epstopdf 2.14

git-svn-id: svn://tug.org/texlive/trunk@17404 c570f23f-e606-0410-a88d-b1316a301751

2 files changed, 98 insertions, 82 deletions

diff --git a/Master/texmf-dist/scripts/epstopdf/epstopdf.pl b/Master/texmf-dist/scripts/epstopdf/epstopdf.pl
index a312a9b7f90..25746bc7960 100755
--- a/Master/texmf-dist/scripts/epstopdf/epstopdf.pl
+++ b/Master/texmf-dist/scripts/epstopdf/epstopdf.pl
@@ -2,7 +2,7 @@ eval '(exit $?0)' && eval 'exec perl -S $0 ${1+"$@"}' && eval 'exec perl -S $0 $
   if 0;
 use strict;
 
-# $Id: epstopdf.pl 16244 2009-11-30 01:36:08Z karl $
+# $Id: epstopdf.pl 17388 2010-03-09 00:25:42Z karl $
 # (Copyright lines below.)
 #
 # Redistribution and use in source and binary forms, with or without
@@ -39,14 +39,24 @@ use strict;
 #   c) the result is piped to Ghostscript and a PDF version written.
 #
 # It needs a Level 2 PS interpreter.
-# If the bounding box is not right, of course, there will be problems.
+# If the input bounding box is not right, of course there will be problems.
 #
-# One thing not allowed for is the case of
+# One thing not allowed for: the case of
 # "%%BoundingBox: (atend)" when input is not seekable (e.g., from a pipe),
-# which is more complicated.
 #
 # emacs-page
 # History
+#  2010/03/08 v2.14 (Manuel P\'egouri\'e-Gonnard)
+#    * In restricted mode, forbid --gscmd (all platforms) and call GS with full
+#    path relative to self location (windows).
+#  2010/02/26 v2.13 (Karl Berry)
+#    * New release.
+#  2010/02/23       (Manuel P\'egouri\'e-Gonnard)
+#    * Use kpsewhich for filename validation in restricted mode, both input and
+#    output. Requires kpathsea 5.1.0 (TL2010), rejects the name with earlier
+#    versions of kpsewhich.
+#    * Call external programs with full path on win32 in order to avoid obvious
+#    attacks with rogue versions of these programs in the current directory.
 #  2009/11/27 v2.12 (Karl Berry)
 #    * Make --filter work again
 #  2009/11/25       (Manuel P\'egouri\'e-Gonnard)
@@ -133,9 +143,9 @@ use strict;
 
 ### program identification
 my $program = "epstopdf";
-my $ident = '($Id: epstopdf.pl 16244 2009-11-30 01:36:08Z karl $) 2.12';
+my $ident = '($Id: epstopdf.pl 17388 2010-03-09 00:25:42Z karl $) 2.14';
 my $copyright = <<END_COPYRIGHT ;
-Copyright 2009 Karl Berry et al.
+Copyright 2009-2010 Karl Berry et al.
 Copyright 2002-2009 Gerben Wierda et al.
 Copyright 1998-2001 Sebastian Rahtz et al.
 License RBSD: Revised BSD <http://www.xfree86.org/3.3.6/COPYRIGHT2.html#5>
@@ -153,17 +163,17 @@ my $restricted = 0;
 $restricted = 1 if $0 =~ /repstopdf/;
 
 ### options
-$::opt_outfile="";
-$::opt_compress=1;
-$::opt_debug=0;
-$::opt_embed=1;
-$::opt_exact=0;
-$::opt_filter=0;
-$::opt_gs=1;
-$::opt_hires=0;
-$::opt_gscmd="";
-$::opt_res=0;
-$::opt_autorotate="None";
+$::opt_autorotate = "None";
+$::opt_compress = 1;
+$::opt_debug = 0;
+$::opt_embed = 1;
+$::opt_exact = 0;
+$::opt_filter = 0;
+$::opt_gs = 1;
+$::opt_gscmd = "";
+$::opt_hires = 0;
+$::opt_outfile = "";
+$::opt_res = 0;
 
 ### usage
 my @bool = ("false", "true");
@@ -193,7 +203,7 @@ Options:
                       For EPS files, PageByPage is equivalent to All
   --restricted       use restricted mode   (default: $bool[$restricted])
 
-Examples for producing 'test.pdf':
+Examples producing test.pdf:
   * $program test.eps
   * produce postscript | $program --filter >test.pdf
   * produce postscript | $program -f -d -o=test.pdf
@@ -211,40 +221,57 @@ END_OF_USAGE
 ### process options
 use Getopt::Long;
 GetOptions (
-  "help",
-  "version",
-  "outfile=s", 		# \ref{openout_any}
+  "autorotate=s",	# \ref{val_autorotate}
   "compress!",
   "debug!",
   "embed!",
   "exact!",
   "filter!",
   "gs!",
-  "hires!",
   "gscmd=s", 		# \ref{val_gscmd}
-  "res=i",		# validated by Getopt ('i' specifier)
-  "autorotate=s",	# \ref{val_autorotate}
+  "help",
+  "hires!",
+  "outfile=s", 		# \ref{openout_any}
+  "res=i",		# validated by getopt ('i' specifier)
   "restricted",
+  "version",
 ) or die $usage;
 
