summaryrefslogtreecommitdiff
path: root/Build
diff options
context:
space:
mode:
authorAndreas Scherer <andreas_tex@freenet.de>2024-06-29 09:38:21 +0000
committerAndreas Scherer <andreas_tex@freenet.de>2024-06-29 09:38:21 +0000
commit52f209882cae81014808940e5d6d68520b901489 (patch)
tree4ad66268d01ef9e1bb36d31108a54f3e7c9e097f /Build
parenta98a6f3bc0e4a5201edec1dd52c900404b83a94b (diff)
Revert "no extractbb in restricted mode"
This reverts commit 4a4953dff0442ef6dda2f762209eac1eec038ace. git-svn-id: svn://tug.org/texlive/trunk@71650 c570f23f-e606-0410-a88d-b1316a301751
Diffstat (limited to 'Build')
-rw-r--r--Build/source/texk/kpathsea/ChangeLog4
-rw-r--r--Build/source/texk/kpathsea/texmf.cnf4
2 files changed, 2 insertions, 6 deletions
diff --git a/Build/source/texk/kpathsea/ChangeLog b/Build/source/texk/kpathsea/ChangeLog
index b7e89628ec3..dc1bd95adf3 100644
--- a/Build/source/texk/kpathsea/ChangeLog
+++ b/Build/source/texk/kpathsea/ChangeLog
@@ -1,7 +1,3 @@
-2024-06-29 Karl Berry <karl@tug.org>
-
- * texmf.cnf (shell_escape_commands): remove extractbb.
-
2024-06-04 Karl Berry <karl@freefriends.org>
* texmf.cnf (MKTEXPK, etc.): adjust values shown to the
diff --git a/Build/source/texk/kpathsea/texmf.cnf b/Build/source/texk/kpathsea/texmf.cnf
index 333e6325b3d..94d1b999fdf 100644
--- a/Build/source/texk/kpathsea/texmf.cnf
+++ b/Build/source/texk/kpathsea/texmf.cnf
@@ -649,6 +649,7 @@ shell_escape = p
%
shell_escape_commands = \
bibtex,bibtex8,\
+extractbb,\
gregorio,\
kpsewhich,\
l3sys-query,\
@@ -659,8 +660,7 @@ repstopdf,\
r-mpost,\
texosquery-jre8,\
-% other programs considered:
-% extractbb - allowed in the past, but can be exploited.
+% we'd like to allow:
% dvips - but external commands can be executed, need at least -R1.
% epspdf, ps2pdf, pstopdf - need to respect openout_any,
% and gs -dSAFER must be used and check for shell injection with filenames.