Questions tagged [security]
Questions about computer safety concerns when running TeX programs or viewing TeX-created documents. For questions about managing digital rights (e.g. password-protected documents) use the {drm} tag.
54
questions
1
vote
0
answers
39
views
Enabling signature verification in TeX Live 2024 (or 2023)
Is it still possible to enable verification of package signatures for TeX Live? According to the documentation, I need to set the option verify-repo with the value all, but all my attempts to do this ...
3
votes
1
answer
157
views
PDF Security/Encryption with LuaLaTeX
I was wondering whether it is possible to protect pdf files (e.g. control printing/copying/... access) with LuaLaTeX without using third-party software like QPDF or those listed in the pdfcrypt ...
6
votes
1
answer
170
views
Security Issue in TexLive: Someone changing the checksums?
Is someone tampering the checksum files of the TexLive installation on CTAN? Or is it just a server or download issue? If I download the checksum files repeatedly at the same time but using different ...
3
votes
0
answers
61
views
In TeX Live 2023, how can I make `tlmgr` honour setting `verify-repo = 1` in its configuration file?
I have been setting verify-repo to all in tlmgr's configuration file for some time. Having just installed TeX Live 2023, I did this for the new release. I then tried to confirm the value was set ...
0
votes
0
answers
202
views
Is there a secure way to use --shell-escape with untrusted content?
I'm planning to create a service that would allow users to render LaTeX documents online with TeX Live running on the server, and I would like to enable certain features (such as gnuplot) that require ...
2
votes
2
answers
995
views
LuaLaTeX: Is shell-escape not required? Does it really make lualatex more vulnerable as an application?
Few weeks ago when I did a fresh install of MacTeX 2020 and tried compiling some documents with command >>lualatex filename.tex I would get this error: attempt to call a nil value (field 'cpath ...
0
votes
0
answers
3k
views
Warning during compilation and its slowing down (security risk)
after upgrading to MiKTeX 20.11 (Texmaker 4.5) I've found an error in Message/Log block:
: security risk: running with elevated privileges
The main problem is that there is a significant slowdown ...
0
votes
0
answers
95
views
How does one trust a ConTeXt installation?
I want to download the ConTeXt source code from a GitHub mirror, such that I can select a version by checking out a commit.
This is where the problem of verifying that this code hasn't been tampered ...
3
votes
1
answer
166
views
Why is `openin_any = p` restricting access to packages in TEXMFDIST?
I'm using openin_any = p (set in a custom TEXMFCNF) as an additional line of defense in an application that runs on (partially) user-provided LaTeX code. This used to work fine, but after updating to ...
14
votes
2
answers
3k
views
Security in autogenerated latex scripts. How to avoid LaTeX Injection?
I have TeX Live 2019 installed on my server and generate PDFs from a LaTeX-Template with a server-side scripting language (PHP 7). I have to insert data from the database (untrusted data) and also ...
3
votes
1
answer
3k
views
Protect image of signature in PDF from being copied
When I write letters that need to be sent via snail mail, I print them out and sign them manually.
In the case of letters that can be sent via e-mail, I add an image of my signature using ...
106
votes
5
answers
19k
views
Are there any dangerous commands in LaTeX?
I encountered this question: What is the most dangerous command in SQL?. And a similar one came to my mind,
Are there any dangerous commands in LaTeX?
By dangerous we may mean any or all of these ...
2
votes
0
answers
633
views
metapost refuses to execute commands when using pdflatex with option --output-directory
I'm trying to exploit CVE-2016-10243 vulnerability (I enabled mpost in texmf.cnf, so it works also for newer Tex Live versions):
https://www.cvedetails.com/cve/CVE-2016-10243/
https://scumjr.github....
2
votes
0
answers
100
views
Detect and act on tampering/re-printing of PDF
Is there a way to make a LaTeX-produced PDF file appear wildly different if someone has modified it (i.e. by opening it in a PDF reader application, and using the "Print to PDF" feature)?
In short, I ...
0
votes
1
answer
313
views
restricting the folders available in \input (etc) in LaTeX
I am running LaTeX on a server, users are collaborating and contributing files and the server runs LaTeX on a root file I produce which \inputs user files (each user has her own special folder). The ...
0
votes
0
answers
82
views
Is there a list of Tex primitives or LaTeX macros which can prevent pdflatex from reading or writing to files if blacklisted? [duplicate]
Not using --shell-escape sandboxes pdflatex to some degree. Still, it is perfectly possible for it to, for instance, open and read files, e.g. through \input or Tex primitives such as \read.