 ### help functions
-sub debug {
-  print STDERR "* @_\n" if $::opt_debug;
-}
-sub warning {
-  print STDERR "==> Warning: @_\n";
-}
-sub error {
-  die "$title!!! Error: @_\n";
-}
-sub errorUsage {
-  die "$usage\n!!! Error: @_\n";
-}
+sub debug      { print STDERR "* @_\n" if $::opt_debug; }
+sub warning    { print STDERR "==> Warning: @_\n"; }
+sub error      { die "$title!!! Error: @_\n"; }
+sub errorUsage { die "Error: @_ (try --help for more information)\n"; }
 
 ### restricted option
 $restricted = 1 if $::opt_restricted;
 debug "Restricted mode activated" if $restricted;
 
+### safer external commands for windows in restricted mode
+my $kpsewhich = 'kpsewhich';
+if ($restricted and ($^O eq 'MSWin32')) {
+  use File::Basename;
+  my $mydirname = dirname $0;
+  # $mydirname is the location of the Perl script
+  $kpsewhich = "$mydirname/../../../bin/win32/$kpsewhich";
+  $GS = "$mydirname/../../../tlpkg/tlgs/bin/$GS";
+}
+debug "kpsewhich command: $kpsewhich";
+
+### check if a name is "safe" according to kpse's open(in|out)_any
+# return true if name is ok, false otherwise
+sub safe_name
+{
+  my ($mode, $name) = @_;
+  my $option = "";
+  $option = '-safe-in-name'  if $mode eq 'in';
+  $option = '-safe-out-name' if $mode eq 'out';
+  error "Unknown check mode in safe_name(): $mode" unless $option;
+  my @args = ($kpsewhich, '-progname', 'repstopdf', $option, $name);
+  my $bad = system {$args[0]} @args;
+  return ! $bad;
+}
+
 ### help, version options.
 if ($::opt_help) {
   print $usage;
@@ -257,29 +284,28 @@ if ($::opt_version) {
   exit (0);
 }
 
-### get input filename
+### get input filename (\ref{openin_any} for validation)
 my $InputFilename = "";
 if ($::opt_filter) {
   @ARGV == 0 or
-    die errorUsage "Input file cannot be used with filter option";
+    errorUsage "Input file cannot be used with filter option";
   debug "Filtering: will read standard input";
 } else {
-  @ARGV > 0 or die errorUsage "Input filename missing";
-  @ARGV < 2 or die errorUsage "Unknown option or too many input files";
+  @ARGV > 0 or errorUsage "Input filename missing";
+  @ARGV < 2 or errorUsage "Unknown option or too many input files";
   $InputFilename = $ARGV[0];
   #-r $InputFilename or error "\"$InputFilename\" not readable";
   debug "Input filename:", $InputFilename;
 }
 
+### emacs-page
 ### option gscmd
 if ($::opt_gscmd) {
-  debug "Switching from $GS to $::opt_gscmd";
-  $GS = $::opt_gscmd;
-  # validate GS \label{val_gscmd}
-  if ($restricted) {
-    $GS =~ /^(gs|mgs|gswin32c|gs386|gsos2)\z/
-      or $GS =~ /^gs[\-_]?(\d|\d[\.-_]?\d\d)c?\z/
-      or die error "Value of gscmd '$GS' not allowed in restricted mode.";
+  if ($restricted) { # \label{val_gscmd}
+    error "Option forbidden in restricted mode: --gscmd";
+  } else {
+    debug "Switching from $GS to $::opt_gscmd";
+    $GS = $::opt_gscmd;
   }
 }
 
@@ -321,7 +347,7 @@ $rotmsg = $::opt_autorotate ? $::opt_autorotate : "[use gs default]";
 error "Invalid value for autorotate: '$::opt_autorotate' "
   . "(use 'All', 'None' or 'PageByPage')."
   if ($::opt_autorotate and
-    not $::opt_autorotate =~ /^(None|All|PageByPage)\z/);
+    not $::opt_autorotate =~ /^(None|All|PageByPage)$/);
 
 ### option BoundingBox types
 my $BBName = "%%BoundingBox:";
@@ -331,31 +357,15 @@ $BBName = "%%HiResBoundingBox:" if $::opt_hires;
 $BBName = "%%ExactBoundingBox:" if $::opt_exact;
 debug "BoundingBox comment:", $BBName;
 
