summaryrefslogtreecommitdiff
path: root/Build
diff options
context:
space:
mode:
authorKarl Berry <karl@freefriends.org>2023-03-07 22:22:26 +0000
committerKarl Berry <karl@freefriends.org>2023-03-07 22:22:26 +0000
commit1126c15d69c515a4adea0363260b4598bd9e2145 (patch)
tree6a0e35a12eae17dbaf311c723696e8a56fcb5a8f /Build
parent5ec21fd1c60e0aa6fcd566e687fd5199695f855d (diff)
epstopdf (7mar23)
git-svn-id: svn://tug.org/texlive/trunk@66441 c570f23f-e606-0410-a88d-b1316a301751
Diffstat (limited to 'Build')
-rwxr-xr-xBuild/source/texk/texlive/linked_scripts/epstopdf/epstopdf.pl42
1 files changed, 33 insertions, 9 deletions
diff --git a/Build/source/texk/texlive/linked_scripts/epstopdf/epstopdf.pl b/Build/source/texk/texlive/linked_scripts/epstopdf/epstopdf.pl
index c4003e25c1f..6f0637ad286 100755
--- a/Build/source/texk/texlive/linked_scripts/epstopdf/epstopdf.pl
+++ b/Build/source/texk/texlive/linked_scripts/epstopdf/epstopdf.pl
@@ -1,5 +1,5 @@
#!/usr/bin/env perl
-# $Id: epstopdf.pl 64317 2022-09-08 01:25:27Z karl $
+# $Id: epstopdf.pl 66407 2023-03-06 23:44:49Z karl $
# (Copyright lines below.)
#
# Redistribution and use in source and binary forms, with or without
@@ -35,7 +35,11 @@
#
# emacs-page
#
-my $ver = "2.30";
+my $ver = "2.31";
+# 2023/03/06 v2.31 (Karl Berry)
+# * disallow --nosafer in restricted mode.
+# * disallow output to pipes in restricted mode.
+# Report from nikolay.ermishkin to tlsecurity.
# 2022/09/05 v2.30 (Siep Kroonenberg)
# * still use gswin32c if gswin64c.exe not on PATH.
# 2022/08/29 v2.29 (Karl Berry)
@@ -193,9 +197,9 @@ my $ver = "2.30";
### emacs-page
### program identification
my $program = "epstopdf";
-my $ident = '($Id: epstopdf.pl 64317 2022-09-08 01:25:27Z karl $)' . " $ver";
+my $ident = '($Id: epstopdf.pl 66407 2023-03-06 23:44:49Z karl $)' . " $ver";
my $copyright = <<END_COPYRIGHT ;
-Copyright 2009-2022 Karl Berry et al.
+Copyright 2009-2023 Karl Berry et al.
Copyright 2002-2009 Gerben Wierda et al.
Copyright 1998-2001 Sebastian Rahtz et al.
License RBSD: Revised BSD <http://www.xfree86.org/3.3.6/COPYRIGHT2.html#5>
@@ -498,8 +502,9 @@ if ($restricted && $on_windows) {
my $mydirname = dirname $0;
# $mydirname is the location of the Perl script
$kpsewhich = "$mydirname/../../../bin/win32/$kpsewhich";
+ debug "Restricted Windows kpsewhich: $kpsewhich";
$GS = "$mydirname/../../../tlpkg/tlgs/bin/$GS";
- debug "restricted Windows gs: $GS";
+ debug "Restricted Windows gs: $GS";
}
debug "kpsewhich command: $kpsewhich";
@@ -512,7 +517,8 @@ sub safe_name {
$option = '-safe-out-name' if $mode eq 'out';
error "Unknown check mode in safe_name(): $mode" unless $option;
my @args = ($kpsewhich, '-progname', 'repstopdf', $option, $name);
- my $bad = system {$args[0]} @args;
+ debug "Checking safe_name with: @args";
+ my $bad = system { $args[0] } @args;
return ! $bad;
}
@@ -569,10 +575,21 @@ if ($::opt_gscmd) {
}
}
+### option (no)safer
+my $gs_opt_safer = "-dSAFER";
+if (! $::opt_safer) {
+ if ($restricted) {
+ error "Option forbidden in restricted mode: --nosafer";
+ } else {
+ debug "Switching from $gs_opt_safer to -dNOSAFER";
+ $gs_opt_safer = "--nosafer";
+ }
+}
+
### start building GS command line for the pipe
my @GS = ($GS);
push @GS, '-q' if $::opt_quiet;
-push @GS, $::opt_safer ? '-dSAFER' : '-dNOSAFER';
+push @GS, $gs_opt_safer;
push @GS, '-dNOPAUSE';
push @GS, '-dBATCH';
push @GS, '-dCompatibilityLevel=1.5';
@@ -609,7 +626,13 @@ if (! $OutputFilename) {
$OutputFilename = "-";
}
}
-$OutputFilename =~ s/%/%%/g; # we will do the escaping for gs
+#
+# gs -sOutputFilename opens pipes itself if the string starts with
+# %pipe or |. Disallow this in restricted mode.
+if ($restricted && $OutputFilename =~ /^(%pipe|\|)/) {
+ error "Output to pipe forbidden in restricted mode: $OutputFilename";
+}
+$OutputFilename =~ s/%/%%/g; # stop gs interpretation of % characters
debug "Output filename:", $OutputFilename;
push @GS, "-sOutputFile=$OutputFilename";
@@ -737,6 +760,7 @@ else {
debug "No Ghostscript: opening $OutputFilename";
if ($OutputFilename eq "-") {
$OUT = *STDOUT;
+ $outname = "-";
} else {
open($OUT, '>', $OutputFilename)
|| error ("Cannot write \"$OutputFilename\": $!");
@@ -795,7 +819,7 @@ if ($buflen > 0) {
debug " No checksum";
}
else {
- debug " checksum: $checksum";
+ debug " Checksum: $checksum";
my $cs = 0;
map { $cs ^= $_ } unpack('n14', $header);
if ($cs != $checksum) {