Take the 2-minute tour ×
TeX - LaTeX Stack Exchange is a question and answer site for users of TeX, LaTeX, ConTeXt, and related typesetting systems. It's 100% free, no registration required.

Background

Users can provide text, which is transformed using XSL into a LaTeX document. The XSL template that transforms the XML document (containing user-defined text) currently resembles:

<xsl:template match="user-text">
  <xsl:text>  \item </xsl:text>
  <xsl:apply-templates />
</xsl:template>

This is then transformed into:

\item This is the text the user provided.

Problem

This allows the user to submit maliciously crafted LaTeX:

\item This is the \{latex} the user provided.

Ideas

Some ideas:

  • \begin{verbatim} and \end{verbatim} cause the text to appear without formatting (i.e., a monospace font).
  • Write an XSLT function that escapes the special characters.

Question

What is the simplest way to ensure user-defined text does not get interpreted as LaTeX code?

Something like \begin{verbatim} would be perfect if it didn't change the font, and prevent text from wrapping.

Related

share|improve this question
add comment

1 Answer

up vote 5 down vote accepted

If you want to render LateX syntax harmless in user input it either requires balanced braces (so that you can pick up the material as an argument and pass it through \scantokens) or it requires es sequence of "stop" tokens that are known not to be part of the material, e.g., \end{verbatim} or + in in \verb+foo+.

Neither can be guaranteed if you have no control whatsoever about the user input, e.g., what would happen if you user writes: "This text contains \end{verbatim} and now I'm free to use \LaTeX{} code."? Then it will blow up or at least execute the second part.

So if safety is important then XSLT is the way to go in my opinion. If you can live with that danger than consider changing \verbatim@font which is command that sets up the font used in verbatim and \verb. Its default definition is

\def\verbatim@font{\normalfont\ttfamily}

So if you change this to do "nothing" then you would get the normal body font.

Update (sorry wrong time of the day)

Of course that doesn't solve the fact that "verbatim" does not wrap. To fix this what is really needed is to write your own version of a "verbatim" environment" that doesn't change spaces to active and doesn't add

  \obeylines \verbatim@font \@noligs
  \hyphenchar\font\m@ne
  \everypar \expandafter{\the\everypar \unpenalty}%

in the first place, as those are your offenders.

share|improve this answer
    
@DaveJarvis no it doesn't see update. it is 5am here and I' up since 3 so ... –  Frank Mittelbach Feb 9 '13 at 4:40
    
@DaveJarvis hope it helps you ... turning into pumpkin now :-) –  Frank Mittelbach Feb 9 '13 at 4:46
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.