SEC: Block shell escapes in latex and ps commands#31282
SEC: Block shell escapes in latex and ps commands#31282WeatherGod merged 1 commit intomatplotlib:mainfrom
Conversation
|
Looks like the |
e05114b to
dec7e56
Compare
|
It's possible switching away from |
tacaswell
left a comment
There was a problem hiding this comment.
I am indifferent to settling on one or two - on latex cli args or leaving as-is.
dec7e56 to
22f4279
Compare
|
In principle, I approve these changes, but I don't know if the test failure is one of the spurious failures or actually related to these changes. |
|
Someone must have re-run them, I'm only seeing a codecov failures but it is short an upload so I am not worried. |
|
@meeseeksdev please backport to v3.10.x |
|
Owee, I'm MrMeeseeks, Look at me. There seem to be a conflict, please backport manually. Here are approximate instructions:
And apply the correct labels and milestones. Congratulations — you did some good work! Hopefully your backport PR will be tested by the continuous integration and merged soon! Remember to remove the If these instructions are inaccurate, feel free to suggest an improvement. |
SEC: Block shell escapes in latex and ps commands (cherry picked from commit 8ff895d) The test that was edited had significant updates on main, so the old test was kept on backport and no similar call exists in the old test.
Backport PR #31282 on branch v3.10.x (SEC: Block shell escapes in latex and ps commands)
PR summary
See the discussion in #31249
This blocks our LaTeX and ps commands from arbitrary code execution in the shell:
--no-shell-escapeadded to all latex commands-R0to-R1to disallow shell execution.-R1is the default, so is there a reason we had this manually set to a lower security level? See the docs here: https://www.tug.org/texinfohtml/dvips.html#Option-details-1-dSAFERflag added to two ghostscript / ps calls which were missing it. May be the default, but now it's explicit, see the docs here: https://ghostscript.readthedocs.io/en/latest/Use.html#dsaferAI Disclosure
Claude used for the audit (found a few more spots to hit!), code manually reviewed
PR checklist