. (line 101) * striptypeface: mktex configuration. (line 104) @@ -3867,12 +3892,17 @@ Index * TEXMFINI <2>: Supported file formats. (line 101) * TEXMFLOG: Logging. (line 10) -* TEXMFOUTPUT: mktex script names. (line 40) +* TEXMFOUTPUT, and missfont.log: mktex script names. (line 39) +* TEXMFOUTPUT, and paranoid output files: Calling sequence. (line 97) * TEXMFSCRIPTS: Supported file formats. (line 195) * texmfvar: mktex configuration. (line 122) * TEXMFVAR: mktex configuration. (line 123) * texmf_casefold_search: Casefolding search. (line 12) +* TEXMF_OUTPUT_DIRECTORY, and missfont.log: mktex script names. + (line 39) +* TEXMF_OUTPUT_DIRECTORY, and paranoid output files: Calling sequence. + (line 97) * TEXPICTS: Supported file formats. (line 79) * TEXPKS: Supported file formats. @@ -3921,6 +3951,7 @@ Index * unreadable file warnings: Suppressing warnings. (line 27) * unreadable files: Searching overview. (line 63) +* unrestricted mode, for output files: Calling sequence. (line 91) * unusable ls-R warning: ls-R. (line 51) * usage patterns, finding: Logging. (line 6) * USERPROFILE, as ~ expansion: Tilde expansion. (line 6) @@ -3967,61 +3998,62 @@ Index Tag Table: Node: Top1480 -Node: Introduction2263 -Node: History4333 -Node: unixtex.ftp8929 -Node: Security10399 -Node: TeX directory structure12903 -Node: Path searching16942 -Node: Searching overview17900 -Node: Path sources21719 -Node: Config files22945 -Node: Path expansion27817 -Node: Default expansion28770 -Node: Variable expansion30840 -Node: Tilde expansion32241 -Node: Brace expansion33221 -Node: KPSE_DOT expansion34160 -Node: Subdirectory expansion34673 -Node: Casefolding search37021 -Node: Casefolding rationale37790 -Node: Casefolding examples39136 -Node: Filename database44182 -Node: ls-R45164 -Node: Filename aliases48840 -Node: Database format50018 -Node: Invoking kpsewhich51031 -Node: Path searching options51986 -Node: Specially-recognized files61589 -Node: Auxiliary tasks62944 -Node: Standard options66669 -Node: TeX support67025 -Node: Supported file formats68379 -Node: File lookup76198 -Node: Glyph lookup77947 -Node: Basic glyph lookup79071 -Node: Fontmap79951 -Node: Fallback font82461 -Node: Suppressing warnings83373 -Node: mktex scripts84500 -Node: mktex configuration85715 -Node: mktex script names91518 -Node: mktex script arguments92904 -Node: Programming93783 -Node: Programming overview94356 -Node: Calling sequence97217 -Node: Program-specific files103746 -Node: Programming with config files104769 -Node: Reporting bugs106356 -Node: Bug checklist107034 -Node: Mailing lists110503 -Node: Debugging111180 -Node: Logging116257 -Node: Common problems118124 -Node: Unable to find files118601 -Node: Slow path searching121011 -Node: Unable to generate fonts122386 -Node: TeX or Metafont failing124858 -Node: Index126060 +Node: Introduction2262 +Node: History4331 +Node: unixtex.ftp8927 +Node: Security10397 +Node: TeX directory structure12901 +Node: Path searching16940 +Node: Searching overview17898 +Node: Path sources21717 +Node: Config files22943 +Node: Path expansion27815 +Node: Default expansion28768 +Node: Variable expansion30838 +Node: Tilde expansion32239 +Node: Brace expansion33219 +Node: KPSE_DOT expansion34158 +Node: Subdirectory expansion34671 +Node: Casefolding search37019 +Node: Casefolding rationale37788 +Node: Casefolding examples39134 +Node: Filename database44180 +Node: ls-R45162 +Node: Filename aliases48838 +Node: Database format50016 +Node: Invoking kpsewhich51029 +Node: Path searching options51984 +Node: Specially-recognized files61654 +Node: Auxiliary tasks63025 +Node: Standard options66750 +Node: TeX support67106 +Node: Supported file formats68460 +Node: File lookup76279 +Node: Glyph lookup78028 +Node: Basic glyph lookup79152 +Node: Fontmap80032 +Node: Fallback font82542 +Node: Suppressing warnings83454 +Node: mktex scripts84581 +Node: mktex configuration85796 +Node: mktex script names91599 +Node: mktex script arguments93170 +Node: Programming94049 +Node: Programming overview94622 +Node: Calling sequence97483 +Ref: openout_any101641 +Node: Program-specific files104692 +Node: