pdfcrop 1.18 (including rpdfcrop)

git-svn-id: svn://tug.org/texlive/trunk@14387 c570f23f-e606-0410-a88d-b1316a301751

1 files changed, 98 insertions, 6 deletions

diff --git a/Master/texmf-dist/scripts/pdfcrop/pdfcrop.pl b/Master/texmf-dist/scripts/pdfcrop/pdfcrop.pl
index 412e979ac50..9dbcdb22d90 100755
--- a/Master/texmf-dist/scripts/pdfcrop/pdfcrop.pl
+++ b/Master/texmf-dist/scripts/pdfcrop/pdfcrop.pl
@@ -22,8 +22,8 @@ $^W=1; # turn warning on
 #
 my $file        = "pdfcrop.pl";
 my $program     = uc($&) if $file =~ /^\w+/;
-my $version     = "1.15";
-my $date        = "2009/07/14";
+my $version     = "1.18";
+my $date        = "2009/07/18";
 my $author      = "Heiko Oberdiek";
 my $copyright   = "Copyright (c) 2002-2009 by $author.";
 #
@@ -52,6 +52,15 @@ my $copyright   = "Copyright (c) 2002-2009 by $author.";
 #   2008/09/12 v1.14: Error detection for invalid Bounding Boxes.
 #   2009/07/14 v1.15: Fix for negative coordinates in Bounding Boxes
 #                     (David Menestrina).
+#   2009/07/16 v1.16: Security fixes:
+#                     * -dSAFER added for Ghostscript,
+#                     * -no-shell-escape added for pdfTeX/XeTeX.
+#   2009/07/17 v1.17: Security fixes:
+#                     * Backticks and whitespace are forbidden
+#                       for options --(gs|pdftex|xetex)cmd.
+#                     * Validation of options --papersize and --resolution.
+#   2009/07/18 v1.18: * Restricted mode added.
+#                     * Option --version added.
 
 ### program identification
 my $title = "$program $version, $date - $copyright\n";
@@ -74,6 +83,12 @@ my $Win = 0;
 $Win = 1 if $^O =~ /mswin32/i;
 $Win = 1 if $^O =~ /cygwin/i;
 
+# restricted mode
+my $restricted = 0;
+if ($0 =~ /rpdfcrop/ or $0 =~ /restricted/) {
+    $restricted = 1;
+}
+
 # "null" device
 use File::Spec::Functions qw(devnull);
 my $null = devnull();
@@ -83,8 +98,26 @@ my $inputfile   = "";
 my $outputfile  = "";
 my $tmp = "tmp-\L$program\E-$$";
 
+### paper sizes
+
+my @papersizes = qw[
+  11x17 ledger legal letter lettersmall
+  archE archD archC archB archA
+  a0 a1 a2 a3 a4 a4small a5 a6 a7 a8 a9 a10
+  isob0 isob1 isob2 isob3 isob4 isob5 isob6
+  c0 c1 c2 c3 c4 c5 c6
+  jisb0 jisb1 jisb2 jisb3 jisb4 jisb5 jisb6
+  b0 b1 b2 b3 b4 b5
+  flsa flse halfletter
+];
+my %papersizes;
+foreach (@papersizes) {
+    $papersizes{$_} = 1;
+}
+
 ### option variables
 my @bool = ("false", "true");
+$::opt_version    = 0;
 $::opt_help       = 0;
 $::opt_debug      = 0;
 $::opt_verbose    = 0;
@@ -104,6 +137,7 @@ ${title}Syntax:   \L$program\E [options] <input[.pdf]> [output file]
 Function: Margins are calculated and removed for each page in the file.
 Options:                                                    (defaults:)
   --help              print usage
+  --version           print version number
   --(no)verbose       verbose printing                      ($bool[$::opt_verbose])
   --(no)debug         debug informations                    ($bool[$::opt_debug])
   --gscmd <name>      call of ghostscript                   ($::opt_gscmd)
@@ -119,6 +153,7 @@ Options:                                                    (defaults:)
   --(no)hires         using `%%HiResBoundingBox'            ($bool[$::opt_hires])
                       instead of `%%BoundingBox'
 Expert options:
+  --restricted        turn on restricted mode               ($bool[$restricted])
   --papersize <foo>   parameter for gs's -sPAPERSIZE=<foo>,
                       use only with older gs versions <7.32 ($::opt_papersize)
   --resolution <xres>x<yres>                                ()
@@ -140,6 +175,7 @@ my @OrgArgv = @ARGV;
 use Getopt::Long;
 GetOptions(
   "help!",
+  "version!",
   "debug!",
   "verbose!",
   "gscmd=s",
@@ -153,9 +189,15 @@ GetOptions(
   "papersize=s",
   "resolution=s",
   "bbox=s",
+  "restricted" => sub { $restricted = 1; },
 ) or die $usage;
 !$::opt_help or die $usage;
 
