summaryrefslogtreecommitdiff
path: root/Master/texmf-dist
diff options
context:
space:
mode:
Diffstat (limited to 'Master/texmf-dist')
-rw-r--r--Master/texmf-dist/web2c/texmf.cnf4
1 files changed, 2 insertions, 2 deletions
diff --git a/Master/texmf-dist/web2c/texmf.cnf b/Master/texmf-dist/web2c/texmf.cnf
index 94d1b999fdf..333e6325b3d 100644
--- a/Master/texmf-dist/web2c/texmf.cnf
+++ b/Master/texmf-dist/web2c/texmf.cnf
@@ -649,7 +649,6 @@ shell_escape = p
%
shell_escape_commands = \
bibtex,bibtex8,\
-extractbb,\
gregorio,\
kpsewhich,\
l3sys-query,\
@@ -660,7 +659,8 @@ repstopdf,\
r-mpost,\
texosquery-jre8,\
-% we'd like to allow:
+% other programs considered:
+% extractbb - allowed in the past, but can be exploited.
% dvips - but external commands can be executed, need at least -R1.
% epspdf, ps2pdf, pstopdf - need to respect openout_any,
% and gs -dSAFER must be used and check for shell injection with filenames.