# Is PostScript access from TeX (via PSTricks or TikZ) safe?

I meant: Is there a vulnerability hole open for someone to exploit?

Edit: I just found that compiling PSTricks with `xelatex` might be unsafe because `dNOSAFER` must be enabled as explained in "News" section on date 2012-05-26. Is it correct?

-

Usually these days the postscript is converted to pdf or otherwise processed by a ghostscript based interpretor. `ghostscript` has an option to disable operations that you may not want to allow when running code from an unknown source:

-dSAFER

Disables the "deletefile" and "renamefile" operators and the ability to open files in any mode other than read-only. This strongly recommended for spoolers, conversion scripts or other sensitive environments where a badly written or malicious PostScript program code must be prevented from changing important files.

-
So compiling PSTricks with `xelatex` might be unsafe because `dNOSAFER` must be enabled as explained in "News" section on date 2012-05-26? –  In PSTricks we trust Mar 18 '13 at 10:49
@Karl'sstudents hmm That site just says to add NOSAFER without saying exactly which pstricks features need it (I would have thought most would not) (oh unless it prevents ghostscript writing the pdf file? But that doesn't seem right as conversion scripts are an example where you want -dSAFER) if you have NOSAFER the main danger is not pstricks itself of course but tex files just writing literal postscript code to the dvi file –  David Carlisle Mar 18 '13 at 11:00
@DavidCarlisle: it makes no sense to use the option `-dSAFER` when converting own PostScript files into PDF. And for PSTricks it makes absolutely no sense. –  Herbert Mar 18 '13 at 11:05
OK. Thanks for answering. –  In PSTricks we trust Mar 18 '13 at 11:05
@Herbert yes I know but the issues are the same. If it is necessary to make write18 an explicit user option turned off by default why would the same reasons not apply to -dsafer? –  David Carlisle Mar 18 '13 at 11:29

I would say that it is safe at compile time, since PSTricks and TikZ only write PostScript in a file, but do not execute it.

The security hazards are related to the execution of the PostScript code, which is done in the PostScript interpreter (viewer) or in the printer.

In principle, PS is a turing-complete language, and it even has the possibility of open files for reading/writing, so if the interpreter allows it to do that, then the security risk is real.

This is what RFC1341 (about MIME types) says about PostScript (sec 7.4.2):

The execution of general-purpose PostScript interpreters entails
serious security risks, and implementors are discouraged from simply sending PostScript email bodies to "off-the-shelf" interpreters. While it is usually safe to send PostScript to a printer, where the potential for harm is greatly constrained, implementors should consider all of the following before they add interactive display of PostScript bodies to their mail readers.

The remainder of this section outlines some, though probably not all, of the possible problems with sending PostScript through the mail. [...]

You can read the rest in the RFC, but basically it can rename, delete, create, etc. files. It can even load an execute machine code (kind of TeX's `\write18`). It can alter parameters in the interpreter which can be retained across documents, altering the way other documents are processed (i.e. it is possible to "infect" the interpreter), etc. Not to mention the possibility of bugs in the interpreter which could be exploited.

However, I don't know if all those risk are purely theoretical, or if there was indeed any actual case of PS-exploit.

-
PStricks writes code which runs PS-files –  Herbert Mar 18 '13 at 11:08