19

There are a large number of packages (plus some classes) uploaded and updated in CTAN (other mirrors as well). How do the CTAN maintainers make sure the uploaded stuff is free of malicious code? Do they use a sophisticated script (like anti-virus checkers probably use) to parse the code to check for cleanness?

  • 5
    I'm not aware of any check done by the CTAN maintainers. With the default settings TeX is limited in its power to read and write files on the computer and therefore LaTeX packages and classes aren't a big thread. – Martin Scharrer Mar 18 '13 at 11:18
  • 1
    Moreover, you can disable writing to a greater or lesser extent depending on how paranoid you are. – Joseph Wright Mar 18 '13 at 11:20
  • How about packages that need -shell-escape? Do they pass them without any security check? – kiss my armpit Mar 18 '13 at 11:27
  • @Karl'sstudents No checks are made on the code, although the occasional loss of a file is picked up by the CTAN guys. – Joseph Wright Mar 18 '13 at 12:06
  • 6
    I think a cost-benefit analysis predicts not much to be gained from writing a virus into a LaTeX package or class. First, you limit the susceptible audience to LaTeX users. Then, you need to design a fake package or class (with documentation) that a good portion of users will be tempted into using. Then you have to obscure the actual function within the package's code, which will be visible to all users. So a lot of work for not much impact. – Matthew Leingang Mar 18 '13 at 12:35
21

we don't apply any checks, since we know of no published "automatic" checks we could apply. most things submitted nowadays are simply too big for a visual check (such as i used to apply in the '90s when i first worked on ctan).

one hopes that people won't run anything with "standard" overwriting controls disabled, and we can't, of course, say anything about "unprotected" behaviour of packages (or anything else, for that matter).

in short caveat emptor...

  • 1
    barbara beeton's writing convention used here, please don't make any capitalization correction. – kiss my armpit Mar 18 '13 at 12:31
  • 3
    @Karl'sstudents Can't wasteofspace protect their own publications, did you sign with the wrong username, or am I missing something obvious? – user10274 Mar 18 '13 at 12:49
  • 1
    @marczellm: Yes. Because she spoke on behalf of her own. – kiss my armpit Mar 18 '13 at 15:08
  • 1
    @marczellm: in my understanding or knowledge, she will use lower case for all characters when she talk on behalf of ams. correct me if i am wrong. – kiss my armpit Mar 18 '13 at 15:19
  • 1
    @Karl'sstudents To the contrary, as stated at the very end of this TUG interview which I just found. – marczellm Mar 18 '13 at 15:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.