4

PSTricks and TikZ grant us access to PostScript. Is it safe?

I meant: Is there a vulnerability hole open for someone to exploit?

Edit: I just found that compiling PSTricks with xelatex might be unsafe because dNOSAFER must be enabled as explained in "News" section on date 2012-05-26. Is it correct?

7

Usually these days the postscript is converted to pdf or otherwise processed by a ghostscript based interpretor. ghostscript has an option to disable operations that you may not want to allow when running code from an unknown source:

-dSAFER

Disables the "deletefile" and "renamefile" operators and the ability to open files in any mode other than read-only. This strongly recommended for spoolers, conversion scripts or other sensitive environments where a badly written or malicious PostScript program code must be prevented from changing important files.

  • So compiling PSTricks with xelatex might be unsafe because dNOSAFER must be enabled as explained in "News" section on date 2012-05-26? – kiss my armpit Mar 18 '13 at 10:49
  • @Karl'sstudents hmm That site just says to add NOSAFER without saying exactly which pstricks features need it (I would have thought most would not) (oh unless it prevents ghostscript writing the pdf file? But that doesn't seem right as conversion scripts are an example where you want -dSAFER) if you have NOSAFER the main danger is not pstricks itself of course but tex files just writing literal postscript code to the dvi file – David Carlisle Mar 18 '13 at 11:00
  • @DavidCarlisle: it makes no sense to use the option -dSAFER when converting own PostScript files into PDF. And for PSTricks it makes absolutely no sense. – user2478 Mar 18 '13 at 11:05
  • @Herbert But if I take a random TeX file from the internet (say an MWE from this site) then it may load pstricks or tikz or any other sensible package but that isn't really the concern, it may just directly use postscript \special hidden in some macro expansions that can place arbitrary postscript. For the same reason that write18 is disabled or restricted by default, it seems that you should have -dSAFER by default if that is at all possible. – David Carlisle Mar 18 '13 at 11:10
  • 1
    @Herbert yes I know but the issues are the same. If it is necessary to make write18 an explicit user option turned off by default why would the same reasons not apply to -dsafer? – David Carlisle Mar 18 '13 at 11:29
4

I would say that it is safe at compile time, since PSTricks and TikZ only write PostScript in a file, but do not execute it.

The security hazards are related to the execution of the PostScript code, which is done in the PostScript interpreter (viewer) or in the printer.

In principle, PS is a turing-complete language, and it even has the possibility of open files for reading/writing, so if the interpreter allows it to do that, then the security risk is real.

This is what RFC1341 (about MIME types) says about PostScript (sec 7.4.2):

The execution of general-purpose PostScript interpreters entails
serious security risks, and implementors are discouraged from simply sending PostScript email bodies to "off-the-shelf" interpreters. While it is usually safe to send PostScript to a printer, where the potential for harm is greatly constrained, implementors should consider all of the following before they add interactive display of PostScript bodies to their mail readers.

The remainder of this section outlines some, though probably not all, of the possible problems with sending PostScript through the mail. [...]

You can read the rest in the RFC, but basically it can rename, delete, create, etc. files. It can even load an execute machine code (kind of TeX's \write18). It can alter parameters in the interpreter which can be retained across documents, altering the way other documents are processed (i.e. it is possible to "infect" the interpreter), etc. Not to mention the possibility of bugs in the interpreter which could be exploited.

However, I don't know if all those risk are purely theoretical, or if there was indeed any actual case of PS-exploit.

  • PStricks writes code which runs PS-files – user2478 Mar 18 '13 at 11:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.