Programming with config files105715 +Node: Reporting bugs107302 +Node: Bug checklist107980 +Node: Mailing lists111449 +Node: Debugging112126 +Node: Logging117203 +Node: Common problems119070 +Node: Unable to find files119547 +Node: Slow path searching121957 +Node: Unable to generate fonts123332 +Node: TeX or Metafont failing125804 +Node: Index127006 End Tag Table diff --git a/Build/source/texk/kpathsea/doc/kpathsea.texi b/Build/source/texk/kpathsea/doc/kpathsea.texi index ce95244b31a..ad1aec64583 100644 --- a/Build/source/texk/kpathsea/doc/kpathsea.texi +++ b/Build/source/texk/kpathsea/doc/kpathsea.texi @@ -3,7 +3,7 @@ @settitle Kpathsea: A library for path searching @set version 6.3.5 -@set month-year February 2023 +@set month-year October 2023 @copying This file documents the Kpathsea library for path searching. @@ -1535,9 +1535,10 @@ Dvips. Default is 600. @item --engine=@var{name} @opindex --engine=@var{name} @cindex engine name -Set the engine name to @var{name}. By default it is not set. The -engine name is used in some search paths to allow files with the same -name but used by different engines to coexist. +Set the engine name to @var{name}. By default it is not set in +@code{kpsewhich} (@TeX{} engines set it to the appropriate string). +The engine name is used in some search paths to allow files with the +same name but used by different engines to coexist. In particular, since the memory dump files (@file{.fmt}/@file{.base}/@file{.mem}) are now stored in @@ -1822,9 +1823,10 @@ look for the file @file{pdftexconfig.tex} instead.) A user-specified format will override the above defaults. @flindex tcfmgr.map -Another useful configuration file in this regard is @file{tcfmgr.map}, -found in @file{texmf/texconfig/tcfmgr.map}, which records various -information about the above configuration files (among others). +Another reference for information about @TeX{}'s many special files is +@file{tcfmgr.map}, found in @file{texmf/texconfig/tcfmgr.map}, which +records various information about the above configuration files (among +others). @node Auxiliary tasks @@ -3018,23 +3020,28 @@ formats. This script is also named @command{fmtutil}, and reads @vindex XDVIMAKEPK @vindex DVILJMAKEPK @noindent These names can be overridden by an environment variable specific -to the program---for example, @code{DVIPSMAKEPK} for Dvipsk. +to the program; for example, @code{DVIPSMAKEPK} for Dvipsk. @comment next two paragraphs are repeated in dvips.texi @flindex missfont.log @cindex failed @code{mktex@dots{}} script invocation If a @code{mktex@dots{}} script fails, the invocation is appended to a -file @file{missfont.log} (by default) in the current directory. You can -then execute the log file to create the missing files after fixing the -problem. +file @file{missfont.log} (by default) in the current directory. After +fixing the problem, you can then execute the log file to create the +missing files. + +@vindex TEXMF_OUTPUT_DIRECTORY@r{, and @file{missfont.log}} +@vindex TEXMFOUTPUT@r{, and @file{missfont.log}} +If the environment variable @code{TEXMF_OUTPUT_DIRECTORY} is set, +@file{missfont.log} is first tried to be written there; if it's not +set, the current directory is tried first. If that first write fails +and the environment variable or configuration file value +@code{TEXMFOUTPUT} is set, we try to write @file{missfont.log} there. +Otherwise nothing is written. -@vindex TEXMFOUTPUT @vindex MISSFONT_LOG -If the current directory is not writable and the environment variable or -configuration file value @code{TEXMFOUTPUT} is set, its value is -used. Otherwise, nothing is written. The name @samp{missfont.log} is -overridden by the @code{MISSFONT_LOG} environment variable or -configuration file value. +The base filename @samp{missfont.log} is overridden by the +@code{MISSFONT_LOG} environment variable or configuration file value. @node mktex script arguments @@ -3261,34 +3268,67 @@ exist, don't use this. @item @findex kpathsea_out_name_ok -@TeX{} can write output files, via the @code{\openout} primitive; this opens -a security hole vulnerable to Trojan horse attack: an unwitting user could -run a @TeX{} program that overwrites, say, @file{~/.rhosts}. Analogous -security holes exist for many other programs. To alleviate this, there is a -configuration variable @code{openout_any}, which selects one of three levels -of security. When it is set to @samp{a} (for ``any''), no restrictions are -imposed. When it is set to @samp{r} (for ``restricted''), filenames -beginning with @samp{.