Reading Are there any disadvantages of TeX being Turing complete? got me thinking about the potential of .tex files for harbouring malicious code.

The filecontents package is used to write external files from within a LaTeX document. According to my tests, it can be used to write external files in an existing path down the directory tree. In other words, it can create a file in the directory in which the input .tex file is located, or in any of its subdirectories. For instance, the following code works as expected,

\documentclass{article}

\usepackage{filecontents}

\begin{filecontents*}{./myfolder/myfile.txt}
Hello World
\end{filecontents*}

\begin{document}
test
\end{document}

as long as

./myfolder

is a valid path (i.e. the "myfolder" subdirectory already exists):

Is writing an external file up the directory tree possible?

All of my attempts so far have been unfruitful. I'm guessing that it's not possible; otherwise, that would represent a potentially very malicious exploit, without even requiring --shell-escape; malevolent people would have used that exploit long before I asked myself this question, and LaTeX would have become infamous for it.

So, is writing an external file up the directory tree possible or not? If the answer is yes, how do you do it? If the answer is no, what exactly forbids it?

  • At your own risk, on a Bash shell, do openout_any=a pdflatex file thus overriding the variable's value for the current job. – egreg May 30 '13 at 19:52
  • @egreg Actually, if you assume that a makefile exists in the user's current directory, an innocent-looking .tex file, using filecontents, could overwrite it and insert open out_any=a pdflatex file in it (unbeknownst to the user). Right? – jubobs May 30 '13 at 19:55
  • @Jubobs I guess so. Always be careful when getting anything from not completely trusted sources. – egreg May 30 '13 at 20:01
  • @egreg Perhaps this topic deserves its own question on meta but here is a thought: shouldn't TeX.SE have a stricter policy regarding questions that contain links to some (possibly very long) .tex file hosted elsewhere? There is a danger, there. I doubt people who are willing to help check every single line of such files for malicious commands. With good intentions, they might download the file, compile it, run their makefile and live to regret it... – jubobs May 30 '13 at 20:08
up vote 11 down vote accepted

It depends how paranoid you are.

My texmf.cnf (default texlive 2012) says

% Allow TeX \openin, \openout, or \input on filenames starting with `.'
% (e.g., .rhosts) or outside the current tree (e.g., /etc/passwd)?
% a (any)        : any file can be opened.
% r (restricted) : disallow opening "dotfiles".
% p (paranoid)   : as `r' and disallow going to parent directories, and
%                  restrict absolute paths to be under $TEXMFOUTPUT.
openout_any = p
openin_any = a
  • So, for people who set option a, filecontents could be used to overwrite critical files on your hard drive; correct? – jubobs May 30 '13 at 19:49
  • No \write18{} ;-) – Marco Daniel May 30 '13 at 19:49
  • 1
    @Jubobs yes (If you have write access to the files) although as Marco indicates, if you allow -shell-escape then the same is true whatever this setting. – David Carlisle May 30 '13 at 19:58
  • 1
    @DavidCarlisle I think people are sufficiently warned about the potential dangers of -shell-escape, but I'm interested in what is possible even without it... – jubobs May 30 '13 at 20:00

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.