summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--Build/source/texk/kpathsea/ChangeLog5
-rw-r--r--Build/source/texk/kpathsea/texmf.cnf14
-rw-r--r--Master/texmf/web2c/texmf.cnf14
3 files changed, 23 insertions, 10 deletions
diff --git a/Build/source/texk/kpathsea/ChangeLog b/Build/source/texk/kpathsea/ChangeLog
index caee7928846..b8133a99135 100644
--- a/Build/source/texk/kpathsea/ChangeLog
+++ b/Build/source/texk/kpathsea/ChangeLog
@@ -1,3 +1,8 @@
+2009-10-15 Manuel Pégourié-Gonnard <mpg@elzevir.fr>
+
+ * texmf.cnf (shell_escape_commands): add repstopdf, a version of
+ epstopdf with restrictions intended to make it safer.
+
2009-10-13 Karl Berry <karl@tug.org>
* texmf.cnf (shell_escape_commands): remove the ps-to-pdf programs
diff --git a/Build/source/texk/kpathsea/texmf.cnf b/Build/source/texk/kpathsea/texmf.cnf
index 6831580d478..a23924b6088 100644
--- a/Build/source/texk/kpathsea/texmf.cnf
+++ b/Build/source/texk/kpathsea/texmf.cnf
@@ -492,11 +492,13 @@ try_std_extension_first = t
shell_escape = p
% No spaces in this command list. These programs either do not write
-% any output files or respect openout_any. And have no features to
-% invoke other programs.
+% any output files, respect openout_any, or have hard-coded restrictions similar
+% or higher to openout_any=p. And have no features (nor, to the best of our
+% knowledge, security holes) to invoke arbitrary other programs.
shell_escape_commands = \
-bibtex,bibtex8,fc-match,\
-kpsewhich,makeindex,\
+kpsewhich,fc-match,\
+bibtex,bibtex8,makeindex,\
+repstopdf,\
% we'd like to allow:
% dvips - but external commands can be executed, need at least -R1.
@@ -504,11 +506,13 @@ kpsewhich,makeindex,\
% without Unix convert it hardly seems worth it, and Windows convert
% is something completely different that destroys filesystems, so
% skip it.
-% epspdf, epstopdf, ps2pdf, pstopdf, rpdfcrop - need to respect openout_any.
+% epspdf, epstopdf, ps2pdf, pstopdf, rpdfcrop - need to respect openout_any,
+% and we need to make sure -dSAFER is used and no injection is possible.
% pygmentize - but is the filter feature insecure?
% ps4pdf - but it calls an unrestricted latex.
% texindy,xindy - but is the module feature insecure?
% ulqda - but requires optional SHA1.pm, so why bother.
+% tex, latex, etc - but need to forbid --shell-escape, and inherit openout_any
% plain TeX should remain unenhanced.
shell_escape.tex = f
diff --git a/Master/texmf/web2c/texmf.cnf b/Master/texmf/web2c/texmf.cnf
index 6831580d478..a23924b6088 100644
--- a/Master/texmf/web2c/texmf.cnf
+++ b/Master/texmf/web2c/texmf.cnf
@@ -492,11 +492,13 @@ try_std_extension_first = t
shell_escape = p
% No spaces in this command list. These programs either do not write
-% any output files or respect openout_any. And have no features to
-% invoke other programs.
+% any output files, respect openout_any, or have hard-coded restrictions similar
+% or higher to openout_any=p. And have no features (nor, to the best of our
+% knowledge, security holes) to invoke arbitrary other programs.
shell_escape_commands = \
-bibtex,bibtex8,fc-match,\
-kpsewhich,makeindex,\
+kpsewhich,fc-match,\
+bibtex,bibtex8,makeindex,\
+repstopdf,\
% we'd like to allow:
% dvips - but external commands can be executed, need at least -R1.
@@ -504,11 +506,13 @@ kpsewhich,makeindex,\
% without Unix convert it hardly seems worth it, and Windows convert
% is something completely different that destroys filesystems, so
% skip it.
-% epspdf, epstopdf, ps2pdf, pstopdf, rpdfcrop - need to respect openout_any.
+% epspdf, epstopdf, ps2pdf, pstopdf, rpdfcrop - need to respect openout_any,
+% and we need to make sure -dSAFER is used and no injection is possible.
% pygmentize - but is the filter feature insecure?
% ps4pdf - but it calls an unrestricted latex.
% texindy,xindy - but is the module feature insecure?
% ulqda - but requires optional SHA1.pm, so why bother.
+% tex, latex, etc - but need to forbid --shell-escape, and inherit openout_any
% plain TeX should remain unenhanced.
shell_escape.tex = f