} are disallowed (except @file{.tex} because @LaTeX{} -needs it). When it is set to @samp{p} (for ``paranoid'') additional -restrictions are imposed: an absolute filename must refer to a file in (a -subdirectory) of @code{TEXMFOUTPUT}, and any attempt to go up a directory -level is forbidden (that is, paths may not contain a @samp{..} component). -The paranoid setting is the default. (For backwards compatibility, @samp{y} -and @samp{1} are synonyms of @samp{a}, while @samp{n} and @samp{0} are -synonyms for @samp{r}.) The function @code{kpathsea_out_name_ok}, with a -filename as second argument, returns @code{true} if that filename is -acceptable to be opend for output or @code{false} otherwise. +@vindex openout_any +@anchor{openout_any} +@TeX{} can write output files, via the @code{\openout} primitive. This +opens a security vulnerability: an unwitting user could run a @TeX{} +document that overwrites, say, @file{~/.profile}. Analogous +vulnerabilities exist for almost any program that can write files, but +since users expect @TeX{} to typeset documents, not overwrite personal +files, it's desirable to handle this. To alleviate it, there is a +configuration variable @code{openout_any}, which selects one of three +levels of security: + +@itemize +@item +@cindex unrestricted mode, for output files +When set to @samp{a} (for ``any''), no restrictions are imposed. + +@item +@cindex restricted mode, for output files +When is set to @samp{r} (for ``restricted''), filenames beginning +with @samp{.} are disallowed (except @file{.tex}, because @LaTeX{} +needs it). + +@item +@cindex paranoid mode, for output files +@vindex TEXMF_OUTPUT_DIRECTORY@r{, and paranoid output files} +@vindex TEXMFOUTPUT@r{, and paranoid output files} +When set to @samp{p} (for ``paranoid''), additional restrictions are +imposed. First, an absolute filename must refer to a file in (or in a +subdirectory of) either the @code{TEXMF_OUTPUT_DIRECTORY} environment +variable or the @code{TEXMFOUTPUT} environment variable or +configuration file setting. Second, any attempt to go up a directory +level is forbidden; that is, paths may not contain a @samp{..} +component. + +@item +For backwards compatibility, @samp{y} and @samp{1} are synonyms of +@samp{a}, while @samp{n} and @samp{0} are synonyms for @samp{r}. + +@end itemize + +The paranoid setting is the default. Any program intended to be safely +called from @TeX{} should implement the same measures, one way or +another. @xref{Shell escapes,,, web2c, Web2c}. + +The function @code{kpathsea_out_name_ok}, with a filename as second +argument, returns @code{true} if that filename is acceptable to be +opened for output or @code{false} otherwise. The Kpsewhich program +has options @samp{--safe-in-name} and @samp{--safe-out-name} to +provide a command line interface for the checking. @item @findex kpathsea_in_name_ok Similarly, the function @code{kpathsea_in_name_ok}, with a filename as second argument, returns @code{true} if that filename is acceptable to be opend for input or @code{false} otherwise, depending on the value of the -configuration variable @code{openin_any} (with @samp{a} as default). +configuration variable @code{openin_any} (with @samp{a} as default; +too many system directories are involved to make @samp{p} feasible). @item @findex kpathsea_finish -To close the kpathsea library instance you are using, call +To close the Kpathsea library instance you are using, call @code{kpathsea_finish}. This function closes any open log files and frees the memory used by the instance. diff --git a/Build/source/texk/kpathsea/tex-file.c b/Build/source/texk/kpathsea/tex-file.c index 335f13b45f4..6ece0ff5c4b 100644 --- a/Build/source/texk/kpathsea/tex-file.c +++ b/Build/source/texk/kpathsea/tex-file.c @@ -1,7 +1,7 @@ /* tex-file.c: high-level file searching by format. Copyright 1993, 1994, 1995, 1996, 1997, 2007, 2008, 2009, 2010, 2011 - 2012, 2014, 2016, 2017, 2019 Karl Berry. + 2012, 2014, 2016, 2017, 2019, 2023 Karl Berry. Copyright 1998-2005 Olaf Weber. This library is free software; you can redistribute it and/or @@ -1194,11 +1194,14 @@ kpathsea_name_ok (kpathsea kpse, const_string fname, const_string check_var, 'r' (restricted) means disallowing special file names. 