summaryrefslogtreecommitdiff
path: root/Build/source/texk/kpathsea/texmf.cnf
diff options
context:
space:
mode:
Diffstat (limited to 'Build/source/texk/kpathsea/texmf.cnf')
-rw-r--r--Build/source/texk/kpathsea/texmf.cnf14
1 files changed, 9 insertions, 5 deletions
diff --git a/Build/source/texk/kpathsea/texmf.cnf b/Build/source/texk/kpathsea/texmf.cnf
index 6831580d478..a23924b6088 100644
--- a/Build/source/texk/kpathsea/texmf.cnf
+++ b/Build/source/texk/kpathsea/texmf.cnf
@@ -492,11 +492,13 @@ try_std_extension_first = t
shell_escape = p
% No spaces in this command list. These programs either do not write
-% any output files or respect openout_any. And have no features to
-% invoke other programs.
+% any output files, respect openout_any, or have hard-coded restrictions similar
+% or higher to openout_any=p. And have no features (nor, to the best of our
+% knowledge, security holes) to invoke arbitrary other programs.
shell_escape_commands = \
-bibtex,bibtex8,fc-match,\
-kpsewhich,makeindex,\
+kpsewhich,fc-match,\
+bibtex,bibtex8,makeindex,\
+repstopdf,\
% we'd like to allow:
% dvips - but external commands can be executed, need at least -R1.
@@ -504,11 +506,13 @@ kpsewhich,makeindex,\
% without Unix convert it hardly seems worth it, and Windows convert
% is something completely different that destroys filesystems, so
% skip it.
-% epspdf, epstopdf, ps2pdf, pstopdf, rpdfcrop - need to respect openout_any.
+% epspdf, epstopdf, ps2pdf, pstopdf, rpdfcrop - need to respect openout_any,
+% and we need to make sure -dSAFER is used and no injection is possible.
% pygmentize - but is the filter feature insecure?
% ps4pdf - but it calls an unrestricted latex.
% texindy,xindy - but is the module feature insecure?
% ulqda - but requires optional SHA1.pm, so why bother.
+% tex, latex, etc - but need to forbid --shell-escape, and inherit openout_any
% plain TeX should remain unenhanced.
shell_escape.tex = f