+if ($::opt_version) {
+    print "$version\n";
+    exit(0);
+}
+
 $::opt_verbose = 1 if $::opt_debug;
 
 @ARGV >= 1 or die $usage;
@@ -227,6 +269,55 @@ else {
 }
 print "* Margins: $llx $lly $urx $ury\n" if $::opt_debug;
 
+### papersize validation (security)
+if ($::opt_papersize ne '') {
+    $::opt_papersize =~ /^[0-9A-Za-z]+$/
+            or die "$Error Invalid papersize ($::opt_papersize)!\n";
+    $papersizes{$::opt_papersize}
+            or die "$Error Unknown papersize ($::opt_papersize),"
+                   . " see ghostscript's documentation for option `-r'!\n";
+}
+
+### resolution validation (security)
+if ($::opt_resolution ne '') {
+    $::opt_resolution =~ /^\d+(x\d+)?$/
+            or die "$Error Invalid resolution ($::opt_resolution),"
+                   . " see ghostscript's documentation!\n";
+}
+
+### command name validation (security)
+my %cmd = (
+    'gscmd' => \$::opt_gscmd,
+    'pdftexcmd' => \$::opt_pdftexcmd,
+    'xetexcmd' => \$::opt_xetexcmd
+);
+foreach my $cmd (keys %cmd) {
+    my $val = ${$cmd{$cmd}};
+    next unless $val;
+    $val =~ s/^\s+//;
+    $val =~ s/\s+$//;
+    next unless $val;
+    if ($val =~ /`/) {
+        die "$Error Forbidden backtick for option `--$cmd' ($val)!\n";
+    }
+    if ($val =~ /\s/) {
+        die "$Error Forbidden whitespace for option `--$cmd' ($val)!\n";
+    }
+}
+if ($restricted) {
+    if ($::opt_pdftexcmd and $::opt_pdftexcmd ne 'pdftex') {
+        die "$Error pdfTeX program name must not be changed in restricted mode!\n";
+    }
+    if ($::opt_xetexcmd and $::opt_xetexcmd ne 'xetex') {
+        die "$Error XeTeX program name must not be changed in restricted mode!\n";
+    }
+    if ($::opt_gscmd) {
+        $::opt_gscmd =~ /^(gs|mgs|gswin32c|gs386|gsos2)$/
+        or $::opt_gscmd =~ /^gs[\-_]?(\d|\d[\.-_]?\d\d)c?$/
+        or die "$Error: Invalid Ghostscript program name in restricted mode!\n";
+    }
+}
+
 ### cleanup system
 my @unlink_files = ();
 my $exit_code = 1;
@@ -393,7 +484,7 @@ if ($::opt_bbox) {
      @bbox = ($1, $2, $3, $4);
 }
 my $page = 0;
-my $gs_pipe = "$::opt_gscmd @gsargs 2>&1";
+my $gs_pipe = "$::opt_gscmd -dSAFER @gsargs 2>&1";
 $gs_pipe .= " 1>$null" unless $::opt_verbose;
 $gs_pipe .= "|";
 
@@ -454,11 +545,11 @@ END_WARNING
 close(GS);
 
 if ($? & 127) {
-    die sprintf  "!!! Error: Ghostscript died with signal %d!\n",
+    die sprintf  "$Error Ghostscript died with signal %d!\n",
                  ($? & 127);
 }
 elsif ($? != 0) {
-    die sprintf "!!! Error: Ghostscript exited with error code %d!\n",
+    die sprintf "$Error Ghostscript exited with error code %d!\n",
                 $? >> 8;
 }
 
@@ -466,7 +557,7 @@ print TMP "\\csname \@\@end\\endcsname\n\\end\n";
 close(TMP);
 
 if ($page == 0) {
-    die "!!! Error: Ghostscript does not report bounding boxes!\n";
+    die "$Error Ghostscript does not report bounding boxes!\n";
 }
 
 ### Run pdfTeX/XeTeX
@@ -482,6 +573,7 @@ else {
     $cmd = $::opt_xetexcmd;
     $texname = 'XeTeX';
 }
+$cmd .= ' -no-shell-escape';
 if ($::opt_verbose) {
     $cmd .= " -interaction=nonstopmode $tmp";
 }