Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [security]

Questions about computer safety concerns when running TeX programs or viewing TeX-created documents. For questions about managing digital rights (e.g. password-protected documents) use the {drm} tag.

Filter by
Sorted by
Tagged with
0 votes
0 answers
72 views

Enabling signature verification in TeX Live 2024 (or 2023)

Is it still possible to require verification of all package signatures for TeX Live? According to the documentation, I need to set the option verify-repo with the value all, but all my attempts to do ...
cfr's user avatar
  • 203k
3 votes
1 answer
208 views

PDF Security/Encryption with LuaLaTeX

I was wondering whether it is possible to protect pdf files (e.g. control printing/copying/... access) with LuaLaTeX without using third-party software like QPDF or those listed in the pdfcrypt ...
Dave's user avatar
  • 133
5 votes
1 answer
197 views

Security Issue in TexLive: Someone changing the checksums?

Is someone tampering the checksum files of the TexLive installation on CTAN? Or is it just a server or download issue? If I download the checksum files repeatedly at the same time but using different ...
krfl's user avatar
  • 111
3 votes
0 answers
87 views

In TeX Live 2023, how can I make `tlmgr` honour setting `verify-repo = 1` in its configuration file?

I have been setting verify-repo to all in tlmgr's configuration file for some time. Having just installed TeX Live 2023, I did this for the new release. I then tried to confirm the value was set ...
cfr's user avatar
  • 203k
0 votes
0 answers
212 views

Is there a secure way to use --shell-escape with untrusted content?

I'm planning to create a service that would allow users to render LaTeX documents online with TeX Live running on the server, and I would like to enable certain features (such as gnuplot) that require ...
ttsc's user avatar
  • 415
2 votes
2 answers
1k views

LuaLaTeX: Is shell-escape not required? Does it really make lualatex more vulnerable as an application?

Few weeks ago when I did a fresh install of MacTeX 2020 and tried compiling some documents with command >>lualatex filename.tex I would get this error: attempt to call a nil value (field 'cpath ...
codepoet's user avatar
  • 1,316
0 votes
0 answers
3k views

Warning during compilation and its slowing down (security risk)

after upgrading to MiKTeX 20.11 (Texmaker 4.5) I've found an error in Message/Log block: : security risk: running with elevated privileges The main problem is that there is a significant slowdown ...
Zdeněk's user avatar
0 votes
0 answers
95 views

How does one trust a ConTeXt installation?

I want to download the ConTeXt source code from a GitHub mirror, such that I can select a version by checking out a commit. This is where the problem of verifying that this code hasn't been tampered ...
Ibex's user avatar
  • 1
3 votes
1 answer
171 views

Why is `openin_any = p` restricting access to packages in TEXMFDIST?

I'm using openin_any = p (set in a custom TEXMFCNF) as an additional line of defense in an application that runs on (partially) user-provided LaTeX code. This used to work fine, but after updating to ...
ThiefMaster's user avatar
14 votes
2 answers
3k views

Security in autogenerated latex scripts. How to avoid LaTeX Injection?

I have TeX Live 2019 installed on my server and generate PDFs from a LaTeX-Template with a server-side scripting language (PHP 7). I have to insert data from the database (untrusted data) and also ...
Awaaaaarghhh's user avatar
3 votes
1 answer
3k views

Protect image of signature in PDF from being copied

When I write letters that need to be sent via snail mail, I print them out and sign them manually. In the case of letters that can be sent via e-mail, I add an image of my signature using ...
Philipp's user avatar
  • 1,595
106 votes
5 answers
19k views

Are there any dangerous commands in LaTeX?

I encountered this question: What is the most dangerous command in SQL?. And a similar one came to my mind, Are there any dangerous commands in LaTeX? By dangerous we may mean any or all of these ...
Masroor's user avatar
  • 17.9k
2 votes
0 answers
652 views

metapost refuses to execute commands when using pdflatex with option --output-directory

I'm trying to exploit CVE-2016-10243 vulnerability (I enabled mpost in texmf.cnf, so it works also for newer Tex Live versions): https://www.cvedetails.com/cve/CVE-2016-10243/ https://scumjr.github....
Awaaaaarghhh's user avatar
2 votes
0 answers
105 views

Detect and act on tampering/re-printing of PDF

Is there a way to make a LaTeX-produced PDF file appear wildly different if someone has modified it (i.e. by opening it in a PDF reader application, and using the "Print to PDF" feature)? In short, I ...
Cloud's user avatar
  • 235
0 votes
1 answer
325 views

restricting the folders available in \input (etc) in LaTeX

I am running LaTeX on a server, users are collaborating and contributing files and the server runs LaTeX on a root file I produce which \inputs user files (each user has her own special folder). The ...
Richard's user avatar
0 votes
0 answers
83 views

Is there a list of Tex primitives or LaTeX macros which can prevent pdflatex from reading or writing to files if blacklisted? [duplicate]

Not using --shell-escape sandboxes pdflatex to some degree. Still, it is perfectly possible for it to, for instance, open and read files, e.g. through \input or Tex primitives such as \read. Is ...
user181983's user avatar
0 votes
0 answers
1k views

How to Flatten & Secure PDF Files?