'p' (paranoid) means being really paranoid: disallowing special file names and restricting output files to be in or below - the working directory or $TEXMFOUTPUT, while input files - must be below the current directory, $TEXMFOUTPUT, or - (implicitly) in the system areas. + the working directory or $TEXMFOUTPUT or + $TEXMF_OUTPUT_DIRECTORY, while input files + must be below the current directory, the envvars, or + (only implicitly) in the system areas. We default to "paranoid". The error messages from TeX may be puzzling. - This function contains several return and goto statements, be careful. */ + This function contains several return and goto statements, be careful. + + Paranoia originally supplied by Charles Karney. */ const_string open_choice = kpathsea_var_value (kpse, check_var); @@ -1231,16 +1234,31 @@ kpathsea_name_ok (kpathsea kpse, const_string fname, const_string check_var, if (*open_choice == 'r' || *open_choice == 'n' || *open_choice == '0') return true; - /* Paranoia originally supplied by Charles Karney. */ if (kpathsea_absolute_p (kpse, fname, false)) { - const_string texmfoutput = kpathsea_var_value (kpse, "TEXMFOUTPUT"); - /* Absolute pathname is only OK if TEXMFOUTPUT is set, it's not empty, - fname begins the TEXMFOUTPUT, and is followed by / */ - if (!texmfoutput || *texmfoutput == '\0' - || fname != strstr (fname, texmfoutput) - || !IS_DIR_SEP (fname[strlen (texmfoutput)])) - goto not_ok; + + /* fname can be an absolute pathname only if one of the TEXMF* + variables is set, is non-empty, the value is the beginning of + fname, and the next character in fname is a directory separator. */ + + /* We'll check TEXMF_OUTPUT_DIRECTORY first. This must be an + environment variable, not a configuration file setting. */ + const_string texmfoutdir = getenv ("TEXMF_OUTPUT_DIRECTORY"); + if (!texmfoutdir || *texmfoutdir == '\0' + || fname != strstr (fname, texmfoutdir) + || !IS_DIR_SEP (fname[strlen (texmfoutdir)])) { + + /* Ok, that didn't work. Check TEXMFOUTPUT in exactly the same + way, except it can be in the configuration file. */ + const_string texmfoutput + = kpathsea_var_value (kpse, "TEXMFOUTPUT"); + if (!texmfoutput || *texmfoutput == '\0' + || fname != strstr (fname, texmfoutput) + || !IS_DIR_SEP (fname[strlen (texmfoutput)])) { + goto not_ok; + } + } } + /* For all pathnames, we disallow "../" at the beginning or "/../" anywhere. */ if (fname[0] == '.' && fname[1] == '.' && IS_DIR_SEP(fname[2])) diff --git a/Build/source/texk/kpathsea/tex-make.c b/Build/source/texk/kpathsea/tex-make.c index 530c6ffe535..7a964b48529 100644 --- a/Build/source/texk/kpathsea/tex-make.c +++ b/Build/source/texk/kpathsea/tex-make.c @@ -1,6 +1,6 @@ /* tex-make.c: run external programs to make TeX-related files. - Copyright 1993, 1994, 1995, 1996, 1997, 2008-2020 Karl Berry. + Copyright 1993, 1994, 1995, 1996, 1997, 2008-2023 Karl Berry. Copyright 1997, 1998, 2001-05 Olaf Weber. This library is free software; you can redistribute it and/or @@ -18,6 +18,7 @@ #include <kpathsea/config.h> +#include <kpathsea/absolute.h> #include <kpathsea/c-fopen.h> #include <kpathsea/c-pathch.h> #include <kpathsea/db.h> @@ -106,7 +107,9 @@ misstex (kpathsea kpse, kpse_file_format_type format, string *args) /* If this is the first time, have to open the log file. But don't bother logging anything if they were discarding errors. */ if (!kpse->missfont && !kpse->make_tex_discard_errors) { + string first_name; const_string missfont_name = kpathsea_var_value (kpse, "MISSFONT_LOG"); + if (!missfont_name || *missfont_name == '1') { missfont_name = "missfont.log"; /* take