Bill Allombert wrote:
> When I spoke of security nightmare, this was exactly what I had in mind.
> You will never find a blacklist of command that prevent abuse, and the
> current certainly does not. For example \usepackage and \documentclass
> are not blacklisted so the attacker can load add-on packages that can
> add potentially dangerous commands.
I think no. My plugin insert \begin{document} before and \end{document}
after LaTeX code. And I have try to compile some files with more than
one document environement, that just compile the first document,
ignoring all after he first \end{document}. Because we have to put
\usepackage between \documentclass and \begin{document}. So we can't add
a package (but I'm not a LaTeX guru, if you can do that, I hear to you)
>
> I could not make sense of the criterium used for blacklisting,
> e.g. why blacklisting \mbox ? Why blacklisting \section but not
> \subsection ? why blacklisting \newcommand but not \newenvironment ?
I've copy pas blacklist from kopeteTeX Kopete's plugin... so... he's in
debian stable, and the way to make image is the same, ...
(http://packages.debian.org/cgi-bin/search_contents.pl?searchmode=filelist&word=kopete&version=stable&arch=i386
)
I think mbox is blacklisted, because gaim can render text alone,
section/subsection I don't know, \newcommand make new commands, and
newenvironnement make new environnement. The difference between the two
is that newenvironnement has to use existing commands (I think), so if
it use dangerous command, they have to be blacklisted.
One more time, I suppose your very better than me in security domain (I
have no special skills in computer science, I'm just a student not in
computer domain, who can write a little code)
>
> You can try the whitelist approach, but LaTeX was not written with this
> security requirement in mind so this is still potentially unsafe.
Yep, it's possible. I didn't write this to be "the most secure plugin to
write math" but just to have an easy way to explain some math/physik
things to friends. If he didn't go in "official" linux distribution,
that's not a problem. People who want such a thing can find it and
install it alone, with own risk.
Cheers
PS : sorry Bill Allombert, I just see that I have posted this to you not
to the mailling list
Attachment:
signature.asc
Description: OpenPGP digital signature