From my readings of past and somewhat similar threads, it sounds like there is no LaTeX code for creating a PDF that is both "flattened" and "secured". Therefore, I need to compile the PDF then use ...
WeCanLearnAnything's user avatar
2 votes
1 answer
533 views

Latex command escape

We are using latex for pdf generation on our server. I would like to increase the security of our system with latex command escaping for data content ie remove all latex / tex / xelatex executable ...
sherif's user avatar
  • 177
3 votes
1 answer
985 views

Has TeX Live stopped signing the public repository?

Recently it appears to me that the TeX Live repository is no longer signed with the release PGP key. When using the tlmgr update command, it always reports tlmgr: package repository [mirrored repo ...
Cong Ma's user avatar
  • 351
0 votes
0 answers
484 views

How to get this Enigma example work with user input?

As in this question, Assume that you have some text in parts of your LaTeX document that you only want people with a password to see. A reason could e.g. be a case with an guiding answer. You want ...
Léo Léopold Hertz 준영's user avatar
3 votes
0 answers
294 views

Is stripping backslashes enough to sanitize user generated input?

If I accept any input from the scary Internet to generate first a tex file and then a pdf using XeTeX in a server, is it enough to remove all backslashes and escape all the reserved characters #, %, $,...
Victor's user avatar
  • 285
20 votes
1 answer
1k views

Security of \includegraphics with untrusted input

When using the \includegraphics command from the graphicx package, are there any security implications when using images from someone whom you don't trust, who may potentially be an adversary? If you'...
caw's user avatar
  • 318
29 votes
2 answers
3k views

Detecting harmful LaTeX code [duplicate]

I'm writing a website which allows users to enter some text in predefined text fields. This text gets passed on the server where a LaTeX document is created (containing the text entered by the user). ...
edo's user avatar
  • 455
4 votes
1 answer
1k views

How to attach a digital signature to my pdf created by xetex?

I want to create a locked document created by XeLaTeX, using \special command. The instructions are provided here. By setting perm as 0x0904 the document can be signed in Acrobat (If there has been a ...
cainmagi's user avatar
32 votes
1 answer
1k views

Is CTAN secure against attackers uploading bugged versions of well-known packages?

I was checking out how to make a CTAN package, and I was surprised that it does not involve making it account: you simply have to fill out a form. If you have a new version of a package, you simply ...
Bram Geron's user avatar
2 votes
1 answer
362 views

LuaTex doesn't open installed packages with openin_any=p options

I plan to launch online LuaTeX compile service. I installed LuaTeX using TexLive 2015 in CentOS 7. For security concerns, I want to restrict opening files. Therefore, I set openin_any=p. But, it also ...
garasubo's user avatar
3 votes
1 answer
681 views

Tex Live Package Security

To what extent is the code of the packages included in tex distributions reviewed with respect to malicious code. This is with respect to what is posted in documentation as well as what is actually ...
kando's user avatar
  • 1,338
1 vote
0 answers
149 views

aeb-pro / example sign

I using MikTeX 2.9. Right now I'm looking at Digitally signing the generated pdf. I ran accross the AcroTeX Education Bundle and am attempting to compile the example sign.tex from the aeb-pro examples....
infowanna's user avatar
  • 583
3 votes
0 answers
148 views

How can I prevent Latex from doing something "bad" to my computer? [duplicate]

More precisely, I want to run PDFLatex on a server and let it accept arbitrary .tex source files from users, returning the compiled pdf to them. However, obviously this introduces a security threat (...
lukas.coenig's user avatar
7 votes
1 answer
9k views

Security: Latex Injection Hack

I'm building a webapp that takes latex code from users, which is then compiled serverside. Now latex creates a huge system vulnerability since it is turing complete and you can basically hack the ...
bersling's user avatar
  • 433
0 votes
0 answers
975 views

Protecting .pdf file created from latex [duplicate]

I know it is possible to protect file from printing with Adobe tools, but is this done on latex layer or with pdf tools? And is it also possible to protect created pdf file with password in following ...
KernelPanic's user avatar
59 votes
3 answers
4k views

Reproducible LaTeX builds - compile to a file which always hashes to the same value

I am interested in using LaTeX in a way such that when I compile twice, I get the very same resulting file. My test.tex: \documentclass{article} \begin{document} Hello, World! \end{document} ...
Frederick Nord's user avatar
3 votes
1 answer
16k views

Safe installation of Texmaker Ubuntu 12.04

Is it safe to install Texmaker from Ubuntu Software Center? It is outdated and a newer version is available from the Texmaker projekt website, but I really do not want to install software from "...
Guest's user avatar
  • 31
8 votes
1 answer
690 views

AVG: Biber listed as a trojan in TexLive 2014?