default name */ } else if (missfont_name @@ -114,9 +117,25 @@ misstex (kpathsea kpse, kpse_file_format_type format, string *args) missfont_name = NULL; /* user requested no missfont.log */ } /* else use user's name */ + /* If the given name is not already absolute, + and TEXMF_OUTPUT_DIRECTORY is set, use that instead of cwd. + This is only an envvar, not a config file value. */ + if (!kpathsea_absolute_p (kpse, missfont_name, false) + && getenv ("TEXMF_OUTPUT_DIRECTORY")) { + first_name = concat3 (getenv ("TEXMF_OUTPUT_DIRECTORY"), + DIR_SEP_STRING, missfont_name); + } else { + first_name = xstrdup (missfont_name); + } kpse->missfont - = missfont_name ? fopen (missfont_name, FOPEN_A_MODE) : NULL; - if (!kpse->missfont && kpathsea_var_value (kpse, "TEXMFOUTPUT")) { + = missfont_name ? fopen (first_name, FOPEN_A_MODE) : NULL; + + /* If that succeeded, save the name for output below. */ + if (kpse->missfont) { + missfont_name = first_name; + + /* If that failed, try TEXMFOUTPUT. */ + } else if (kpathsea_var_value (kpse, "TEXMFOUTPUT")) { missfont_name = concat3 (kpathsea_var_value (kpse, "TEXMFOUTPUT"), DIR_SEP_STRING, missfont_name); kpse->missfont = fopen (missfont_name, FOPEN_A_MODE); @@ -125,6 +144,9 @@ misstex (kpathsea kpse, kpse_file_format_type format, string *args) if (kpse->missfont) fprintf (stderr, "kpathsea: Appending font creation commands to %s.\n", missfont_name); + + /* Uselessly save memory. */ + free (first_name); } /* Write the command if we have a log file. */ @@ -530,15 +552,23 @@ int main (int argc, char **argv) { kpathsea kpse = xcalloc(1, sizeof(kpathsea_instance)); - kpathsea_set_program_name(kpse, argv[0], NULL); + kpathsea_set_program_name (kpse, argv[0], NULL); kpathsea_xputenv (kpse, "KPATHSEA_DPI", "781"); /* call mktexpk */ kpathsea_xputenv (kpse,"MAKETEX_BASE_DPI", "300"); /* call mktexpk */ - kpathsea_set_program_enabled(kpse, kpse_pk_format, 1, kpse_src_env); + kpathsea_set_program_enabled (kpse, kpse_pk_format, 1, kpse_src_env); + + /* Succeed. */ test_make_tex (kpse, kpse_pk_format, "cmr10"); - /* Fail with mktextfm. */ - kpathsea_set_program_enabled(kpse, kpse_tfm_format, 1, kpse_src_env); - test_make_tex (kpse, kpse_tfm_format, "foozler99"); + /* Fail with mktextfm, writing missfont.log to a different directory. */ + kpathsea_set_program_enabled (kpse, kpse_tfm_format, 1, kpse_src_env); + kpathsea_xputenv (kpse,"TEXMF_OUTPUT_DIRECTORY", "/tmp"); + test_make_tex (kpse, kpse_tfm_format, "foozout99"); + + /* Since the missfont.log descriptor is cached, can only save in one + place in a given run, so don't bother doing it twice. + test_make_tex (kpse, kpse_tfm_format, "foozler98"); + */ /* Call something disabled. */ test_make_tex (kpse, kpse_bst_format, "no-way"); @@ -551,6 +581,6 @@ main (int argc, char **argv) /* Local variables: -standalone-compile-command: "gcc -g -I. -I.. -DTEST tex-make.c kpathsea.a" +standalone-compile-command: "gcc -g -I. -I.. -I$wk/.. -DTEST -DMAKE_KPSE_DLL tex-make.c $wk/.libs/libkpathsea.a && ./a.out" End: */ diff --git a/Build/source/texk/kpathsea/texmf.cnf b/Build/source/texk/kpathsea/texmf.cnf index 21b0af293c3..4bc73d6bcf8 100644 --- a/Build/source/texk/kpathsea/texmf.cnf +++ b/Build/source/texk/kpathsea/texmf.cnf @@ -688,8 +688,18 @@ TEXMF_RESTRICTED_SCRIPTS = \ openin_any = a openout_any = p -% Write .log/.dvi/.aux/etc. files here, if the current directory is unwritable. +% Write .log/.dvi/.aux/etc. files here, if they can't be written in the +% current directory. +% +% Best to use this only when a particular job requires it, not set +% globally in a configuration file or the environment. %TEXMFOUTPUT = /tmp +% +% A related environment variable is TEXMF_OUTPUT_DIRECTORY. It +% overrides the current directory for all output files in TeX and the other +% engines. It cannot be set in a configuration file. And it's even more +% important to use it only temporarily, when required, to avoid massive +% confusion about where the output files are ending up. % If a dynamic file creation fails, log the command to this file, in % either the current directory or TEXMFOUTPUT. Set to the |