From 03070f532392d9e24d8dc2b79df0c626abc599f0 Mon Sep 17 00:00:00 2001 From: Karl Berry Date: Mon, 19 Oct 2009 23:12:04 +0000 Subject: discourage shell_escape=p git-svn-id: svn://tug.org/texlive/trunk@15842 c570f23f-e606-0410-a88d-b1316a301751 --- Master/texmf/web2c/texmf.cnf | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) (limited to 'Master/texmf/web2c') diff --git a/Master/texmf/web2c/texmf.cnf b/Master/texmf/web2c/texmf.cnf index 4259f954d1c..e430efe55a2 100644 --- a/Master/texmf/web2c/texmf.cnf +++ b/Master/texmf/web2c/texmf.cnf @@ -485,7 +485,7 @@ engine = unsetengine try_std_extension_first = t % Enable system commands via \write18{...}. When enabled fully (set to -% 1), obviously insecure. When enabled partially (set to p), only the +% t), obviously insecure. When enabled partially (set to p), only the % commands listed in shell_escape_commands are allowed. Although this % is not fully secure either, it is much better, and so useful that we % enable it for everything but bare tex. @@ -495,9 +495,15 @@ shell_escape = f % any output files, respect openout_any, or have hard-coded restrictions similar % or higher to openout_any=p. And have no features (nor, to the best of our % knowledge, obvious security holes) to invoke arbitrary other programs. +% +% Unfortunately we found too many problems with shell_escape=p, so it +% should be treated as though it were just as dangerous as shell_escape=t. shell_escape_commands = \ -kpsewhich,fc-match,\ -repstopdf,\ +false + +% These programs are our first goal when we can enable it. +%kpsewhich,fc-match,\ +%repstopdf,\ % we'd like to allow: % dvips - but external commands can be executed, need at least -R1. -- cgit v1.2.3