add repstopdf to shell_escape_commands

git-svn-id: svn://tug.org/texlive/trunk@15800 c570f23f-e606-0410-a88d-b1316a301751

1 files changed, 9 insertions, 5 deletions

diff --git a/Master/texmf/web2c/texmf.cnf b/Master/texmf/web2c/texmf.cnf
index 6831580d478..a23924b6088 100644
--- a/Master/texmf/web2c/texmf.cnf
+++ b/Master/texmf/web2c/texmf.cnf
@@ -492,11 +492,13 @@ try_std_extension_first = t
 shell_escape = p
 
 % No spaces in this command list.  These programs either do not write
-% any output files or respect openout_any.  And have no features to
-% invoke other programs.
+% any output files, respect openout_any, or have hard-coded restrictions similar
+% or higher to openout_any=p.  And have no features (nor, to the best of our
+% knowledge, security holes) to invoke arbitrary other programs.
 shell_escape_commands = \
-bibtex,bibtex8,fc-match,\
-kpsewhich,makeindex,\
+kpsewhich,fc-match,\
+bibtex,bibtex8,makeindex,\
+repstopdf,\
 
 % we'd like to allow:
 % dvips - but external commands can be executed, need at least -R1.
@@ -504,11 +506,13 @@ kpsewhich,makeindex,\
 %   without Unix convert it hardly seems worth it, and Windows convert
 %   is something completely different that destroys filesystems, so
 %   skip it.
-% epspdf, epstopdf, ps2pdf, pstopdf, rpdfcrop - need to respect openout_any.
+% epspdf, epstopdf, ps2pdf, pstopdf, rpdfcrop - need to respect openout_any,
+%   and we need to make sure -dSAFER is used and no injection is possible.
 % pygmentize - but is the filter feature insecure?
 % ps4pdf - but it calls an unrestricted latex.
 % texindy,xindy - but is the module feature insecure?
 % ulqda - but requires optional SHA1.pm, so why bother.
+% tex, latex, etc - but need to forbid --shell-escape, and inherit openout_any
 
 % plain TeX should remain unenhanced.
 shell_escape.tex = f