diff options
author | Karl Berry <karl@freefriends.org> | 2023-03-07 22:22:26 +0000 |
---|---|---|
committer | Karl Berry <karl@freefriends.org> | 2023-03-07 22:22:26 +0000 |
commit | 1126c15d69c515a4adea0363260b4598bd9e2145 (patch) | |
tree | 6a0e35a12eae17dbaf311c723696e8a56fcb5a8f /Master/texmf-dist/scripts/epstopdf | |
parent | 5ec21fd1c60e0aa6fcd566e687fd5199695f855d (diff) |
epstopdf (7mar23)
git-svn-id: svn://tug.org/texlive/trunk@66441 c570f23f-e606-0410-a88d-b1316a301751
Diffstat (limited to 'Master/texmf-dist/scripts/epstopdf')
-rwxr-xr-x | Master/texmf-dist/scripts/epstopdf/epstopdf.pl | 42 |
1 files changed, 33 insertions, 9 deletions
diff --git a/Master/texmf-dist/scripts/epstopdf/epstopdf.pl b/Master/texmf-dist/scripts/epstopdf/epstopdf.pl index c4003e25c1f..6f0637ad286 100755 --- a/Master/texmf-dist/scripts/epstopdf/epstopdf.pl +++ b/Master/texmf-dist/scripts/epstopdf/epstopdf.pl @@ -1,5 +1,5 @@ #!/usr/bin/env perl -# $Id: epstopdf.pl 64317 2022-09-08 01:25:27Z karl $ +# $Id: epstopdf.pl 66407 2023-03-06 23:44:49Z karl $ # (Copyright lines below.) # # Redistribution and use in source and binary forms, with or without @@ -35,7 +35,11 @@ # # emacs-page # -my $ver = "2.30"; +my $ver = "2.31"; +# 2023/03/06 v2.31 (Karl Berry) +# * disallow --nosafer in restricted mode. +# * disallow output to pipes in restricted mode. +# Report from nikolay.ermishkin to tlsecurity. # 2022/09/05 v2.30 (Siep Kroonenberg) # * still use gswin32c if gswin64c.exe not on PATH. # 2022/08/29 v2.29 (Karl Berry) @@ -193,9 +197,9 @@ my $ver = "2.30"; ### emacs-page ### program identification my $program = "epstopdf"; -my $ident = '($Id: epstopdf.pl 64317 2022-09-08 01:25:27Z karl $)' . " $ver"; +my $ident = '($Id: epstopdf.pl 66407 2023-03-06 23:44:49Z karl $)' . " $ver"; my $copyright = <<END_COPYRIGHT ; -Copyright 2009-2022 Karl Berry et al. +Copyright 2009-2023 Karl Berry et al. Copyright 2002-2009 Gerben Wierda et al. Copyright 1998-2001 Sebastian Rahtz et al. License RBSD: Revised BSD <http://www.xfree86.org/3.3.6/COPYRIGHT2.html#5> @@ -498,8 +502,9 @@ if ($restricted && $on_windows) { my $mydirname = dirname $0; # $mydirname is the location of the Perl script $kpsewhich = "$mydirname/../../../bin/win32/$kpsewhich"; + debug "Restricted Windows kpsewhich: $kpsewhich"; $GS = "$mydirname/../../../tlpkg/tlgs/bin/$GS"; - debug "restricted Windows gs: $GS"; + debug "Restricted Windows gs: $GS"; } debug "kpsewhich command: $kpsewhich"; @@ -512,7 +517,8 @@ sub safe_name { $option = '-safe-out-name' if $mode eq 'out'; error "Unknown check mode in safe_name(): $mode" unless $option; my @args = ($kpsewhich, '-progname', 'repstopdf', $option, $name); - my $bad = system {$args[0]} @args; + debug "Checking safe_name with: @args"; + my $bad = system { $args[0] } @args; return ! $bad; } @@ -569,10 +575,21 @@ if ($::opt_gscmd) { } } +### option (no)safer +my $gs_opt_safer = "-dSAFER"; +if (! $::opt_safer) { + if ($restricted) { + error "Option forbidden in restricted mode: --nosafer"; + } else { + debug "Switching from $gs_opt_safer to -dNOSAFER"; + $gs_opt_safer = "--nosafer"; + } +} + ### start building GS command line for the pipe my @GS = ($GS); push @GS, '-q' if $::opt_quiet; -push @GS, $::opt_safer ? '-dSAFER' : '-dNOSAFER'; +push @GS, $gs_opt_safer; push @GS, '-dNOPAUSE'; push @GS, '-dBATCH'; push @GS, '-dCompatibilityLevel=1.5'; @@ -609,7 +626,13 @@ if (! $OutputFilename) { $OutputFilename = "-"; } } -$OutputFilename =~ s/%/%%/g; # we will do the escaping for gs +# +# gs -sOutputFilename opens pipes itself if the string starts with +# %pipe or |. Disallow this in restricted mode. +if ($restricted && $OutputFilename =~ /^(%pipe|\|)/) { + error "Output to pipe forbidden in restricted mode: $OutputFilename"; +} +$OutputFilename =~ s/%/%%/g; # stop gs interpretation of % characters debug "Output filename:", $OutputFilename; push @GS, "-sOutputFile=$OutputFilename"; @@ -737,6 +760,7 @@ else { debug "No Ghostscript: opening $OutputFilename"; if ($OutputFilename eq "-") { $OUT = *STDOUT; + $outname = "-"; } else { open($OUT, '>', $OutputFilename) || error ("Cannot write \"$OutputFilename\": $!"); @@ -795,7 +819,7 @@ if ($buflen > 0) { debug " No checksum"; } else { - debug " checksum: $checksum"; + debug " Checksum: $checksum"; my $cs = 0; map { $cs ^= $_ } unpack('n14', $header); if ($cs != $checksum) { |