+### validate input file name in restricted mode \label{openin_any}
+if ($restricted and not $::opt_filter
+    and not safe_name('in', $InputFilename)) {
+  error "Input filename '$InputFilename' not allowed in restricted mode.";
+}
+
 ### validate output file name in restricted mode \label{openout_any}
-use File::Spec::Functions qw(splitpath file_name_is_absolute);
-if ($restricted) {
-  # use the equivalent of openout_any = p
-  # (see opennameok() web2c/lib/texmfmp.c)
-  # Well, for now, be even more paranoid: don't allow absolute path at all
-  my $ok = 1;
-  # disallow opening dot-files on Unix
-  unless ($^O eq "MSWin32") {
-    my ($drive, $path, $basename) = splitpath($OutputFilename);
-    $ok = 0 if $basename =~ /^\./;
-  }
-  # disallow absolute path
-  $ok = 0 if file_name_is_absolute($OutputFilename);
-  # disallow colon on Windows. It could be used either after a drive
-  # (like "a:dir\file") or for an alternate data stream (like
-  # "file:ads").
-  if ($^O eq "MSWin32" || $^O eq "cygwin") {
-    $ok = 0 if $OutputFilename =~ /:/;
-  }
-  # disallow going to parent directory
-  my $ds = ($^O eq "MSWin32" || $^O eq "cygwin") ? qr([\\/]) : qr(/);
-  $ok = 0 if $OutputFilename =~ /^\.\.$ds|$ds\.\.$ds/;
-  # we passed all tests
-  die error "Output filename '$OutputFilename' not allowed in restricted mode." unless $ok;
+if ($restricted and not safe_name('out', $OutputFilename)) {
+  error "Output filename '$OutputFilename' not allowed in restricted mode.";
 }
 
 ### option gs
@@ -584,3 +594,5 @@ if ($? & 127) {
 
 warning "BoundingBox not found" unless $BBCorrected;
 debug "Done.";
+
+# vim: ts=8 sw=2 expandtab:
diff --git a/Master/texmf/doc/man/man1/epstopdf.1 b/Master/texmf/doc/man/man1/epstopdf.1
index 7243280bafb..c8228ff53b6 100644
--- a/Master/texmf/doc/man/man1/epstopdf.1
+++ b/Master/texmf/doc/man/man1/epstopdf.1
@@ -1,5 +1,5 @@
-.TH EPSTOPDF 1 "30 November 2009"
-.\" $Id: epstopdf.1 16245 2009-11-30 01:37:26Z karl $
+.TH EPSTOPDF 1 "9 March 2010"
+.\" $Id: epstopdf.1 17388 2010-03-09 00:25:42Z karl $
 .\" man page originally by Jim Van Zandt
 .SH NAME
 epstopdf, repstopdf \- convert an EPS file to PDF
@@ -41,15 +41,16 @@ set image resolution (default: [use gs default])
 set AutoRotatePages (default: None); recognized \fIval\fP choices:
 None, All, PageByPage.  For EPS files, PageByPage is equivalent to All.
 .IP "\fB--restricted\fP=\fIval\fP"
-turn on restricted mode (default: [on for resptopdf, else off]);
-this restricts the values accepted by \fB--gscmd\fP and impose restrictions
-on the output file name similar to web2c's openout_any=p.
+turn on restricted mode (default: [on for repstopdf, else off]);
+this forbids the use of \fB--gscmd\fP and imposes restrictions on the input and
+output file names according to the values of openin_any and openout_any (see
+the Web2c manual, http://tug.org/web2c).
 .IP "\fB--help\fP
 display help message and exit
 .IP "\fB--version\fP
 display version information and exit
 .SH EXAMPLES
-Examples for producing "test.pdf":
+Examples which produce "test.pdf":
 .nf
 epstopdf test.eps
 produce postscript | epstopdf --filter >test.pdf
@@ -64,12 +65,15 @@ epstopdf -d --nogs --hires test.ps >testcorr.ps
 The case of "%%BoundingBox: (atend)"
 when input is not seekable (e.g., from a pipe) is not supported.
 .PP
-When reporting bugs, please include an input file and command line
-options so the problem can be reproduced.  Report bugs in
-the program or this man page to tex-k@tug.org.
+Report bugs in the program or this man page to tex-k@tug.org.  When
+reporting bugs, please include an input file and the command line
+options specified, so the problem can be reproduced.
 .SH SEE ALSO
 \fBgs\fP(1),
 \fBpdfcrop\fP(1).
+.PP
+The epstopdf LaTeX package, part of the oberdiek bundle, which automates
+running this script on the fly under TeX: http://ctan.org/pkg/epstopdf-pkg.
 .SH AUTHOR
 The script was originally written by Sebastian Rahtz, for Elsevier
 Science, with subsequent contributions from Gerben Wierda and many
@@ -77,6 +81,6 @@ others.  Currently maintained by Karl Berry.
 .PP
 Man page originally written by Jim Van Zandt.
 .PP
-epstopdf home page: http://tug.org/epstopdf/
+epstopdf home page: http://tug.org/epstopdf.
 .PP
 You may freely use, modify and/or distribute this file.