summaryrefslogtreecommitdiff
path: root/Build/source/texk/kpathsea
diff options
context:
space:
mode:
authorKarl Berry <karl@freefriends.org>2024-06-28 22:08:39 +0000
committerKarl Berry <karl@freefriends.org>2024-06-28 22:08:39 +0000
commitb522cc20332ad230a34ddc0cab14c93ab3263019 (patch)
tree21275b37da8ce6b2e1afe3bebe06641c3cc492ff /Build/source/texk/kpathsea
parentcd09ce29745ba3b8073b18dc4eb76defaa91acf1 (diff)
no extractbb in restricted mode
git-svn-id: svn://tug.org/texlive/trunk@71645 c570f23f-e606-0410-a88d-b1316a301751
Diffstat (limited to 'Build/source/texk/kpathsea')
-rw-r--r--Build/source/texk/kpathsea/ChangeLog4
-rw-r--r--Build/source/texk/kpathsea/texmf.cnf4
2 files changed, 6 insertions, 2 deletions
diff --git a/Build/source/texk/kpathsea/ChangeLog b/Build/source/texk/kpathsea/ChangeLog
index dc1bd95adf3..b7e89628ec3 100644
--- a/Build/source/texk/kpathsea/ChangeLog
+++ b/Build/source/texk/kpathsea/ChangeLog
@@ -1,3 +1,7 @@
+2024-06-29 Karl Berry <karl@tug.org>
+
+ * texmf.cnf (shell_escape_commands): remove extractbb.
+
2024-06-04 Karl Berry <karl@freefriends.org>
* texmf.cnf (MKTEXPK, etc.): adjust values shown to the
diff --git a/Build/source/texk/kpathsea/texmf.cnf b/Build/source/texk/kpathsea/texmf.cnf
index 94d1b999fdf..333e6325b3d 100644
--- a/Build/source/texk/kpathsea/texmf.cnf
+++ b/Build/source/texk/kpathsea/texmf.cnf
@@ -649,7 +649,6 @@ shell_escape = p
%
shell_escape_commands = \
bibtex,bibtex8,\
-extractbb,\
gregorio,\
kpsewhich,\
l3sys-query,\
@@ -660,7 +659,8 @@ repstopdf,\
r-mpost,\
texosquery-jre8,\
-% we'd like to allow:
+% other programs considered:
+% extractbb - allowed in the past, but can be exploited.
% dvips - but external commands can be executed, need at least -R1.
% epspdf, ps2pdf, pstopdf - need to respect openout_any,
% and gs -dSAFER must be used and check for shell injection with filenames.