A few days ago I installed TexLive 2014 on Windows. I just compiled a document today to test it and Biber is recognized as a Trojan Horse by AVG Free. The message says: BackDoor.Generic18.ALDX. From ...
pluton's user avatar
  • 16.4k
25 votes
2 answers
11k views

How secure is sharelatex?

Background: One of my co-authors faced problem of compiling the paper that I had built using TexStudio and MikteX 2.9 on his Mac Machine running TexLive. ShareLaTeX Role: So, one solution is to use ...
Espanta's user avatar
  • 1,069
3 votes
0 answers
454 views

Serial key in pdf document [closed]

I don't know if it is a question to be asked here, but there is: I'm writting a ebook and I'm gonna to sell it soon. I'd sell it at Google Play Store, but here in Brazil they don't accept PayPal as ...
mvfs314's user avatar
  • 543
5 votes
0 answers
619 views

Using LaTeX, can we prevent others from editing pdf file properties? [duplicate]

After opening a .pdf file with Adobe Acrobat, go through menu File->Properties->Description tab, we can see the fields such as Author, Subject, Title, Keywords etc. If the .pdf file is created with ...
gyou's user avatar
  • 51
6 votes
0 answers
359 views

CTAN Mirror Integrity - Miktex Update

Does the Miktex Updater ensure that the downloaded packages from a CTAN mirror are not corrupted in comparison to the original version? When looking up the update log there are messages about a "...
Mar's user avatar
  • 61
1 vote
0 answers
115 views

How to mark and secure a PDF document for distribution? [duplicate]

This might not be a 100% LaTeX question since it is a matter of PDFs, but I think that the LaTeX crowd is the most appropriate audience for it. I have an unpublished research paper that I am writing ...
Zorbx's user avatar
  • 11
3 votes
2 answers
6k views

Protect scanned signature in a PDF [closed]

I would like to include a scanned signature in my PDF and send it via email. Call me a tin-foil hat but I know how easy it is to open a PDF using, say, inkscape and extract the signature graphics from ...
Gerome Bochmann's user avatar
11 votes
4 answers
5k views

Full version of TeX Live: malware checked?

I am wondering if texlive-full is bearing any security issues? Why everybody does trust it? Are they checked by anybody? Thanks for helping and educating me on this point :)
Barbara's user avatar
  • 111
5 votes
1 answer
426 views

XeLaTeX inside chroot jail

I'm using xetex 3.1415926-2.2-0.9995.2 (TeX Live 2009/Debian). I'm trying to run xelatex inside chroot jail. I've copied following binaries and directories: pdftex bibtex xdvipdfmx xelatex /usr/...
Gregory Kalabin's user avatar
28 votes
3 answers
2k views

Is Arara safe/secure

I have just begun playing around with arara and I am curious if there are safety/security concerns. For example, pdflatex from TeX Live has shell escape disabled by default. If the TeX Live team think ...
StrongBad's user avatar
  • 20.6k
19 votes
1 answer
627 views

How do CTAN maintainers make sure all the uploaded packages and classess in CTAN are free of malicious code?

There are a large number of packages (plus some classes) uploaded and updated in CTAN (other mirrors as well). How do the CTAN maintainers make sure the uploaded stuff is free of malicious code? Do ...
kiss my armpit's user avatar
48 votes
3 answers
2k views

Is luatex as secure as pdftex?

My texmf.cnf file contains these lines: % Allow TeX \openin, \openout, or \input on filenames starting with `.' % (e.g., .rhosts) or outside the current tree (e.g., /etc/passwd)? % a (any) : ...
Paul Gaborit's user avatar
4 votes
1 answer
1k views

Equivalent to TeXLive's --restricted-shell-escape for MiKTeX?

I often work on Windows, so need to use MiKTeX. I recently found the minted package, which needs to call the external command pygmentize. I currently call xelatex with the -shell-escape option to ...
Daniel H's user avatar
  • 373
6 votes
1 answer
2k views

Escaping special LaTeX characters in user-defined input text

Background Users can provide text, which is transformed using XSL into a LaTeX document. The XSL template that transforms the XML document (containing user-defined text) currently resembles: <xsl:...
Dave Jarvis's user avatar
9 votes
2 answers
195 views

Is it possible to prevent users from seeing the package codes while they still can make use of its publicly exposed macros?

Assume that I have a confidential package that nobody is allowed to see the source code. The users are only allowed to use the public macros. This question is closely related to my other question. \...
kiss my armpit's user avatar
11 votes
4 answers
4k views

Is it necessary to disable virus scanner during TeX Live installation, and if so, why?

Is it necessary to disable virus scanner during TeX Live installation, and if so, why?
kiss my armpit's user avatar
5 votes
2 answers
2k views

Disable including of system files [duplicate]

Possible Duplicate: How can I safely compile other people's LaTeX documents? I've got a Linux server that is rendering LaTeX documents, I want to disable the access of LaTeX to system files ...
Dig's user avatar
  • 291