From 0de5925b154dd85f9d701210476ebcf1c58baa41 Mon Sep 17 00:00:00 2001 From: Karl Berry Date: Tue, 18 May 2010 00:25:24 +0000 Subject: enable restricted shell escapes (again) git-svn-id: svn://tug.org/texlive/trunk@18321 c570f23f-e606-0410-a88d-b1316a301751 --- Build/source/texk/kpathsea/ChangeLog | 5 +++++ Build/source/texk/kpathsea/texmf.cnf | 22 +++++++++------------- 2 files changed, 14 insertions(+), 13 deletions(-) (limited to 'Build') diff --git a/Build/source/texk/kpathsea/ChangeLog b/Build/source/texk/kpathsea/ChangeLog index 7e09056af5f..d7fcb074502 100644 --- a/Build/source/texk/kpathsea/ChangeLog +++ b/Build/source/texk/kpathsea/ChangeLog @@ -1,5 +1,10 @@ 2010-05-18 Karl Berry + * texmf.cnf (shell_escape): set to p. Trying restricted shells again. + (shell_escape_commands): bibtex, bibtex8, + kpsewhich, makeindex, repstopdf. Don't plan to add anything + else for TL'10. + * NEWS, * kpsewhich.c (read_command_line), * texmf.cnf (TEXMFCONFIG, TEXMFVAR): 2010. diff --git a/Build/source/texk/kpathsea/texmf.cnf b/Build/source/texk/kpathsea/texmf.cnf index cba3213dfc3..61ee6340b73 100644 --- a/Build/source/texk/kpathsea/texmf.cnf +++ b/Build/source/texk/kpathsea/texmf.cnf @@ -496,7 +496,7 @@ try_std_extension_first = t % commands listed in shell_escape_commands are allowed. Although this % is not fully secure either, it is much better, and so useful that we % enable it for everything but bare tex. -shell_escape = f +shell_escape = p % No spaces in this command list. These programs either do not write % any output files, respect openout_any, or have hard-coded restrictions similar @@ -506,28 +506,24 @@ shell_escape = f % Unfortunately we found too many problems with shell_escape=p, so it % should be treated as though it were just as dangerous as shell_escape=t. shell_escape_commands = \ -false - -% These programs are our first goal when we can enable it. -%kpsewhich,fc-match,\ -%repstopdf,\ +bibtex,bibtex8,\ +kpsewhich,\ +makeindex,\ +repstopdf,\ % we'd like to allow: % dvips - but external commands can be executed, need at least -R1. % epspdf, ps2pdf, pstopdf - need to respect openout_any, -% and we need to make sure -dSAFER is used and no injection is possible. +% and gs -dSAFER must be used and check for shell injection with filenames. % (img)convert (ImageMagick) - delegates.mgk possible misconfig, besides, % without Unix convert it hardly seems worth it, and Windows convert -% is something completely different that destroys filesystems, so -% skip it. +% is something completely different that destroys filesystems, so skip. % pygmentize - but is the filter feature insecure? % ps4pdf - but it calls an unrestricted latex. +% rpdfcrop - maybe ok, but let's get experience with repstopdf first. % texindy,xindy - but is the module feature insecure? % ulqda - but requires optional SHA1.pm, so why bother. -% tex, latex, etc. - but need to forbid --shell-escape, and inherit openout_any -% -% repstopdf, rpdfcrop - maybe ok -% bibtex,bibtex8,makeindex - maybe ok +% tex, latex, etc. - need to forbid --shell-escape, and inherit openout_any. % plain TeX should remain unenhanced. shell_escape.tex = f -- cgit v1.2.3