Is ...
0
votes
0
answers
1k
views
How to Flatten & Secure PDF Files?
From my readings of past and somewhat similar threads, it sounds like there is no LaTeX code for creating a PDF that is both "flattened" and "secured". Therefore, I need to compile the PDF then use ...
2
votes
1
answer
525
views
Latex command escape
We are using latex for pdf generation on our server.
I would like to increase the security of our system with latex command escaping for data content ie remove all latex / tex / xelatex executable ...
3
votes
1
answer
960
views
Has TeX Live stopped signing the public repository?
Recently it appears to me that the TeX Live repository is no longer signed with the release PGP key. When using the tlmgr update command, it always reports tlmgr: package repository [mirrored repo ...
0
votes
0
answers
473
views
How to get this Enigma example work with user input?
As in this question,
Assume that you have some text in parts of your LaTeX document that you only want people with a password to see. A reason could e.g. be a case with an guiding answer. You want ...
3
votes
0
answers
291
views
Is stripping backslashes enough to sanitize user generated input?
If I accept any input from the scary Internet to generate first a tex file and then a pdf using XeTeX in a server, is it enough to remove all backslashes and escape all the reserved characters #, %, $,...
20
votes
1
answer
1k
views
Security of \includegraphics with untrusted input
When using the \includegraphics command from the graphicx package, are there any security implications when using images from someone whom you don't trust, who may potentially be an adversary?
If you'...
29
votes
2
answers
3k
views
Detecting harmful LaTeX code [duplicate]
I'm writing a website which allows users to enter some text in predefined text fields. This text gets passed on the server where a LaTeX document is created (containing the text entered by the user). ...
4
votes
1
answer
1k
views
How to attach a digital signature to my pdf created by xetex?
I want to create a locked document created by XeLaTeX, using \special command. The instructions are provided here. By setting perm as 0x0904 the document can be signed in Acrobat (If there has been a ...
32
votes
1
answer
1k
views
Is CTAN secure against attackers uploading bugged versions of well-known packages?
I was checking out how to make a CTAN package, and I was surprised that it does not involve making it account: you simply have to fill out a form. If you have a new version of a package, you simply ...
2
votes
1
answer
358
views
LuaTex doesn't open installed packages with openin_any=p options
I plan to launch online LuaTeX compile service.
I installed LuaTeX using TexLive 2015 in CentOS 7.
For security concerns, I want to restrict opening files.
Therefore, I set openin_any=p.
But, it also ...
3
votes
1
answer
669
views
Tex Live Package Security
To what extent is the code of the packages included in tex distributions reviewed with respect to malicious code.
This is with respect to what is posted in documentation as well as what is actually ...
1
vote
0
answers
149
views
aeb-pro / example sign
I using MikTeX 2.9. Right now I'm looking at Digitally signing the generated pdf. I ran accross the AcroTeX Education Bundle and am attempting to compile the example sign.tex from the aeb-pro examples....
3
votes
0
answers
147
views
How can I prevent Latex from doing something "bad" to my computer? [duplicate]
More precisely, I want to run PDFLatex on a server and let it accept arbitrary .tex source files from users, returning the compiled pdf to them. However, obviously this introduces a security threat (...
7
votes
1
answer
9k
views
Security: Latex Injection Hack
I'm building a webapp that takes latex code from users, which is then compiled serverside. Now latex creates a huge system vulnerability since it is turing complete and you can basically hack the ...
0
votes
0
answers
975
views
Protecting .pdf file created from latex [duplicate]
I know it is possible to protect file from printing with Adobe tools, but is this done on latex layer or with pdf tools? And is it also possible to protect created pdf file with password in following ...
59
votes
3
answers
4k
views
Reproducible LaTeX builds - compile to a file which always hashes to the same value
I am interested in using LaTeX in a way such that when I compile twice, I get the very same resulting file.
My test.tex:
\documentclass{article}
\begin{document}
Hello, World!
\end{document}
...
3
votes
1
answer
16k
views
Safe installation of Texmaker Ubuntu 12.04
Is it safe to install Texmaker from Ubuntu Software Center? It is outdated and a newer version is available from the Texmaker projekt website, but I really do not want to install software from "...
8
votes
1
answer
690
views
AVG: Biber listed as a trojan in TexLive 2014?
