Questions tagged [security]

Questions about computer safety concerns when running TeX programs or viewing TeX-created documents. For questions about managing digital rights (e.g. password-protected documents) use the {drm} tag.

Filter by
Sorted by
Tagged with
0
votes
1answer
251 views

How secure is Overleaf? [closed]

Can I write my thesis on Overleaf? What is the guarantee that, nobody can access my thesis? Overleaf link
0
votes
0answers
71 views

Is there a list of Tex primitives or LaTeX macros which can prevent pdflatex from reading or writing to files if blacklisted? [duplicate]

Not using --shell-escape sandboxes pdflatex to some degree. Still, it is perfectly possible for it to, for instance, open and read files, e.g. through \input or Tex primitives such as \read. Is ...
0
votes
0answers
142 views

How to Flatten & Secure PDF Files?

From my readings of past and somewhat similar threads, it sounds like there is no LaTeX code for creating a PDF that is both "flattened" and "secured". Therefore, I need to compile the PDF then use ...
1
vote
1answer
116 views

Latex command escape

We are using latex for pdf generation on our server. I would like to increase the security of our system with latex command escaping for data content ie remove all latex / tex / xelatex executable ...
3
votes
1answer
459 views

Has TeX Live stopped signing the public repository?

Recently it appears to me that the TeX Live repository is no longer signed with the release PGP key. When using the tlmgr update command, it always reports tlmgr: package repository [mirrored repo ...
0
votes
0answers
291 views

How to get this Enigma example work with user input?

As in this question, Assume that you have some text in parts of your LaTeX document that you only want people with a password to see. A reason could e.g. be a case with an guiding answer. You want ...
3
votes
0answers
127 views

Is stripping backslashes enough to sanitize user generated input?

If I accept any input from the scary Internet to generate first a tex file and then a pdf using XeTeX in a server, is it enough to remove all backslashes and escape all the reserved characters #, %, $,...
18
votes
1answer
480 views

Security of \includegraphics with untrusted input

When using the \includegraphics command from the graphicx package, are there any security implications when using images from someone whom you don't trust, who may potentially be an adversary? If you'...
29
votes
2answers
2k views

Detecting harmful LaTeX code [duplicate]

I'm writing a website which allows users to enter some text in predefined text fields. This text gets passed on the server where a LaTeX document is created (containing the text entered by the user). ...
4
votes
1answer
437 views

How to attach a digital signature to my pdf created by xetex?

I want to create a locked document created by XeLaTeX, using \special command. The instructions are provided here. By setting perm as 0x0904 the document can be signed in Acrobat (If there has been a ...
30
votes
1answer
694 views

Is CTAN secure against attackers uploading bugged versions of well-known packages?

I was checking out how to make a CTAN package, and I was surprised that it does not involve making it account: you simply have to fill out a form. If you have a new version of a package, you simply ...
2
votes
1answer
200 views

LuaTex doesn't open installed packages with openin_any=p options

I plan to launch online LuaTeX compile service. I installed LuaTeX using TexLive 2015 in CentOS 7. For security concerns, I want to restrict opening files. Therefore, I set openin_any=p. But, it also ...
2
votes
1answer
359 views

Tex Live Package Security

To what extent is the code of the packages included in tex distributions reviewed with respect to malicious code. This is with respect to what is posted in documentation as well as what is actually ...
1
vote
0answers
97 views

aeb-pro / example sign

I using MikTeX 2.9. Right now I'm looking at Digitally signing the generated pdf. I ran accross the AcroTeX Education Bundle and am attempting to compile the example sign.tex from the aeb-pro examples....
3
votes
0answers
84 views

How can I prevent Latex from doing something “bad” to my computer? [duplicate]

More precisely, I want to run PDFLatex on a server and let it accept arbitrary .tex source files from users, returning the compiled pdf to them. However, obviously this introduces a security threat (...
6
votes
1answer
2k views

Security: Latex Injection Hack

I'm building a webapp that takes latex code from users, which is then compiled serverside. Now latex creates a huge system vulnerability since it is turing complete and you can basically hack the ...
0
votes
0answers
586 views

Protecting .pdf file created from latex [duplicate]

I know it is possible to protect file from printing with Adobe tools, but is this done on latex layer or with pdf tools? And is it also possible to protect created pdf file with password in following ...
34
votes
2answers
2k views

Reproducible LaTeX builds - compile to a file which always hashes to the same value

I am interested in using LaTeX in a way such that when I compile twice, I get the very same resulting file. My test.tex: \documentclass{article} \begin{document} Hello, World! \end{document} ...
3
votes
1answer
15k views

Safe installation of Texmaker Ubuntu 12.04

Is it safe to install Texmaker from Ubuntu Software Center? It is outdated and a newer version is available from the Texmaker projekt website, but I really do not want to install software from "...
8
votes
1answer
604 views

AVG: Biber listed as a trojan in TexLive 2014?

A few days ago I installed TexLive 2014 on Windows. I just compiled a document today to test it and Biber is recognized as a Trojan Horse by AVG Free. The message says: BackDoor.Generic18.ALDX. From ...
24
votes
2answers
10k views

How secure is sharelatex?

