From 5024fb4890c7b795c5891b605f809eb119af837c Mon Sep 17 00:00:00 2001 From: Karl Berry Date: Tue, 7 Mar 2023 22:22:41 +0000 Subject: epstopdf (7mar23) (branch) git-svn-id: svn://tug.org/texlive/branches/branch2022.final@66442 c570f23f-e606-0410-a88d-b1316a301751 --- .../texlive/linked_scripts/epstopdf/epstopdf.pl | 42 ++++++++++++++++----- Master/texmf-dist/doc/man/man1/epstopdf.1 | 24 +++++++----- Master/texmf-dist/doc/man/man1/epstopdf.man1.pdf | Bin 31067 -> 31088 bytes Master/texmf-dist/doc/man/man1/repstopdf.man1.pdf | Bin 31067 -> 31088 bytes Master/texmf-dist/scripts/epstopdf/epstopdf.pl | 42 ++++++++++++++++----- 5 files changed, 80 insertions(+), 28 deletions(-) diff --git a/Build/source/texk/texlive/linked_scripts/epstopdf/epstopdf.pl b/Build/source/texk/texlive/linked_scripts/epstopdf/epstopdf.pl index c4003e25c1f..6f0637ad286 100755 --- a/Build/source/texk/texlive/linked_scripts/epstopdf/epstopdf.pl +++ b/Build/source/texk/texlive/linked_scripts/epstopdf/epstopdf.pl @@ -1,5 +1,5 @@ #!/usr/bin/env perl -# $Id: epstopdf.pl 64317 2022-09-08 01:25:27Z karl $ +# $Id: epstopdf.pl 66407 2023-03-06 23:44:49Z karl $ # (Copyright lines below.) # # Redistribution and use in source and binary forms, with or without @@ -35,7 +35,11 @@ # # emacs-page # -my $ver = "2.30"; +my $ver = "2.31"; +# 2023/03/06 v2.31 (Karl Berry) +# * disallow --nosafer in restricted mode. +# * disallow output to pipes in restricted mode. +# Report from nikolay.ermishkin to tlsecurity. # 2022/09/05 v2.30 (Siep Kroonenberg) # * still use gswin32c if gswin64c.exe not on PATH. # 2022/08/29 v2.29 (Karl Berry) @@ -193,9 +197,9 @@ my $ver = "2.30"; ### emacs-page ### program identification my $program = "epstopdf"; -my $ident = '($Id: epstopdf.pl 64317 2022-09-08 01:25:27Z karl $)' . " $ver"; +my $ident = '($Id: epstopdf.pl 66407 2023-03-06 23:44:49Z karl $)' . " $ver"; my $copyright = < @@ -498,8 +502,9 @@ if ($restricted && $on_windows) { my $mydirname = dirname $0; # $mydirname is the location of the Perl script $kpsewhich = "$mydirname/../../../bin/win32/$kpsewhich"; + debug "Restricted Windows kpsewhich: $kpsewhich"; $GS = "$mydirname/../../../tlpkg/tlgs/bin/$GS"; - debug "restricted Windows gs: $GS"; + debug "Restricted Windows gs: $GS"; } debug "kpsewhich command: $kpsewhich"; @@ -512,7 +517,8 @@ sub safe_name { $option = '-safe-out-name' if $mode eq 'out'; error "Unknown check mode in safe_name(): $mode" unless $option; my @args = ($kpsewhich, '-progname', 'repstopdf', $option, $name); - my $bad = system {$args[0]} @args; + debug "Checking safe_name with: @args"; + my $bad = system { $args[0] } @args; return ! $bad; } @@ -569,10 +575,21 @@ if ($::opt_gscmd) { } } +### option (no)safer +my $gs_opt_safer = "-dSAFER"; +if (! $::opt_safer) { + if ($restricted) { + error "Option forbidden in restricted mode: --nosafer"; + } else { + debug "Switching from $gs_opt_safer to -dNOSAFER"; + $gs_opt_safer = "--nosafer"; + } +} + ### start building GS command line for the pipe my @GS = ($GS); push @GS, '-q' if $::opt_quiet; -push @GS, $::opt_safer ? '-dSAFER' : '-dNOSAFER'; +push @GS, $gs_opt_safer; push @GS, '-dNOPAUSE'; push @GS, '-dBATCH'; push @GS, '-dCompatibilityLevel=1.5'; @@ -609,7 +626,13 @@ if (! $OutputFilename) { $OutputFilename = "-"; } } -$OutputFilename =~ s/%/%%/g; # we will do the escaping for gs +# +# gs -sOutputFilename opens pipes itself if the string starts with +# %pipe or |. Disallow this in restricted mode. +if ($restricted && $OutputFilename =~ /^(%pipe|\|)/) { + error "Output to pipe forbidden in restricted mode: $OutputFilename"; +} +$OutputFilename =~ s/%/%%/g; # stop gs interpretation of % characters debug "Output filename:", $OutputFilename; push @GS, "-sOutputFile=$OutputFilename"; @@ -737,6 +760,7 @@ else { debug "No Ghostscript: opening $OutputFilename"; if ($OutputFilename eq "-") { $OUT = *STDOUT; + $outname = "-"; } else { open($OUT, '>', $OutputFilename) || error ("Cannot write \"$OutputFilename\": $!"); @@ -795,7 +819,7 @@ if ($buflen > 0) { debug " No checksum"; } else { - debug " checksum: $checksum"; + debug " Checksum: $checksum"; my $cs = 0; map { $cs ^= $_ } unpack('n14', $header); if ($cs != $checksum) { diff --git a/Master/texmf-dist/doc/man/man1/epstopdf.1 b/Master/texmf-dist/doc/man/man1/epstopdf.1 index feb5e887c9b..6f152485603 100644 --- a/Master/texmf-dist/doc/man/man1/epstopdf.1 +++ b/Master/texmf-dist/doc/man/man1/epstopdf.1 @@ -1,5 +1,5 @@ -.TH EPSTOPDF 1 "29 August 2022" -.\" $Id: epstopdf.1 64235 2022-08-29 22:52:01Z karl $ +.TH EPSTOPDF 1 "6 March 2023" +.\" $Id: epstopdf.1 66408 2023-03-06 23:45:51Z karl $ .SH NAME epstopdf, repstopdf \- convert an EPS file to PDF .SH SYNOPSIS @@ -62,7 +62,7 @@ is, the input PostScript as modified by \fBepstopdf\fP. scan HiresBoundingBox (default: false). .IP "\fB--restricted\fP=\fIval\fP" turn on restricted mode (default: [true for repstopdf, else false]); -this forbids the use of \fB--gscmd\fP and other options and imposes +this forbids the use of \fB--gscmd\fP, among other options, and imposes restrictions on the input and output file names according to the values of openin_any and openout_any (see the Web2c manual, https://tug.org/web2c). On Windows, the Ghostscript command is forced to be the TeX Live builtin @@ -108,12 +108,12 @@ with gs can be specified with either or both of the two cumulative options \fB--gsopts\fP and \fB--gsopt.\fP .PP \fB--gsopts\fP takes a single string of options, which is split at -whitespace, each resulting word then added to the gs command line +whitespace; each resulting word then added to the gs command line individually. .PP \fB--gsopt\fP adds its argument as a single option to the gs command -line. It can be used multiple times to specify options separately, -and is necessary if an option or its value contains whitespace. +line. It can be used multiple times to specify options separately. +This must be used if a gs option or its value contains whitespace. .PP In restricted mode, options are limited to those with names and values known to be safe. Some options taking booleans, integers or fixed @@ -135,7 +135,7 @@ epstopdf --hires test.eps .PP Example for \fBepstopdf\fP's attempt at correcting PostScript: .nf -$program --nogs test.ps >testcorr.ps +epstopdf --nogs test.ps >testcorr.ps .fi .PP In all cases, you can add \fB--debug\fP (\fB-d\fP) to see more about @@ -144,9 +144,10 @@ what \fBepstopdf\fP is doing. The case of "%%BoundingBox: (atend)" when input is not seekable (e.g., from a pipe) is not supported. .PP -Report bugs in the program or this man page to tex-k@tug.org. When -reporting bugs, please include an input file and the command line -options specified, so the problem can be reproduced. +Report bugs in the program or this man page to tex-k@tug.org +(https://lists.tug.org/tex-k). When reporting bugs, please include an +input file and the command line options specified, so the problem can be +reproduced. .SH SEE ALSO \fBgs\fP(1), \fBpdfcrop\fP(1). @@ -163,3 +164,6 @@ Man page originally written by Jim Van Zandt. epstopdf home page: https://tug.org/epstopdf. .PP You may freely use, modify and/or distribute this man page. +The epstopdf script is released under a modified BSD license. +.PP +$Id: epstopdf.1 66408 2023-03-06 23:45:51Z karl $ diff --git a/Master/texmf-dist/doc/man/man1/epstopdf.man1.pdf b/Master/texmf-dist/doc/man/man1/epstopdf.man1.pdf index 7e1f637d91c..424f20d1877 100644 Binary files a/Master/texmf-dist/doc/man/man1/epstopdf.man1.pdf and b/Master/texmf-dist/doc/man/man1/epstopdf.man1.pdf