A few days ago I installed TexLive 2014 on Windows. I just compiled a document today to test it and Biber is recognized as a Trojan Horse by AVG Free. The message says: BackDoor.Generic18.ALDX. From ...
25
votes
2
answers
11k
views
How secure is sharelatex?
Background: One of my co-authors faced problem of compiling the paper that I had built using TexStudio and MikteX 2.9 on his Mac Machine running TexLive.
ShareLaTeX Role: So, one solution is to use ...
3
votes
0
answers
453
views
Serial key in pdf document [closed]
I don't know if it is a question to be asked here, but there is: I'm writting a ebook and I'm gonna to sell it soon.
I'd sell it at Google Play Store, but here in Brazil they don't accept PayPal as ...
5
votes
0
answers
618
views
Using LaTeX, can we prevent others from editing pdf file properties? [duplicate]
After opening a .pdf file with Adobe Acrobat, go through menu File->Properties->Description tab, we can see the fields such as Author, Subject, Title, Keywords etc. If the .pdf file is created with ...
6
votes
0
answers
359
views
CTAN Mirror Integrity - Miktex Update
Does the Miktex Updater ensure that the downloaded packages from a CTAN mirror are not corrupted in comparison to the original version?
When looking up the update log there are messages about a "...
1
vote
0
answers
115
views
How to mark and secure a PDF document for distribution? [duplicate]
This might not be a 100% LaTeX question since it is a matter of PDFs, but I think that the LaTeX crowd is the most appropriate audience for it.
I have an unpublished research paper that I am writing ...
3
votes
2
answers
6k
views
Protect scanned signature in a PDF [closed]
I would like to include a scanned signature in my PDF and send it via email. Call me a tin-foil hat but I know how easy it is to open a PDF using, say, inkscape and extract the signature graphics from ...
11
votes
4
answers
4k
views
Full version of TeX Live: malware checked?
I am wondering if texlive-full is bearing any security issues? Why everybody does trust it? Are they checked by anybody?
Thanks for helping and educating me on this point :)
5
votes
1
answer
424
views
XeLaTeX inside chroot jail
I'm using xetex 3.1415926-2.2-0.9995.2 (TeX Live 2009/Debian).
I'm trying to run xelatex inside chroot jail.
I've copied following binaries and directories:
pdftex
bibtex
xdvipdfmx
xelatex
/usr/...
28
votes
3
answers
2k
views
Is Arara safe/secure
I have just begun playing around with arara and I am curious if there are safety/security concerns. For example, pdflatex from TeX Live has shell escape disabled by default. If the TeX Live team think ...
19
votes
1
answer
622
views
How do CTAN maintainers make sure all the uploaded packages and classess in CTAN are free of malicious code?
There are a large number of packages (plus some classes) uploaded and updated in CTAN (other mirrors as well). How do the CTAN maintainers make sure the uploaded stuff is free of malicious code? Do ...
48
votes
3
answers
2k
views
Is luatex as secure as pdftex?
My texmf.cnf file contains these lines:
% Allow TeX \openin, \openout, or \input on filenames starting with `.'
% (e.g., .rhosts) or outside the current tree (e.g., /etc/passwd)?
% a (any) : ...
4
votes
1
answer
1k
views
Equivalent to TeXLive's --restricted-shell-escape for MiKTeX?
I often work on Windows, so need to use MiKTeX. I recently found the minted package, which needs to call the external command pygmentize. I currently call xelatex with the -shell-escape option to ...
6
votes
1
answer
2k
views
Escaping special LaTeX characters in user-defined input text
Background
Users can provide text, which is transformed using XSL into a LaTeX document. The XSL template that transforms the XML document (containing user-defined text) currently resembles:
<xsl:...
9
votes
2
answers
195
views
Is it possible to prevent users from seeing the package codes while they still can make use of its publicly exposed macros?
Assume that I have a confidential package that nobody is allowed to see the source code. The users are only allowed to use the public macros. This question is closely related to my other question.
\...
11
votes
4
answers
4k
views
Is it necessary to disable virus scanner during TeX Live installation, and if so, why?
Is it necessary to disable virus scanner during TeX Live installation, and if so, why?
5
votes
2
answers
2k
views
Disable including of system files [duplicate]
Possible Duplicate:
How can I safely compile other people's LaTeX documents?
I've got a Linux server that is rendering LaTeX documents, I want to disable the access of LaTeX to system files ...