diff options
| -rw-r--r-- | Build/source/texk/kpathsea/ChangeLog | 5 | ||||
| -rw-r--r-- | Build/source/texk/kpathsea/texmf.cnf | 14 | ||||
| -rw-r--r-- | Master/texmf/web2c/texmf.cnf | 14 |
3 files changed, 23 insertions, 10 deletions
diff --git a/Build/source/texk/kpathsea/ChangeLog b/Build/source/texk/kpathsea/ChangeLog index caee7928846..b8133a99135 100644 --- a/Build/source/texk/kpathsea/ChangeLog +++ b/Build/source/texk/kpathsea/ChangeLog @@ -1,3 +1,8 @@ +2009-10-15 Manuel Pégourié-Gonnard <mpg@elzevir.fr> + + * texmf.cnf (shell_escape_commands): add repstopdf, a version of + epstopdf with restrictions intended to make it safer. + 2009-10-13 Karl Berry <karl@tug.org> * texmf.cnf (shell_escape_commands): remove the ps-to-pdf programs diff --git a/Build/source/texk/kpathsea/texmf.cnf b/Build/source/texk/kpathsea/texmf.cnf index 6831580d478..a23924b6088 100644 --- a/Build/source/texk/kpathsea/texmf.cnf +++ b/Build/source/texk/kpathsea/texmf.cnf @@ -492,11 +492,13 @@ try_std_extension_first = t shell_escape = p % No spaces in this command list. These programs either do not write -% any output files or respect openout_any. And have no features to -% invoke other programs. +% any output files, respect openout_any, or have hard-coded restrictions similar +% or higher to openout_any=p. And have no features (nor, to the best of our +% knowledge, security holes) to invoke arbitrary other programs. shell_escape_commands = \ -bibtex,bibtex8,fc-match,\ -kpsewhich,makeindex,\ +kpsewhich,fc-match,\ +bibtex,bibtex8,makeindex,\ +repstopdf,\ % we'd like to allow: % dvips - but external commands can be executed, need at least -R1. @@ -504,11 +506,13 @@ kpsewhich,makeindex,\ % without Unix convert it hardly seems worth it, and Windows convert % is something completely different that destroys filesystems, so % skip it. -% epspdf, epstopdf, ps2pdf, pstopdf, rpdfcrop - need to respect openout_any. +% epspdf, epstopdf, ps2pdf, pstopdf, rpdfcrop - need to respect openout_any, +% and we need to make sure -dSAFER is used and no injection is possible. % pygmentize - but is the filter feature insecure? % ps4pdf - but it calls an unrestricted latex. % texindy,xindy - but is the module feature insecure? % ulqda - but requires optional SHA1.pm, so why bother. +% tex, latex, etc - but need to forbid --shell-escape, and inherit openout_any % plain TeX should remain unenhanced. shell_escape.tex = f diff --git a/Master/texmf/web2c/texmf.cnf b/Master/texmf/web2c/texmf.cnf index 6831580d478..a23924b6088 100644 --- a/Master/texmf/web2c/texmf.cnf +++ b/Master/texmf/web2c/texmf.cnf @@ -492,11 +492,13 @@ try_std_extension_first = t shell_escape = p % No spaces in this command list. These programs either do not write -% any output files or respect openout_any. And have no features to -% invoke other programs. +% any output files, respect openout_any, or have hard-coded restrictions similar +% or higher to openout_any=p. And have no features (nor, to the best of our +% knowledge, security holes) to invoke arbitrary other programs. shell_escape_commands = \ -bibtex,bibtex8,fc-match,\ -kpsewhich,makeindex,\ +kpsewhich,fc-match,\ +bibtex,bibtex8,makeindex,\ +repstopdf,\ % we'd like to allow: % dvips - but external commands can be executed, need at least -R1. @@ -504,11 +506,13 @@ kpsewhich,makeindex,\ % without Unix convert it hardly seems worth it, and Windows convert % is something completely different that destroys filesystems, so % skip it. -% epspdf, epstopdf, ps2pdf, pstopdf, rpdfcrop - need to respect openout_any. +% epspdf, epstopdf, ps2pdf, pstopdf, rpdfcrop - need to respect openout_any, +% and we need to make sure -dSAFER is used and no injection is possible. % pygmentize - but is the filter feature insecure? % ps4pdf - but it calls an unrestricted latex. % texindy,xindy - but is the module feature insecure? % ulqda - but requires optional SHA1.pm, so why bother. +% tex, latex, etc - but need to forbid --shell-escape, and inherit openout_any % plain TeX should remain unenhanced. shell_escape.tex = f |