differ diff --git a/Master/texmf-dist/doc/man/man1/repstopdf.man1.pdf b/Master/texmf-dist/doc/man/man1/repstopdf.man1.pdf index dd1e12bcbef..377128acc5e 100644 Binary files a/Master/texmf-dist/doc/man/man1/repstopdf.man1.pdf and b/Master/texmf-dist/doc/man/man1/repstopdf.man1.pdf differ diff --git a/Master/texmf-dist/scripts/epstopdf/epstopdf.pl b/Master/texmf-dist/scripts/epstopdf/epstopdf.pl index c4003e25c1f..6f0637ad286 100755 --- a/Master/texmf-dist/scripts/epstopdf/epstopdf.pl +++ b/Master/texmf-dist/scripts/epstopdf/epstopdf.pl @@ -1,5 +1,5 @@ #!/usr/bin/env perl -# $Id: epstopdf.pl 64317 2022-09-08 01:25:27Z karl $ +# $Id: epstopdf.pl 66407 2023-03-06 23:44:49Z karl $ # (Copyright lines below.) # # Redistribution and use in source and binary forms, with or without @@ -35,7 +35,11 @@ # # emacs-page # -my $ver = "2.30"; +my $ver = "2.31"; +# 2023/03/06 v2.31 (Karl Berry) +# * disallow --nosafer in restricted mode. +# * disallow output to pipes in restricted mode. +# Report from nikolay.ermishkin to tlsecurity. # 2022/09/05 v2.30 (Siep Kroonenberg) # * still use gswin32c if gswin64c.exe not on PATH. # 2022/08/29 v2.29 (Karl Berry) @@ -193,9 +197,9 @@ my $ver = "2.30"; ### emacs-page ### program identification my $program = "epstopdf"; -my $ident = '($Id: epstopdf.pl 64317 2022-09-08 01:25:27Z karl $)' . " $ver"; +my $ident = '($Id: epstopdf.pl 66407 2023-03-06 23:44:49Z karl $)' . " $ver"; my $copyright = < @@ -498,8 +502,9 @@ if ($restricted && $on_windows) { my $mydirname = dirname $0; # $mydirname is the location of the Perl script $kpsewhich = "$mydirname/../../../bin/win32/$kpsewhich"; + debug "Restricted Windows kpsewhich: $kpsewhich"; $GS = "$mydirname/../../../tlpkg/tlgs/bin/$GS"; - debug "restricted Windows gs: $GS"; + debug "Restricted Windows gs: $GS"; } debug "kpsewhich command: $kpsewhich"; @@ -512,7 +517,8 @@ sub safe_name { $option = '-safe-out-name' if $mode eq 'out'; error "Unknown check mode in safe_name(): $mode" unless $option; my @args = ($kpsewhich, '-progname', 'repstopdf', $option, $name); - my $bad = system {$args[0]} @args; + debug "Checking safe_name with: @args"; + my $bad = system { $args[0] } @args; return ! $bad; } @@ -569,10 +575,21 @@ if ($::opt_gscmd) { } } +### option (no)safer +my $gs_opt_safer = "-dSAFER"; +if (! $::opt_safer) { + if ($restricted) { + error "Option forbidden in restricted mode: --nosafer"; + } else { + debug "Switching from $gs_opt_safer to -dNOSAFER"; + $gs_opt_safer = "--nosafer"; + } +} + ### start building GS command line for the pipe my @GS = ($GS); push @GS, '-q' if $::opt_quiet; -push @GS, $::opt_safer ? '-dSAFER' : '-dNOSAFER'; +push @GS, $gs_opt_safer; push @GS, '-dNOPAUSE'; push @GS, '-dBATCH'; push @GS, '-dCompatibilityLevel=1.5'; @@ -609,7 +626,13 @@ if (! $OutputFilename) { $OutputFilename = "-"; } } -$OutputFilename =~ s/%/%%/g; # we will do the escaping for gs +# +# gs -sOutputFilename opens pipes itself if the string starts with +# %pipe or |. Disallow this in restricted mode. +if ($restricted && $OutputFilename =~ /^(%pipe|\|)/) { + error "Output to pipe forbidden in restricted mode: $OutputFilename"; +} +$OutputFilename =~ s/%/%%/g; # stop gs interpretation of % characters debug "Output filename:", $OutputFilename; push @GS, "-sOutputFile=$OutputFilename"; @@ -737,6 +760,7 @@ else { debug "No Ghostscript: opening $OutputFilename"; if ($OutputFilename eq "-") { $OUT = *STDOUT; + $outname = "-"; } else { open($OUT, '>', $OutputFilename) || error ("Cannot write \"$OutputFilename\": $!"); @@ -795,7 +819,7 @@ if ($buflen > 0) { debug " No checksum"; } else { - debug " checksum: $checksum"; + debug " Checksum: $checksum"; my $cs = 0; map { $cs ^= $_ } unpack('n14', $header); if ($cs != $checksum) { -- cgit v1.2.3