1

We are using latex for pdf generation on our server. I would like to increase the security of our system with latex command escaping for data content ie remove all latex / tex / xelatex executable code. My question is if it is enough to remove the '\' character? Or are there any other special characters I should remove as well?

2

You don't have to remove them, just use \detokenize{...} around all unknown data then \ (and ^ which you also need to make safe) will just be normal characters that that typeset as themselves) (you probably want to make % catcode 12 as well.

  • Thanks I will definitely use this but unfortunately this is not enough.You can simply use }{ and the escaping does not work anymore i.e:\detokenize{bla }{\input{/etc/passwd} blo} also they may be a use case where I need to enable some latex commands for example \thepage. Do you know any other dangerous characters except \ and ^ ? – sherif Nov 20 '17 at 17:22
  • @sherif I was assuming the incoming data was plain text without any tex commands so wouldn't have any tex commands needing {} – David Carlisle Nov 20 '17 at 18:22
  • Well me too but that changed yesterday :D Is it possible to close detokenize any other way than } ? – sherif Nov 21 '17 at 7:01
  • Ok so I have read a little about catcodes If I blacklist the \catcode command (and \def of course ) in the entire document then I can assume that there is no way to escape detokenize except using }. If there is no package declaring another cat 2 character – sherif Nov 21 '17 at 7:18
  • 1
    @sherif probably not, if you make ^ and \ safe then you can't access any tex commands other than active characters for things like utf8 decoding, although it depends what you mean by dangerous null (ascii 0) is by default has teh catcode of an invalid character so if you get it on input you will get a tex error (it can't redefine anything but it might stop your job) – David Carlisle Nov 23 '17 at 13:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.