Background: One of my co-authors faced problem of compiling the paper that I had built using TexStudio and MikteX 2.9 on his Mac Machine running TexLive. ShareLaTeX Role: So, one solution is to use ...
3
votes
0answers
421 views

Serial key in pdf document [closed]

I don't know if it is a question to be asked here, but there is: I'm writting a ebook and I'm gonna to sell it soon. I'd sell it at Google Play Store, but here in Brazil they don't accept PayPal as ...
4
votes
0answers
178 views

Using LaTeX, can we prevent others from editing pdf file properties? [duplicate]

After opening a .pdf file with Adobe Acrobat, go through menu File->Properties->Description tab, we can see the fields such as Author, Subject, Title, Keywords etc. If the .pdf file is created with ...
4
votes
0answers
301 views

CTAN Mirror Integrity - Miktex Update

Does the Miktex Updater ensure that the downloaded packages from a CTAN mirror are not corrupted in comparison to the original version? When looking up the update log there are messages about a "...
0
votes
0answers
68 views

How to mark and secure a PDF document for distribution? [duplicate]

This might not be a 100% LaTeX question since it is a matter of PDFs, but I think that the LaTeX crowd is the most appropriate audience for it. I have an unpublished research paper that I am writing ...
2
votes
2answers
5k views

Protect scanned signature in a PDF [closed]

I would like to include a scanned signature in my PDF and send it via email. Call me a tin-foil hat but I know how easy it is to open a PDF using, say, inkscape and extract the signature graphics from ...
9
votes
4answers
2k views

Full version of TeX Live: malware checked?

I am wondering if texlive-full is bearing any security issues? Why everybody does trust it? Are they checked by anybody? Thanks for helping and educating me on this point :)
5
votes
1answer
343 views

XeLaTeX inside chroot jail

I'm using xetex 3.1415926-2.2-0.9995.2 (TeX Live 2009/Debian). I'm trying to run xelatex inside chroot jail. I've copied following binaries and directories: pdftex bibtex xdvipdfmx xelatex /usr/...
28
votes
3answers
2k views

Is Arara safe/secure

I have just begun playing around with arara and I am curious if there are safety/security concerns. For example, pdflatex from TeX Live has shell escape disabled by default. If the TeX Live team think ...
18
votes
1answer
445 views

How do CTAN maintainers make sure all the uploaded packages and classess in CTAN are free of malicious code?

There are a large number of packages (plus some classes) uploaded and updated in CTAN (other mirrors as well). How do the CTAN maintainers make sure the uploaded stuff is free of malicious code? Do ...
40
votes
1answer
1k views

Is luatex as secure as pdftex?

My texmf.cnf file contains these lines: % Allow TeX \openin, \openout, or \input on filenames starting with `.' % (e.g., .rhosts) or outside the current tree (e.g., /etc/passwd)? % a (any) : ...
4
votes
1answer
857 views

Equivalent to TeXLive's --restricted-shell-escape for MiKTeX?

I often work on Windows, so need to use MiKTeX. I recently found the minted package, which needs to call the external command pygmentize. I currently call xelatex with the -shell-escape option to ...
6
votes
1answer
1k views

Escaping special LaTeX characters in user-defined input text

Background Users can provide text, which is transformed using XSL into a LaTeX document. The XSL template that transforms the XML document (containing user-defined text) currently resembles: <xsl:...
9
votes
2answers
174 views

Is it possible to prevent users from seeing the package codes while they still can make use of its publicly exposed macros?

Assume that I have a confidential package that nobody is allowed to see the source code. The users are only allowed to use the public macros. This question is closely related to my other question. \...
11
votes
4answers
3k views

Is it necessary to disable virus scanner during TeX Live installation, and if so, why?

Is it necessary to disable virus scanner during TeX Live installation, and if so, why?
4
votes
2answers
1k views

Disable including of system files [duplicate]

Possible Duplicate: How can I safely compile other people's LaTeX documents? I've got a Linux server that is rendering LaTeX documents, I want to disable the access of LaTeX to system files ...
22
votes
1answer
29k views

How do I create a PDF file that can be digitally signed?

We are using Acrobat digital signatures in my organization. With Acrobat Professional you can put in a signature block that allows signing with a client-side digital signature. This is something ...
37
votes
4answers
9k views

Digital signature

I have recently been asked to add a digital signature to a report (which I wrote using pdflatex). Is there such a mechanism in the TeX/LaTeX world or am I better of using external software to verify ...
27
votes
3answers
2k views

How can I safely compile other people's LaTeX documents?

I am a programmer and as part of a website I need to be able to take LaTeX source files and compile them, then return the pdf to the user. This seems dangerous since a malicious user could e.g. read ...
11
votes
3answers
744 views

What analysis of Texlive's restricted permissions model exists?

TH. writes, in How should one use \write18 with BibTeX: Background Now that TeX Live 2010 has a restricted \write18, I figured it'd be reasonable to update my cv which uses the bibunits package ...